{ "Event": { "published": true, "date": "2026-03-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-10", "timestamp": 1773187382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "bd439c11-bf05-40d3-9c12-a3288d2a49ae", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc01450-1cb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773171143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773171143, "uuid": "115f3cd6-209b-4684-8dc9-7483a47b4d1e", "comment": "Malware payload", "value": "20660efa5e26e086c7862625d706b7b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773171143, "uuid": "f61e9242-90b3-495a-bd6d-4f389681cb5e", "comment": "Malware payload", "value": "000b095e3daa69f473bb4cba9cb29ff85da3043f393bd624a82f966c0ab2b35e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773171143, "uuid": "a478a966-8aa3-4b86-a0f6-5d328f71e8e2", "comment": "Malware payload", "value": "205b45fed0ae87070a71ecba5cfdec1dcc143c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773171143, "uuid": "5b2a5855-affb-4a7a-8499-d28ae8ebf93c", "comment": "Malware payload", "value": "50bd6d26f6361fc82e2f51d27ba0ed6221ffae25c8d9744b196086765661358e3602420183c71017f9e17054cf54cbf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773171143, "uuid": "22a25610-0566-447a-9430-499b3105d29a", "value": "T10A42D6AF195460F8C57AF1B8CB666502BC31709407352BD35B6297F90B22FECAA79B04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773171143, "uuid": "f26b075c-bf46-4814-9ced-e4e3263d8b08", "value": "192:+9BzxgyFZC7GMWs8nkdb+79g5Qr8aaaole33NoKMjG/Zu:+VXDJ11fy5Qr9aajMjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773171143, "uuid": "e5f9ecf9-1800-4d08-9629-c1453a1233f0", "value": 13032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773171143, "uuid": "65b0a7dd-1aff-4c5f-a1bc-6affcd8bbf59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773171143, "uuid": "66751320-f4ce-4b35-a87f-8652329fb047", "value": "sys.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d641d0-1cc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773177565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177565, "uuid": "80b1eac5-9ccb-44df-8ccb-61925aee8982", "comment": "Malware payload", "value": "22c344f299d9438e3871b025b91230e6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177565, "uuid": "48f5d9c9-650d-4ea7-aaf4-4167fdb91600", "comment": "Malware payload", "value": "036c343cd3825c27561c09b0bdd04bcb6ef5a44394d0743a5ba5796edd2cff8b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177565, "uuid": "8fbcff37-775f-4a34-a7d0-e98d149abff5", "comment": "Malware payload", "value": "fb49c1a8b3664a844fbaa07b5d5acebfd8664bdd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177565, "uuid": "bd614c6e-760d-42ab-9ea4-1e6556f6a158", "comment": "Malware payload", "value": "91c83925cf642800922b68f862843b28a5a56efe1d91c7bd3f790cd43502c7faf5627614d679101493ffb4501e847756", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177565, "uuid": "11666361-b95e-42c6-bb52-ebf4025a5701", "value": "T1B0925CB916496C79BBC0DE7D9F3C7F0CADE881C02218A39CBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177565, "uuid": "10d054e6-e8c3-42e0-8748-463c987b8cca", "value": "384:CKO0M3vgRjGlsaq77zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:CKMmjfHzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773177565, "uuid": "50a8891c-cbd0-4df9-9eda-d4b61543f556", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773177565, "uuid": "284f97e1-0683-414a-a15f-54d8141bde73", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177565, "uuid": "48d445eb-3dd7-4df8-b728-c89674989d85", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c469183-1cbd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773173451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173451, "uuid": "265aa0de-612b-462a-9a59-c04eb809417d", "comment": "Malware payload (Mirai)", "value": "e35fb69c306480dfc879255ad1891018", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173451, "uuid": "d7c2c44f-225b-498a-8d12-2f673196d0b5", "comment": "Malware payload (Mirai)", "value": "03bb7a58beb30b1b6af87beb2a3cdc136e0f5de706852ac97124926f5e0481c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173451, "uuid": "e4f4f959-e9df-41f4-a37b-389511a50e03", "comment": "Malware payload (Mirai)", "value": "8915035383e53f6b7f0a4fcb2024003fda47e244", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173451, "uuid": "a3d222df-597a-459b-83ca-56a6ce19fd0c", "comment": "Malware payload (Mirai)", "value": "1f676e8a6c312a4a2ab86aa0b87fa6f6893db9b979830aed312599b3b3854f9bf61c0923e14c016239ccdad01e047e27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773173451, "uuid": "acabd8d2-aa41-42b6-91c8-21f9c0808851", "value": "T125930782BC81EA16C7D0137BFA6F108E331567D8E1DA3242DD251FA47BCA81F0D6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773173451, "uuid": "141b0581-cddf-4f6b-9b33-e372355c04b4", "value": "1536:NBywrO+bV2LkKsZCPgtAURwaxmXzsk0gDmvzdJq9xB8t46bZpCXJdwyU:NBg+bVqkAxJVQJgz84wZuJd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773173451, "uuid": "b4f0eb88-3200-4f50-99b5-1883aa40778f", "value": 91132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773173451, "uuid": "9045bb8e-9544-433c-9954-c71b1a796a2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773173451, "uuid": "cc2be126-7e38-4c42-b115-42e31930db74", "value": "MMaaRRiiOisecTanee.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e92234-1c68-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773137033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137033, "uuid": "0c5c9c1d-a2ef-4618-a68c-746f33079408", "comment": "Malware payload (AgentTesla)", "value": "9b6e504022bd988d28a804440284c03a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137033, "uuid": "1fa47a5f-ac09-4cec-a03d-6b4492ef1734", "comment": "Malware payload (AgentTesla)", "value": "03ef900249f9237d80ac65c42b5a17784183b1c67525e6799ec7cdb76e77bc3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137033, "uuid": "bdc5560c-93e6-4060-a334-27c08c773db4", "comment": "Malware payload (AgentTesla)", "value": "4846e0545bb2df8d345b97243b52f6c5c7326ede", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137033, "uuid": "952a19e5-2a1d-4b40-9194-425c16878222", "comment": "Malware payload (AgentTesla)", "value": "40eeacb405663f2af7b7fd53765b7e2ec7c1307d7c1131ec682f2d1aea4b6cfe5ed649e0d1fdf9e3e0f80b6912a567fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137033, "uuid": "17a088ec-d6b2-4b42-a9b7-92a34d1dbd22", "value": "T1B1D231CD79C6B16883013033A95FF49BF13F9C816C9CD958D9D5B898A8A4B38D0B587E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137033, "uuid": "b2db9cd9-7321-4263-83d3-340b849f0036", "value": "768:rYCaJY9UL3nmmFbrfMwFkkIplRDwqbOfihoiL:rYCkLmmFtS9/RMqaaho4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773137033, "uuid": "a07825f0-eca0-4358-8fed-c032993293cb", "value": 28985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773137033, "uuid": "e330c3b9-cff7-45ea-bf42-32342e11294f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137033, "uuid": "3b5b6db2-2276-4cfc-af6d-048442c829e0", "value": "Orderen.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafc5e6d-1cb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773168563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168563, "uuid": "8d22e161-b08a-4380-a056-29741ea00204", "comment": "Malware payload", "value": "9f64ea9bfd8954057df175532d27088a", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168563, "uuid": "365f3349-c018-4784-8d79-1dcc6c499c81", "comment": "Malware payload", "value": "08887f949d9a15dba1d89e4a0a4e37435856cd0de5f3d739f1fad40382bed71b", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168563, "uuid": "d28ca857-db3c-4f00-bb9a-3e1860418df9", "comment": "Malware payload", "value": "58e348df4088d9fdcf7a7d37eec0a04575127a8b", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168563, "uuid": "5eb5660c-19ee-4b17-baca-2c227681c4fa", "comment": "Malware payload", "value": "67c9fea50afe77aebe06e71c5fbc3ddf28a9a31643dce555755804f958105383191ebb64763ca6e6e1c0381777f8360d", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168563, "uuid": "cbe2c224-8a3f-4b75-9257-c2eb088a9009", "value": "T1AE37AD19A3E504A1D41BCA388626C333CAB5BDA38635C10F395DE7861F37D529F6FA21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168563, "uuid": "21acd7c9-38b7-4adc-9ece-4450b9ef8c65", "value": "c408d5c45cb005ed3b8a08b7f7ecefdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168563, "uuid": "d791616d-5158-4afd-bee6-5bd4faa40e3f", "value": "393216:ZZQl3drcNHkip68QyvRwrl2T7+wzmddtPD4lQWn:k46CGKydtMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773168563, "uuid": "49868e72-beea-484f-b53f-a864386805ed", "value": 23367680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773168563, "uuid": "e5919b8d-34b6-424b-819c-7533e44bce16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168563, "uuid": "4e571bdc-23cc-4221-bf7f-17d39fde79ed", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d62b22-1c91-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773154626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154626, "uuid": "486cd65d-f81e-4cbf-adb8-3de9847c848f", "comment": "Malware payload (njrat)", "value": "0ef956dd02e25df45ddfd4dec38b8fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154626, "uuid": "27eadcc8-327d-4ff6-9c63-10b25e991ac2", "comment": "Malware payload (njrat)", "value": "08ea1961754e92d523304e1b5cb0f8eee3df198f46b0f495ad02f335ca885d54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154626, "uuid": "07aebe20-fd6d-4453-bdaf-a4a322e2b476", "comment": "Malware payload (njrat)", "value": "3467ad35ef62b07324768e4bbc89bc8365cfe520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154626, "uuid": "5bf45a28-bca2-42dc-b82d-f196aba21217", "comment": "Malware payload (njrat)", "value": "41f66bcf5d8f057857afde8fee102eba3f7450da41eb5c9ffd87067e533a66cb2475761d6595618cd8ecd189202ef176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154626, "uuid": "29bcfce1-baea-45d6-af75-ecbe809ba779", "value": "T1FAB23C0877E08624DAFF2FB6096397A90773D2474836DB1E2CD865DBBA37A8606101F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154626, "uuid": "fb99279d-0091-4a55-9b50-4464869e1cdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154626, "uuid": "f1c68e77-4db0-4b71-ad76-eafb1ec777c0", "value": "384:6LtbQsVJwYVQOmZmwpR6AfWq/ie+SOFa3zmLT2gP/Zw3k5MW4O4ShqrD1hKmvCvN:ktbQECYYZm4df3/j6fPgsh2D1hKeCvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773154626, "uuid": "37ffe936-04eb-47b1-8cf8-7a43ea4ae08f", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773154626, "uuid": "6433aee4-5835-428b-9873-b73f61ed8f11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154626, "uuid": "d7c8948b-6088-48f8-953d-f8c591051e5e", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1c62af-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773146632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146632, "uuid": "a6870d2d-d885-44e9-802b-c47464dbaaed", "comment": "Malware payload", "value": "4303d82625d004ba77214a98f0eccb7b", "object_relation": "md5", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146632, "uuid": "88409d14-7c44-43b0-9530-78069655f6bb", "comment": "Malware payload", "value": "09cae9413387356f4a1f138be252b8a2ffe8f61990cc353738776bfaeeee761d", "object_relation": "sha256", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146632, "uuid": "72f4fd75-b660-45bd-b266-076b70c3f083", "comment": "Malware payload", "value": "83e37401798e331d4707577318ff729180215aad", "object_relation": "sha1", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146632, "uuid": "931ca262-442e-49c2-b3c7-8c881bb0900a", "comment": "Malware payload", "value": "754ef650ffe821fac76d0ca742f62fe656e36f3768526df207dc7cda98cfdcf07fe95019713f9d632cb6ca1214d1e19c", "object_relation": "sha3-384", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146632, "uuid": "1ead08de-273d-4299-8b46-7355c61cdf38", "value": "T1B0E2C547F38CBA00D49D0174A2CD8BE795A2F1683FD1B35F1BA0D6647EB42A46B1660F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146632, "uuid": "44549830-71fc-4da4-9332-ac8950249bff", "value": "96:xA5Qfs2eUy8Q6+KKToiHEV+Dh2tS0fxsOQUdV2rgr5ROxOqPTofy28J:NfTs8Q6+pEV+Dh2tSQgrgrPL8kfT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146632, "uuid": "30511348-ccc0-446a-ab6e-bb7bb64091bd", "value": 32032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146632, "uuid": "465a8f25-b1e9-4913-a5a4-cb875f79f5db", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146632, "uuid": "9ebd9064-4e87-4e1b-a903-978661b0abc4", "value": "localfile~.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6962dce3-1cc9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773178680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178680, "uuid": "504015d3-c468-4ce8-ac68-3a2ee8867a83", "comment": "Malware payload", "value": "370276c452d239d8cfdd378b50855ada", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178680, "uuid": "0bf16f12-9846-4678-9efb-4536c7745aa8", "comment": "Malware payload", "value": "09dca286514968e1099159d630118b6309e87d71c4ec03f743eb9f75ee4672ed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178680, "uuid": "d8b368fc-90cd-4638-b1c3-8be4b17c24ab", "comment": "Malware payload", "value": "3bdf38e8d0c4b76cfe5fa702f13b4d6b0182d567", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178680, "uuid": "ffa2b177-2f1c-46b0-b374-4bca9b43d17a", "comment": "Malware payload", "value": "c202984fe30532b4880940677eff5ebe3b13c8800c65841998712b23536605c61fc665a5630ff6f4712805f966cdf7a1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178680, "uuid": "6a34fee5-beb1-4b8f-99ed-b31605479adc", "value": "T193C399C8C9DF47999B472874C50B2547EBB52C03214BD670B76E8A02BF8BD9C56F88D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178680, "uuid": "114c0c32-16ce-4feb-892e-51f2834da4c5", "value": "768:qMWSJzOO7hUYMrHuSorHjt41Vdsy41HmcBBGrKR1Mum5A1leKLxnIuDKBFEtF3Xi:oSJzOO9aupmcrGrKR1MF5HKLxbD89UNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773178680, "uuid": "71f66efd-888b-4928-b105-a9b714f42a04", "value": 125275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773178680, "uuid": "d4eb2e27-a91e-4e91-8742-5ba8db9ec7b1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178680, "uuid": "2e8d9841-543b-47f0-8324-676eacb31a1e", "value": "Video_Home__93.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1143f250-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773127422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127422, "uuid": "ad51058a-6869-4ad8-9b95-52c20bb3ae7c", "comment": "Malware payload (Mirai)", "value": "5b8e2e160d370355f6c2971356b85916", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127422, "uuid": "a271d9f9-a9df-4d78-a870-fcd40b75dec1", "comment": "Malware payload (Mirai)", "value": "0a6894abaab03ffba329cef19b5083f1673e2893b22762a2e541e839d1a80291", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127422, "uuid": "39b29ec2-4f48-4a13-b401-9c28da3c90f0", "comment": "Malware payload (Mirai)", "value": "741c59f06f3c82547dd2ca607292f05b276f5aef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127422, "uuid": "9b5c2200-86ef-42fe-b85f-2126c46ee4ca", "comment": "Malware payload (Mirai)", "value": "8299ac52ebd0421cc061a18ba1fd60d474b314796759f43f15a96007e347010a30394249466a87d79eaf2d6242c0ce1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127422, "uuid": "5a9facfa-d915-47d3-97dc-76d9972734a6", "value": "T148E4BF93E6705ED6C00A0EB454BEE2308B05E1A313577181F6FF8244286F9A6FDAE774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127422, "uuid": "3f8a9739-c1f8-47c8-96dd-d794212356d0", "value": "12288:h5swp+l0/QATKEA3l6rf82/rGIaF/V62KyQyYtapIPhz:hTQlZETfte58p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127422, "uuid": "497f5309-6ca7-43ab-a8ef-9e17b4200328", "value": 660172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127422, "uuid": "a4a38bd1-e8c8-4f9c-bee2-d38ea30215db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127422, "uuid": "be95daf9-5630-4e00-a734-4e5f65e39e04", "value": "yakuza.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6da829a-1c9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773159134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159134, "uuid": "c715f617-efee-47bc-bb84-1b344a6eb69f", "comment": "Malware payload", "value": "805e646af2927e72bf056171aec38835", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159134, "uuid": "01d9fedb-b284-4484-878c-82ae775d6266", "comment": "Malware payload", "value": "0ada96fe01fb58d986ec32056522e32aa04afe63e4c9ad6fc821319374864c95", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159134, "uuid": "da35210a-94d7-4d0d-9ff3-6c323257472a", "comment": "Malware payload", "value": "fd58e72c0cdd3e8688d81a9a20d64832f4408638", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159134, "uuid": "362c836d-5f49-40d3-ad7b-a7e5c90e4e0e", "comment": "Malware payload", "value": "b135de501358dc606b2fdd8e87d6c3cc4adc8152fece61263184326b8b583e07e7bb2843c459b5b322d5152c5496e381", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773159134, "uuid": "0c2a189a-c715-4dcb-a8ef-67484ead8e79", "value": "T1F2C3EE7A1BDF80BBA2076856598B1940EAF1D423035CDAC4FB8CB3FD2F45A7590F5898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773159134, "uuid": "7ea162e1-3b9c-4d5b-aa12-457185ef6bbe", "value": "1536:l8H2sWt1KsTRNYE1EnQq8arWw9hWzKU5sm:lgCbJse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773159134, "uuid": "9f159af0-211a-494f-989c-db45dea943cb", "value": 127112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773159134, "uuid": "5b8c25fc-89f0-47cd-a56b-c82858254384", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773159134, "uuid": "3aa03f03-7e6d-4854-a448-c9d08ef81789", "value": "Global_Project_Release_6060.jpeg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521075a5-1c55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773128819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128819, "uuid": "043f088a-c778-4076-b315-e6df0077e21f", "comment": "Malware payload", "value": "f52e124d6cb9e2cae2b2a49e76eac8d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128819, "uuid": "161b4f78-0e9d-4f17-b870-e6f6bcea73c5", "comment": "Malware payload", "value": "0c19519635e511c0e7e6cdb9a2f4c36a0b43dbef0addca8cdd48a5446e61dd80", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128819, "uuid": "60aa0967-c895-49ef-b4d7-ea744f121b6c", "comment": "Malware payload", "value": "9347b6b6bf17ec03f6a2480d38ba23fb9faeb6ce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128819, "uuid": "5fb4441a-3588-49a5-86b8-8d7dc55f0117", "comment": "Malware payload", "value": "af9ad9b326497ee7670f1539b66ae884899b3905c0788b7aa50f722f8937863f4ee3cd32414c78d591db15d2ae2a4aa6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128819, "uuid": "b0790a1a-8111-4472-bf0e-f1619e958f2b", "value": "T1504584FCA4E6CD891BC15A16A60892E89F36D080234E528911D3D5D67FD9F8FF8C7368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128819, "uuid": "e9e832b6-887e-46e4-9b45-26fe7b0215c4", "value": "48:vVyrvrNAUArANA9rNrvU2viU2UrAuUrUEUrryUrUEUrryUrUEUrr2UrUEUrrvUr9:gT7Q2oWB+0OEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773128819, "uuid": "2bd7929d-7700-49e4-a1b3-a9d3f3d3c089", "value": 1168345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773128819, "uuid": "1b8f32ba-84dc-497a-a949-09dcb62715c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128819, "uuid": "87acd9d8-47df-4878-851d-9438fcc995ef", "value": "cevamp_group_request_for_quotation_03_09_2026_xls.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b974ea3e-1c6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773140160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140160, "uuid": "66feba82-a61f-41d6-860f-26c387ced489", "comment": "Malware payload", "value": "7f54f87b7da0e7e0b868d1df07b0d949", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140160, "uuid": "c78de964-d890-47f8-a706-c07168863672", "comment": "Malware payload", "value": "0c99481dcacda99014e1eeef2e12de3db44b5db9879ce33204d3c65469e969ff", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140160, "uuid": "f220ec39-a8ea-4d34-93ef-ae60bd2773da", "comment": "Malware payload", "value": "f4befca298acd26f5048b18ebc9ee21e167cbdc5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140160, "uuid": "527defe1-2b9f-4771-b8c7-0878f3b08938", "comment": "Malware payload", "value": "63a6c3c9f5c7d108f2a0f37c1719ccd8ad2ec018bffae5c4586c0b38a4b855dd5d24c73783c149932f00abc672f6412c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140160, "uuid": "70d40eda-910d-4b4f-8543-41cc1397dae1", "value": "T1DBE50122738BC637C65D02B115A9EF1E5138FDA3473450EBB7E8392B88F44C26679B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140160, "uuid": "cd10ea69-de75-4592-9f0f-74f1bf1af31e", "value": "49152:+2SX7jizoL5laI3x/Bkpu7X5hZ0LH7WKnaaaqT8vWVNY6OoNUX+q5kk:S0+VzZ0+K2qTAPrSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773140160, "uuid": "91d819a5-7ba0-4b64-b978-32285358db88", "value": 3056640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773140160, "uuid": "72a09dd6-0bac-4ebe-8427-7975ac330453", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140160, "uuid": "8159afc8-38be-4608-aa47-5258e7eee158", "value": "Update (4).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c145a93-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146365, "uuid": "08dba9e6-e1c1-4408-9517-576ce342cc78", "comment": "Malware payload (Mirai)", "value": "66728d313c086bb04c7a2c9bc06fee8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146365, "uuid": "267268c7-e586-4c21-a6b9-a687c03271c6", "comment": "Malware payload (Mirai)", "value": "0df996e56ae707b6d51b95fe67c4423bff8cf8e6e96d639e64218b1af1278ccf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146365, "uuid": "4fce18b3-aeb3-46a1-a30c-62904ab9cb6d", "comment": "Malware payload (Mirai)", "value": "d76620c0c8ad97bd95b7dcb057cfd8d28d23ddf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146365, "uuid": "1f436b9f-cf51-4113-b358-8ce536da31ae", "comment": "Malware payload (Mirai)", "value": "b3919cd921e12e868432210ff6d34320ac0bb040526634722737c76acd36d4ab4df2853e361ff7fef907e79e52e5c200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146365, "uuid": "661093dd-33b2-4c7a-81df-8947c8b78e91", "value": "T1878328C1BA4BC0F5D90748304067F33FCB32D6394061D66EEFAA9E65EA73642522629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146365, "uuid": "44987685-d047-4664-9c36-981d1f50518a", "value": "1536:8l8IhK59kLMSbs6mz1WAcanWC8f4TxdgoXF6hKal9:8/hU9ktb01WnfgTxddX0l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146365, "uuid": "220627fe-570d-4629-8507-d74003c8a17b", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146365, "uuid": "daefb1f0-fc7b-49eb-8d5f-1cd31f17d5a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146365, "uuid": "8f1a431e-0f33-4796-8ada-1e3253d7d4ef", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce6961c-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146393, "uuid": "c1bbcaa1-47da-4aa4-a1c2-21b1a9170459", "comment": "Malware payload (Mirai)", "value": "5a96bf871e1fed820b3e67ef4940b229", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146393, "uuid": "738500e2-b027-48cb-b049-13332023252e", "comment": "Malware payload (Mirai)", "value": "103fe4f939387b77ba2e869e623000529e2a1cd46eb25976cf8102be8e10fcca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146393, "uuid": "6e6a6f0c-c51c-427c-8474-8908e5be729c", "comment": "Malware payload (Mirai)", "value": "5bd2300dc05aab8aa3f058316f487983f33600e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146393, "uuid": "b7c79a3c-3459-4507-a5e9-c5a00b6e6d87", "comment": "Malware payload (Mirai)", "value": "877bef782ca81f8aacf274df0213d14186b63527c5359675214067e0ad18099f5e10fa59f4eff1d0e6a1dd3fbb88422b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146393, "uuid": "9646b4b8-711f-4b8c-a24a-ecf3e4c9aa6d", "value": "T174839C23C9361DA8D84804B0B0B48F755BA3E515C4572EFB599AC63AD483EDCF68A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146393, "uuid": "56b53918-9967-4046-be04-70cb07106b73", "value": "1536:KxD+xE86+GxaqPshbEKRvyQV+XRCaW9x7IHyk:Kl+xsxPE1rRz+XRs9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146393, "uuid": "a3e18a82-8878-488a-aa30-55f228b6c63d", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146393, "uuid": "974b38d3-7785-41d6-8143-9719a98064f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146393, "uuid": "01542fa8-e884-4e18-8dba-b9ba5e48238a", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32f3e4f-1c38-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773116554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773116554, "uuid": "746152ed-4f94-4c8d-94d8-bba1b2c6e152", "comment": "Malware payload (Mirai)", "value": "3ab97c784bd10c23f86ce7bc9d79c4d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773116554, "uuid": "afcd49fa-ab2b-43b8-8e4a-1cdc264529f4", "comment": "Malware payload (Mirai)", "value": "108a9fd100e056b2bcec846f4f06b0df71c583e2449634b3eb6b5aab456e4548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773116554, "uuid": "faef776a-38f5-4bb6-99e1-7dddc4bf9e27", "comment": "Malware payload (Mirai)", "value": "fe6760b209a49c708d23d7fe006c6a62cc68c7c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773116554, "uuid": "da1547a9-9ccd-4d44-a0a9-e6b6a513c88f", "comment": "Malware payload (Mirai)", "value": "70d7ed677ce9a494ac9c44ac49d69a4f452b3d89bc1a851b946bf8c299a7a49c66f58d08ce379459c047364509e0a803", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773116554, "uuid": "adb4a632-5c69-4ce9-b56e-8f80639c9834", "value": "T131F35B07B4C094FDC8D6C2B48FAEF216D972F45D2238B21F27D46E262E4DE206B6D651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773116554, "uuid": "d8d0c7b5-e595-4591-99e9-59e405d1f37a", "value": "3072:JKmwXpfIudRPUPIA41MySTuwhdEcU8bLjAD+Lt2a:mpfFt9vkV9HCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773116554, "uuid": "9c7f4e8d-9a21-4ac7-8cf9-2459368ddb4c", "value": 170408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773116554, "uuid": "43105fc6-cc54-427e-afaa-895c7806028e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773116554, "uuid": "72f9c592-d558-4b04-b1f1-b6bb5d2f801b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e268c5e-1c55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773128706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128706, "uuid": "bba4027f-62a2-46d5-b89c-60e13af87659", "comment": "Malware payload", "value": "a414282c860af5a9dd7011da263e0713", "object_relation": "md5", "Tag": [ { "name": "CULTURE-EDUCATION-INTERNATIONAL-LIMITED", "colour": "#30DAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakadadscomeone-com", "colour": "#F4EA15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128706, "uuid": "930c3e30-19b0-451a-acff-6bb50cdb2f04", "comment": "Malware payload", "value": "11875de4d8789bc95ba00bc040b8160549252dae2fb18f948d9380fb0d297c32", "object_relation": "sha256", "Tag": [ { "name": "CULTURE-EDUCATION-INTERNATIONAL-LIMITED", "colour": "#30DAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakadadscomeone-com", "colour": "#F4EA15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128706, "uuid": "0b658a46-2c2b-47e3-9f79-f8eae859924b", "comment": "Malware payload", "value": "f7b2968ba25e5984c561398162030a47784cb21c", "object_relation": "sha1", "Tag": [ { "name": "CULTURE-EDUCATION-INTERNATIONAL-LIMITED", "colour": "#30DAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakadadscomeone-com", "colour": "#F4EA15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128706, "uuid": "4c1718ee-ede0-43a4-99ed-0be54338a06d", "comment": "Malware payload", "value": "81aba1137c0049c517ab318b5feaa9fd6227ba79d461d871bbc069df041fb767b1c489902696ff68b01e8154867439fc", "object_relation": "sha3-384", "Tag": [ { "name": "CULTURE-EDUCATION-INTERNATIONAL-LIMITED", "colour": "#30DAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mazafakadadscomeone-com", "colour": "#F4EA15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128706, "uuid": "257a38a8-409f-4e2a-b025-54a2c428d093", "value": "T11EB733BB6349C1D6D127C1B096C8CD959E758D2ADFC17FA2A2F4EB6DC8930DD208D242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128706, "uuid": "36383ed5-2a61-4da5-acc3-cd3e2b76718a", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128706, "uuid": "7321d32a-976b-4dc8-ae2f-4b5f1f23c8a8", "value": "786432:0LfCNChYQSarFfxnnbSpPHEnzv7ca/u4ew5uvqChwme9fMMkc0Qr5ZDjc:0eLGFlbSRHqzDcsu4eUszcMPpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773128706, "uuid": "59f480a6-ad40-438e-a1fd-f9f2c87dc118", "value": 50618264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773128706, "uuid": "806f6b48-041d-4824-8333-ae2728e5ce3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128706, "uuid": "964f45ac-7175-4cc0-a9f5-1e3c405be8c6", "value": "11875de4d8789bc95ba00bc040b8160549252dae2fb18f948d9380fb0d297c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfefe10-1c80-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1773147440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147440, "uuid": "30ebe60f-4bc7-451f-9cd3-796626507894", "comment": "Malware payload (Joker)", "value": "a9a4f7c24ac455aaf11c3a29ae98a43c", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147440, "uuid": "5329984a-a4be-4725-a001-14a86ba3681e", "comment": "Malware payload (Joker)", "value": "131ebec765ce7fe0f803a3bbb814ecf9e734c421ccbbafecb37c76a014546c61", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147440, "uuid": "be07d239-9660-4876-aa76-5a039d1710f0", "comment": "Malware payload (Joker)", "value": "688a705fc47a840b9d9c80ffb70c6d150f3f4b4c", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147440, "uuid": "48fac948-6551-45b1-829d-4bf26dc3b670", "comment": "Malware payload (Joker)", "value": "de38aa122479531c81b48315d78a5eff6af27cbe47524653d3d942ef25af9a182912461361ddf734192195b0c8f5ca03", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147440, "uuid": "cce6bddb-f1fb-4a0b-ad98-6a5e9ddb1950", "value": "T1F6571249EF0DFE2BC9BEB076DF1562337126AC641241D3B33804A60878E36D68E95BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147440, "uuid": "083855dd-df26-449f-9830-c7c36b7fbf60", "value": "786432:UpWNv6CxJ3OS7+Rqzi51m2Et1wm6a1ATiQZI9Rm:UpWp6+IfRum1mw7B2Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773147440, "uuid": "d9425b71-f6f9-4235-9f45-b5abe3ad27cc", "value": 29054178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773147440, "uuid": "8fd1d303-fc7f-44ae-aa37-93b8e95d42f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147440, "uuid": "e8e94386-8b2a-425f-a31b-85628b3f1357", "value": "Now+Junk+Cleaner_1.28.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1460de-1cc9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773178743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178743, "uuid": "ff1f1586-af37-4d1a-bf63-18dffadb77ae", "comment": "Malware payload (Mirai)", "value": "4041ff792ce40c240c2255b332562c6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178743, "uuid": "65b6351d-8418-4813-ab8d-afa23e31460b", "comment": "Malware payload (Mirai)", "value": "13fef25ab468904a3ebcb98835e649d74a5939b170f16cc781db301474e70a7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178743, "uuid": "5d205cf1-71c6-432f-b647-3a04a84a12e7", "comment": "Malware payload (Mirai)", "value": "15fe76e445e58257011397a8dbbcbca7647f17f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178743, "uuid": "867fba5b-eb96-4dcb-819a-0d87ca8460c7", "comment": "Malware payload (Mirai)", "value": "b9096ba24dce5ae588d5cf5d2c1ce0adfe67724a826ce51ba5490997bb55f1218c3f81743678f5f0737f4748527c62cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178743, "uuid": "f172860f-283f-480f-801f-79d23aea5429", "value": "T1EF739D75D0786D98C5048A34A6ACD9B88B17A504A7A33FF2C681CF650047EFCF2157FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178743, "uuid": "ef353aae-f58e-4721-b4ca-82cac5452c82", "value": "1536://kM1TnB8BwtVNYDe2tGvESrFRwUxKTPEQfCT8o:/MMJneB48jSpqwiPEQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773178743, "uuid": "6ce6dfc0-165e-4290-81af-ab0d6b1f4f50", "value": 80592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773178743, "uuid": "9f81753c-360e-4a9f-b3a9-f35d4535aa2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178743, "uuid": "55e3fa05-5689-474d-ad2c-a22867179571", "value": "MMaaRRiiOisecTanee.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1c711d-1c28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773109675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109675, "uuid": "fda7e8cf-5540-4b7e-bdfc-5ce4ba16fa6c", "comment": "Malware payload", "value": "eaab7f491c63f1599535ed2312bb4bff", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109675, "uuid": "62640737-7ff3-4d79-ac58-10f7da646264", "comment": "Malware payload", "value": "15020778c8004fbf4d4f123cf9b0f9749065baf32835790c44549efb7399414f", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109675, "uuid": "52ff6482-c433-45ef-91a0-ec9bd85e6b95", "comment": "Malware payload", "value": "7766fe317035246249e34cfb5e86ea586b51141a", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109675, "uuid": "19d1fa64-ab8b-4100-9a60-e97e73abf90e", "comment": "Malware payload", "value": "c26fda1742e3f9185844935ade58a6890fcf06336f7de5fc6af439bc2eb639002d9406c1c003ec1c05480af88e93d9a1", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109675, "uuid": "2790aab7-e70d-4acc-9373-2ad386a85a8f", "value": "T108E512826FCC2CAED8794674749707421A637C7E92A11BEF11DCB23D49727B01A36F1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109675, "uuid": "37aab641-4390-4cc6-b315-b48829096b20", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109675, "uuid": "64fdb306-e1dd-4008-9325-f0b891fb1d52", "value": "49152:/gFhvu4HVqmfE5kwGLVTUd4HA53g4pVttcGOz6rSc8g3:/gFhBVqWE2P5Ue63xVIz6B3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773109675, "uuid": "ade06c9c-8eb8-4698-9f79-634fc2614fc8", "value": 3232766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773109675, "uuid": "241f302f-3db6-4641-90ae-39e6ba028460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109675, "uuid": "faedfe2b-c7ca-4e99-9150-9f45142db1a5", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f071f0-1c93-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1773155537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155537, "uuid": "3e7dee94-9cb2-4789-8d30-feeb8dd4bfa3", "comment": "Malware payload (SimpleHelp)", "value": "deb8272ca0ae00aa6d1f96c1d5d8c69a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155537, "uuid": "db19a005-73cf-4bc2-9620-a5e639759f43", "comment": "Malware payload (SimpleHelp)", "value": "15ce8f62c93ff546140fd25005bd62a13e7f35c7f6744dfa964e795c0f303201", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155537, "uuid": "ef1380b4-6412-4e84-8517-6a739e2f3c81", "comment": "Malware payload (SimpleHelp)", "value": "3e09eb24dd5c90b004020b7a23b5295a7f69d811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155537, "uuid": "051b0adf-54e4-4175-89ee-b109cca33139", "comment": "Malware payload (SimpleHelp)", "value": "822c072549cb813161d3c266c399683d063d6389df13cd6f71f8ecc14b60ecb49d1aa378398abffe59b31c05b0d70852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155537, "uuid": "b6eef322-cd54-4971-a86c-a4e0eddf9e45", "value": "T18085016AF7A618F1D9A7D838C6928763FFB17168031462D707A08D666F733E06A3D305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155537, "uuid": "3a91efe3-99d4-4c05-ba66-62e7f8714faf", "value": "4dcdd102066c792bcf91dce0ad10afac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155537, "uuid": "ea08590b-8610-4c82-9aad-c5c6e3648dae", "value": "49152:0aHqbMGOOMRjiornbPOBrwIt2OwihPJSfkKIxVw:lTdZiJrRDwIBSMKIxVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155537, "uuid": "cabb62a6-9880-4fb0-ae85-12b00289007a", "value": 1725848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155537, "uuid": "17c3cf9c-368b-41c0-a2d3-a2a8cdd5b82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155537, "uuid": "454dd666-abcb-42d7-9d31-85f865d07291", "value": "POLICE-PDF185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62b2450-1c26-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773108801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773108801, "uuid": "76f4204a-04e0-42da-ab46-ec44d811ece5", "comment": "Malware payload (Mirai)", "value": "6ceac6e866fae6360d2135af0057a30e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773108801, "uuid": "853fdeda-9097-4d77-8770-86566d5386ca", "comment": "Malware payload (Mirai)", "value": "1688643bf6de775f751996f9d66fce7e59f5db56f66038798cac39a08d499e1e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773108801, "uuid": "3f122a87-7afe-49b4-9949-de287a9a39bb", "comment": "Malware payload (Mirai)", "value": "9122c35ec37002903bbfb3d06011e436485441b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773108801, "uuid": "96bce812-1ca1-47bd-b33f-7e88dbf61370", "comment": "Malware payload (Mirai)", "value": "7c1e08cfc170b53bc581b77c3710d352621c97a6e0f1a1957d29784d42517a11ff7f0a71fd6cdff748e416fcc0f7d474", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773108801, "uuid": "aa3c55be-cd07-47e2-9bfe-9d9f499a481d", "value": "T1A2C012C632E07200C5A9EA443CA28415514887C9AC552F7CB8E88555CCCD774F04DF53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773108801, "uuid": "358077dd-1ae2-4894-b5c0-586ef7128a34", "value": "3:TKH/GlTLTeURJQaHDGaOOdReFLhCAlTLTeURJQaHW8aGBzOdFLTUWv+TLTeURJQ+:Hlfoa6aNeFvfoaFNqX+foaFDG53x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773108801, "uuid": "79a99151-eb40-4346-bb53-d6571545f0f6", "value": 193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773108801, "uuid": "ff70b6ca-168a-4d3d-8fa4-30bbfd4bc8d5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773108801, "uuid": "c1300b74-ee65-48a8-b9b1-5e301efd619e", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a80cf5c-1c93-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773155543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155543, "uuid": "6df7e8b8-b696-44f1-b166-13d66eff1ac6", "comment": "Malware payload (ConnectWise)", "value": "68d5a8ea6f16b920c91613838389f04b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155543, "uuid": "1cb13942-23ee-458c-ad7e-4c1da2693c01", "comment": "Malware payload (ConnectWise)", "value": "171077e02e1ec55507c64be2254ae6acf9b6bd6e5218205a7b469db709183313", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155543, "uuid": "d5aa1714-6840-49a7-a751-6f960a5d8644", "comment": "Malware payload (ConnectWise)", "value": "314d7afdcdb512a80d1ae3deeb1fa946a4751a32", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155543, "uuid": "1a893d8d-c2cd-4109-9080-59d4ef5a0bf2", "comment": "Malware payload (ConnectWise)", "value": "24b513395542264460ca77127feea50d589ba3425ee72d125c39a0446b6366beae2acfb9105fed6638a18e04e7ca4443", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155543, "uuid": "0ed84446-4822-44c1-b933-6c83aac3b10e", "value": "T1E8A6232153F9D028E0F35B35EE7AD165AA32BE618E12C15F1354780E39B1E8196B373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155543, "uuid": "b074463e-b925-49fd-8d1a-f5e14549c406", "value": "196608:HBn2hg5kEWmXhcfKjSVeh7vGeSBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcfKjSVI:xgdEEijbDGfgdEEijsgdEEijWgdEEij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155543, "uuid": "5009277f-443c-4205-9e75-3ea8b3502c4b", "value": 10121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155543, "uuid": "a72f07c0-b9fa-4124-a685-1f080c8b9ba4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155543, "uuid": "b83d57da-f2ce-40f7-abd9-69f954a4641d", "value": "ORCAMENTO_PROD.SERV._MARCO2026_698547.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a6aff8-1c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773128844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128844, "uuid": "01a80537-3895-42a0-8aea-c4c94d9e60bc", "comment": "Malware payload (Formbook)", "value": "3209120e817db75bcc37310061119043", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128844, "uuid": "2ee8acbd-a61d-45ff-b4ed-1f4b0c274571", "comment": "Malware payload (Formbook)", "value": "172d478c04c29843e4f5372957380e4d1ff043bbc4e0058c885fd8ea5b45466f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128844, "uuid": "dfddde09-c16a-4588-ae87-fb42683da6d2", "comment": "Malware payload (Formbook)", "value": "86963b19e41d559ed7d518a76b1b1984418095b8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128844, "uuid": "8220ddd9-623e-4bed-9659-c77403bbc507", "comment": "Malware payload (Formbook)", "value": "7b355f6e2df35d25608e910764c24663c99609a47e0285eeb5b892eac4a07228a4395d07f89f8461d4964df0833b5bb2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128844, "uuid": "8de048b6-dbce-42b4-a6e5-1bd481640e0b", "value": "T18606AD09DED14E72CEC3490BA4FE429B51C1E28FC06679B6CB527E8AA6DF540137B0D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128844, "uuid": "14da01df-f655-4a55-a684-1fadd2f0a600", "value": "24576:JFhpnqjD1Sne7dg8Bj25DCRsB5lElpevYb35DDgpQvm1V9Cpm19Q0X2tQKTWcAB4:JY1coHBsS5TWrBvzY1coHBsS5TWrBvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773128844, "uuid": "e8231647-70bb-42dc-b197-120defa19a65", "value": 3939359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773128844, "uuid": "e766a349-2b84-4a6d-bb85-ab5d3c3a19fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128844, "uuid": "c16eb004-df11-4809-b4a4-1733544628fa", "value": "Technical Parameter.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c98ce7-1caf-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773167455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773167455, "uuid": "3561d385-b4a5-48d4-bfb9-0c9f71cbe6ad", "comment": "Malware payload (njrat)", "value": "8cafcb685865aa205ecfd7be00a192bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773167455, "uuid": "fc05e01c-7bb5-4fe0-be68-95a2c0d6ff73", "comment": "Malware payload (njrat)", "value": "180f08eec33e60dece5478838462052aad8ab51fe07704c6de48685ed4cdc497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773167455, "uuid": "15ac1127-f22c-4156-bd11-236368e31bed", "comment": "Malware payload (njrat)", "value": "25817c9dbbc25cfa5c2ef1839d26d9f5ba66b12e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773167455, "uuid": "69f39f44-4dc6-4258-b576-2169d7b878f8", "comment": "Malware payload (njrat)", "value": "aa01b2f12683c606d7b34c63d7fb6fc60b9b78558fba45f88185cd0311df34465ec1c70fae816c98b1db04b298ecc720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773167455, "uuid": "31d4b40e-4d1f-419c-a8b6-3e235a7fe437", "value": "T11ED6332B2C415C7AD37C213F0806B8B5DF740DAD99D9F227B8DFF6489E36C965A20681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773167455, "uuid": "0c75802a-8839-4399-a6e1-93c4963b59ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773167455, "uuid": "446d46c5-fb78-4c40-87ad-666379249896", "value": "196608:+V4ofSL0q7v2Iw4Hy2OH0tXQo/F5Z+28q80bN1H3+icKZzB85sk4I7Yw9Pr4J:+V4OBq7vLOgHd5ZB1R1H3+ihZK1bvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773167455, "uuid": "5b244754-26a0-4c15-9598-88a1bd201906", "value": 13154304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773167455, "uuid": "8caf9fd4-6d06-478f-9dd8-5aa608e8879d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773167455, "uuid": "d7bf729d-d07d-4e07-82a3-63faab97aff0", "value": "MicrosoftWord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567051d7-1c4d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773125391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125391, "uuid": "d10a2e1b-a8e4-42c5-b629-2e6191454728", "comment": "Malware payload (Mirai)", "value": "d9dbf6605633e9b5682684e6cdbab662", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125391, "uuid": "8933bf6e-8363-431a-b05d-ab372bd2a34e", "comment": "Malware payload (Mirai)", "value": "183c7a7607fb4bfbdedc8ac29f56dc44833c79d671bb20f6e88ed2dd32a12578", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125391, "uuid": "88472ba9-8559-4d83-9e8b-4fa15ac78b95", "comment": "Malware payload (Mirai)", "value": "eb389cc0b3b5cba946c77fd3a7770d2859aa557b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125391, "uuid": "4654eddb-7744-4607-9488-5f26d867ee11", "comment": "Malware payload (Mirai)", "value": "0d16e6325d189d858e7672033b6e301f94ba9a650947f7811af5c5ac23293fdf6ac2984af5eee2008400c8f71f3a95f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125391, "uuid": "72b339d5-3f2d-4ab0-8bbd-6f378931786e", "value": "T122144A47EE890EDEC82BCEB086AF835B1EE7559B4CE1F1F4543C8C0C755D29A45A3648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125391, "uuid": "639f0f14-2b80-4886-9ff7-94a9409ece05", "value": "3072:Lsz3TFErPVXyKAoPpB9ABdmRMdFV3eDuOD9skoGtBuE2f7s6SHaq244:ESyKAUheZetD9skPtBkA6SHaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773125391, "uuid": "dbb00e55-e2a7-44e0-b4dc-0415db1685c9", "value": 205244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773125391, "uuid": "8980ae20-ea4d-4997-a1c2-3813f21b88ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125391, "uuid": "1bfed2a3-bbdd-46e5-b6c3-5492bea413ca", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a87c560-1c93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773155355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155355, "uuid": "818cd6b5-cca8-48f2-86fb-3e5fc7ed0d8f", "comment": "Malware payload", "value": "bc7203ce457e55a984b114d8eaffe313", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155355, "uuid": "ba16e71d-287a-485f-866e-c1d9e33caf08", "comment": "Malware payload", "value": "1c89dce2314aa6b6b0a88c79239c32d7bb25cc89034f7e7eab63a865c71fb1f6", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155355, "uuid": "00389917-2ddc-40ec-ac0a-2dce068a34c1", "comment": "Malware payload", "value": "329fa1f9f9865aecc1bd53eaf7941b5e58177390", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155355, "uuid": "f813211f-6f64-43af-a058-2e6f1d45b8c6", "comment": "Malware payload", "value": "d110f292540710b3e07dd23ffa7a80796bfb4b29e0475f825689f6bcabeda0020a608fa035f1fe6a6293386863dc44d7", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155355, "uuid": "74242a0a-0b01-4fcd-add9-3ac094816237", "value": "T1D966C19CB2826AF15558A7EC874370CC17506637A3FB644E92E4C48D3D0AF577AB8CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155355, "uuid": "df98f57d-9b88-4dfd-8e25-54fe643c81f0", "value": "49152:gYQqBUYQqBtYQqBDYQqBIYQqBqYQqBKYQqB9YQqBdYQqBYYQqBDYQqBHYQqB2YQM:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155355, "uuid": "b1ebb4b8-c8bf-4597-be31-ed27480d5ebb", "value": 6620689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155355, "uuid": "8767460c-0d87-4a36-ac98-a5da33ffb9f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155355, "uuid": "dc94853e-dd4a-46d0-ac31-f05e806a9192", "value": "views", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc739c8-1c93-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773155493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155493, "uuid": "253428c2-dc27-4292-b2e1-16dabbebfb38", "comment": "Malware payload (AgentTesla)", "value": "c4fd931417e90d14ed88d76dd1796c42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155493, "uuid": "32b7ecd2-93e9-440a-8fa8-a88e56514b00", "comment": "Malware payload (AgentTesla)", "value": "1dbe912cb021358dfa0a1fe56d03647c6245ed0f1af2e041b6a2ec6af3528a5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155493, "uuid": "aa6e75b9-aad1-4027-9ba8-8bdb2fe8a191", "comment": "Malware payload (AgentTesla)", "value": "bb02c7a122a3f9a2bcf55fa45c32ed17a6a66a84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155493, "uuid": "89bc00b0-0d5b-4a38-a275-263748400721", "comment": "Malware payload (AgentTesla)", "value": "842eb74146d7530b79e67c08173f89d707bde6c7c24b9ef93b8be1f92dd0188a25cc9b1354ef04654d5c5f41fd20a193", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155493, "uuid": "02d5cd90-f1e7-461f-85aa-73c0dec0fac6", "value": "T1AA163AC4B1884A443A676D3BF760F0E057E561D7BD81B90AE21F67F2B7A70C1E821366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155493, "uuid": "c28da803-fd10-465e-9b95-9ce82c66b6ef", "value": "98304:twpIhZIBb4UDSlk8PPDdEi4tM4nXKsT4sZBjAdZq9sno3v+wCHbXbAlmytgK1kYw:twpIQBBSlk8PPDiifiXKsT4sYmsKv+LL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155493, "uuid": "a17a726d-544e-4792-873c-84d4c61f3aa1", "value": 4161173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155493, "uuid": "c15baf93-9ea6-442e-8ac9-b9f59db6a5e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155493, "uuid": "8105c9aa-e66b-4e1b-9106-0d523f711a3d", "value": "Bill of Lading Toll - TNGB7337093.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f89880-1c54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773128670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128670, "uuid": "40637116-6e86-4526-a14f-7f2e333bfc08", "comment": "Malware payload", "value": "805879edca3ca479b1224016e4cc0b76", "object_relation": "md5", "Tag": [ { "name": "CULTURE-EDUCATION-INTERNATIONAL-LIMITED", "colour": "#30DAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128670, "uuid": "0168cab5-8882-4fa4-ab46-b6a731bd3bad", "comment": "Malware payload", "value": "1df551df7e486858c0165d8e791db2d0a96a99e6d1cedc5b30fbd689c6363801", "object_relation": "sha256", "Tag": [ { "name": "CULTURE-EDUCATION-INTERNATIONAL-LIMITED", "colour": "#30DAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128670, "uuid": "509e8d23-1d52-4cea-bd46-e00d4de4f458", "comment": "Malware payload", "value": "a5998747ed9c59561ed04982447f4ce4506ac9f6", "object_relation": "sha1", "Tag": [ { "name": "CULTURE-EDUCATION-INTERNATIONAL-LIMITED", "colour": "#30DAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773128670, "uuid": "4cae0272-54d2-4788-a38a-de65d8c4830d", "comment": "Malware payload", "value": "d1251ec47595a9bb6225fee08aefad008fec4be011db78b71b2c14816f28488044d39a18d22bb546be92fabf3e2a80d3", "object_relation": "sha3-384", "Tag": [ { "name": "CULTURE-EDUCATION-INTERNATIONAL-LIMITED", "colour": "#30DAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128670, "uuid": "12736047-dbe2-4e2d-b317-3c7bcb1f525a", "value": "T1EFE733A27BC46E5CC8E8DDF50E757E914DED446A3284C0E1B853B2D6E984CF2460F1AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128670, "uuid": "96a17ac4-d3c9-4db7-9e06-a34abc263144", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128670, "uuid": "cdf3b887-0099-43d1-a0bf-c93757d9ba16", "value": "1572864:X2H8rPqMMpO9addr8I34OPJ3YsNeuCdLJ4vfUH2Z40f:Xw8rtlSdA4PtxXCdLJeZ4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773128670, "uuid": "9959da5e-1e16-493d-b8fa-5ecb701ac9fc", "value": 65343840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773128670, "uuid": "6e90c2dd-a71b-41a6-8418-5882b142584d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773128670, "uuid": "69b79e3b-f9d9-45c5-b26e-647ae1339593", "value": "1df551df7e486858c0165d8e791db2d0a96a99e6d1cedc5b30fbd689c6363801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7415a6-1ca3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773162205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162205, "uuid": "28962944-8ea3-4dec-872c-5c5143c97f02", "comment": "Malware payload (Mirai)", "value": "f55bd5affe424bec6d2e9facad13ee32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162205, "uuid": "a593731c-d755-414d-ad0b-c5b1b64039a9", "comment": "Malware payload (Mirai)", "value": "1e1e79611cbca7cce1cb1e03b7478c8e7c12758e6270f8efa226eb14f5de5fe3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162205, "uuid": "b62dcddc-1b78-417c-bb17-fe60bacfd1fb", "comment": "Malware payload (Mirai)", "value": "e31ed7548d9d9ee4ceae2eebaf2bec6cc3b6584c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162205, "uuid": "1754c02f-8a5a-4093-816d-e9fafd1bdf17", "comment": "Malware payload (Mirai)", "value": "b3d45af2b438cd6404878cf4dace1939d007e522d88564fbe79f28f5c945036bc6a3b808d484302a3cb75e01251a4a1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773162205, "uuid": "2e02bb44-1a0f-45a1-ab52-759517ce3a61", "value": "T180934AC5EAC3C8FAFC160575213AAB76DF33E17F202ADA47C39D9932A821511C61676C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773162205, "uuid": "be9ee070-3f73-4ed8-8efd-3c3e35b0dc70", "value": "1536:5NllXn3Tq35VUGuZg/RQ40Nw2f001f+nfjaI6SQsfT9rTeSCo:5lXn3TqpK4d0NNan77TQ8T9rR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773162205, "uuid": "311b6bef-5e06-4214-a5df-27d2fea2918d", "value": 93704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773162205, "uuid": "03e6cc9b-4680-4287-b71d-eeffd7507437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773162205, "uuid": "a449a161-81b3-41ea-b92f-f04949b78e10", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a687f9ca-1cba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773172340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773172340, "uuid": "2f0dba4f-6d21-462b-a4fc-468c3e75a65c", "comment": "Malware payload", "value": "778bfe9aafbcf6d24275de59aa22cb57", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "REWARDSTEAL", "colour": "#66B89A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773172340, "uuid": "3715747c-4ca7-4a48-9a35-bc7572df764c", "comment": "Malware payload", "value": "1e7ebdcef5d6a5ab149872c4fbe9c23ba46e81b19e902350b77d645ccabcc1a4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "REWARDSTEAL", "colour": "#66B89A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773172340, "uuid": "17a09e4f-78d1-4d7e-84b3-80e459d4a6e0", "comment": "Malware payload", "value": "fb5dd8e78b99310d8e8b8f1b435d51006f3dd70a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "REWARDSTEAL", "colour": "#66B89A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773172340, "uuid": "18fb23bb-7e7e-4070-be67-f913aac60f10", "comment": "Malware payload", "value": "fe99bf22eb70507d47ba14402ce5dde36b92317937a7d5a16b065017fdfdef33773e705fd5fec4630c9504ad3b686548", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "REWARDSTEAL", "colour": "#66B89A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773172340, "uuid": "869f8452-71e0-4c08-847a-66a479c79b56", "value": "T153272299BB85563EE835C3354C110635B2965C078AC28ADFB68CF708AB775B48E8F7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773172340, "uuid": "607d9ce8-b1a7-483f-b5e7-d7947a29f376", "value": "393216:Oz6DLlWsuq3GWjEPkcpVVjF9s/krOTu76a2HzZxdyUXgLXt:OzmLUxqGW4McpPjF9s/aGsmpy9Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773172340, "uuid": "7175f11d-d51a-4303-9a70-9ca784f3217a", "value": 21921241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773172340, "uuid": "0336218b-7924-49eb-85ca-0ffc48958cd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773172340, "uuid": "b1a07dfb-5946-495c-8e2b-c5270c82c2e5", "value": "mparivahan-1771333307307.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac630a9a-1c6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773140138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140138, "uuid": "d389a4c8-c2f7-4984-93fc-4c5847048f8a", "comment": "Malware payload", "value": "84278aef6bad59f280b7f4513f58e240", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140138, "uuid": "8e6930b4-3bb9-4b20-89c9-7e8f73851c89", "comment": "Malware payload", "value": "1ec97383327393c772d3664b126150431617a4882b5e0b20b0cb240fdbf0eab1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140138, "uuid": "34172f65-2ed9-4072-b09d-ec28d9a8dbad", "comment": "Malware payload", "value": "4b8e26cc87a2a22bc074ffec363b80c0081845ea", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140138, "uuid": "c80765fa-d294-443f-b325-b24a92dd9742", "comment": "Malware payload", "value": "0c72c867a2a351555b6e2575d2d7e15d7b93d966d3c292f734b209a5f0b5d173f9f51338d7d85e17664f652ac9ac3464", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140138, "uuid": "7c716828-47fa-4610-992b-b040a42a97c6", "value": "T197D50122738BC626C55D02B115AAEF5E5138FDB7473540E7B7E8392B88F00C26779B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140138, "uuid": "15db154d-62ea-473e-b6da-06edadbdfdf7", "value": "49152:G2SX7jizoL5laI3xhBkpu75rsefBAk0UYmMnbGlIkvrt9L5RDH/WKpfV0mEondI5:K0sn17+mMnC/L5Rb/DRVZdIlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773140138, "uuid": "b5a6041c-3d0f-4a59-b562-fdf4430b8433", "value": 3000320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773140138, "uuid": "50dfc193-245d-46c5-b89e-dc6cda26f064", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140138, "uuid": "7e2072ef-619f-42a8-b921-d13c47933790", "value": "Update (2).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f80b2a-1c89-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1773151180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151180, "uuid": "68722aeb-503e-474c-a813-b41e97f3dd23", "comment": "Malware payload (Gh0stRAT)", "value": "9810d6089a0554e9baef00667a2031ca", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151180, "uuid": "13453a98-711a-426e-aa53-9340926a2008", "comment": "Malware payload (Gh0stRAT)", "value": "2199c2f79655ca13dc8ba2be4283b832135bc86614591f6f95e410ac9e075519", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151180, "uuid": "9f45b7a7-c54e-4f27-8924-82dc666a352b", "comment": "Malware payload (Gh0stRAT)", "value": "2121704e0e744bf956bbd816aa562400779d3c62", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151180, "uuid": "b77a1c26-65c4-4f6c-983c-0bab5744782c", "comment": "Malware payload (Gh0stRAT)", "value": "9938ca3628a0a300b0487968cb7df5ae20d108079226929eb6e474a25405380b68e02c8d9fe5b4d19d2b4a7af96fb12a", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151180, "uuid": "72d607d6-43f6-4b8d-8203-1f60cab50b66", "value": "T1F7E73317C4DC8FBDA3DA9007D5612A88841539C987F8D198DA7FDBD2261BA4327E4BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151180, "uuid": "fa786a98-f364-4558-8b76-bdc8ad74d241", "value": "1572864:sSgueZvnP2xgNXWPZGDjc8R1qBu581WwqRu6HPx5:s77xnuxSCmwpa8uVHPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773151180, "uuid": "20f668c7-11bd-4b1f-b8e6-d5516139a8ef", "value": 66222621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773151180, "uuid": "56450a5c-6d25-4f3a-bb68-32a8a1ce8aec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151180, "uuid": "c52431c4-7469-466b-bd75-918bd5d7f42a", "value": "XshellA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd30bcb-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126207, "uuid": "377cf893-8f6f-4377-906e-d3cfea8c5cb0", "comment": "Malware payload", "value": "974a0f579f95e80b1ff3de6d81f8b7d9", "object_relation": "md5", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126207, "uuid": "7c4d9525-aa4b-40f0-b2cf-878a9e51fa7f", "comment": "Malware payload", "value": "21dd863ff9bbd15da01c1218bf92bd65eeae04a41876e10c41733b58035414c4", "object_relation": "sha256", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126207, "uuid": "845c4b4e-e98a-4f7b-be2b-26f4c08379c4", "comment": "Malware payload", "value": "8cef47bd49826ea459cd697b150f7f3b03ec0e49", "object_relation": "sha1", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126207, "uuid": "baffa91b-99b7-47aa-89b6-5a994fc56c66", "comment": "Malware payload", "value": "3aa1e7fa3fb8daaabd3259bae5045775f922e968168bdcb47bb60db6da76e4992fd40535bd849cfc009634a9f5a43556", "object_relation": "sha3-384", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126207, "uuid": "802d662b-391e-4a39-8d1d-5ea7037385cb", "value": "T1AB52B02412CF664ED316537FB1BA0747363D2BDA74DD844F84182A6B0C61502DB71B8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126207, "uuid": "e13eaa32-7cc9-41d5-adff-6ccd6c297859", "value": "384:f6R7SbrBp/CK5eqIZbWOKP8h2brqgcmKWBr9:f6R7OBpybaPyUdcDWBr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126207, "uuid": "6d102a5d-34e6-4327-94f0-25ecc4a7a9e5", "value": 14126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126207, "uuid": "a2fa263c-9ec0-410e-80e3-6cbf49e7a975", "value": "application/x-chrome-extension", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126207, "uuid": "21e5e0e4-6fc1-4712-b3ef-d065f0643d97", "value": "21dd863ff9bbd15da01c1218bf92bd65eeae04a41876e10c41733b58035414c4.crx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc07359-1c91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773154639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154639, "uuid": "1d3ac628-31ea-48e6-b385-870881eb30cd", "comment": "Malware payload", "value": "c1852e25c07c758fb23388f7db07bb2f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154639, "uuid": "4fc64c82-7697-405f-b396-07988eb6131d", "comment": "Malware payload", "value": "22c7580541af6902f4af5e44a1fca89ca0a8c172f6e386fc39f96ca4af81fa43", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154639, "uuid": "3ba58885-20ec-4614-b01c-f7fba96e4a8d", "comment": "Malware payload", "value": "3e66d7cd3f6db2add822de542cb19803b29ad56b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154639, "uuid": "03bf7839-2aae-4de7-894b-206f7327f7f8", "comment": "Malware payload", "value": "ceb4308b93e797153947f0e6ec21e04f5fd66a0fa11ba89235c658c403ec70da9aa7a7a935fd3a03f266f7ee25013e57", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154639, "uuid": "e8e9fa84-ad1b-453a-b835-6d246a8a53ab", "value": "T1D4925CB512496D79FBD1CE39AF3C6F4CADE8C2C42124A3ACBA4F39215A1166DC70534D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154639, "uuid": "e26647be-30ff-449c-9ad4-ea1373a1e8e3", "value": "384:oScuQpWx+BL0SWL0gazsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:oS8i+BL0SI0xzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773154639, "uuid": "ed58ca1d-af04-4c3f-b589-4fa86d0f0a5c", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773154639, "uuid": "975738b9-9c2e-4b13-ba50-faf1837376b7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154639, "uuid": "0d606b78-dec0-4f86-a8ea-bb7d199fab5b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942f0223-1c19-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773103161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773103161, "uuid": "2e253a94-2600-4883-9e29-951cec6ea0b7", "comment": "Malware payload (Vidar)", "value": "66619f99187bf98c8718de5bcdd67976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773103161, "uuid": "73a7b2d8-5310-4759-8dae-d1a40ea97043", "comment": "Malware payload (Vidar)", "value": "24f8e3ce7459c2d32d0c0cdab543f415009c54d5d939c71b9e0ae6ded905a3f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773103161, "uuid": "d6ecc63a-ead3-42be-966c-ae767a1426ae", "comment": "Malware payload (Vidar)", "value": "9b61d7437d0a5043be5643fc8314783ec8e36e70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773103161, "uuid": "f35dfb51-4481-420d-be2a-dcb4a0387a81", "comment": "Malware payload (Vidar)", "value": "60d916cb352c62ba6e85dd50ffa1442005517e7c5907d465c93d2796ef9d7eb95e8d37cfc714cac7f73aaf1c7bdc163a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773103161, "uuid": "d3d70978-b7e3-4f57-a076-d48d145deb0d", "value": "T1D5B605AB72E48169C15ED13BC0D68BCCEBF3747C172786E702A31F58BA615C15D3AA21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773103161, "uuid": "5942f7d1-1604-4fb4-93a0-1227f6772963", "value": "1e54f30d93be40d1ca36769121a045a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773103161, "uuid": "62fa1036-6faf-4165-b97b-128e6416e852", "value": "49152:O1ViDxj/Fx1GwKe1xW1ry1hSTzPQebSPgMUM6hNoeomcpTfMdPHQpt+HHsfNa4Pd:O3L31PoeoX3pAHHsfNa4PKV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773103161, "uuid": "5845fee3-d694-4cc7-b673-d6d4a4563c3a", "value": 11020800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773103161, "uuid": "ca4a3ba1-d9f3-4f1a-9777-f1543ee86666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773103161, "uuid": "def5eb5b-8498-464c-a3f8-b036179224f3", "value": "SecuriteInfo.com.Win64.MalwareX-gen.67479391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce172b50-1c6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773140194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140194, "uuid": "2a168199-78de-4366-8278-983d8c986e51", "comment": "Malware payload", "value": "53c59025a7d123634803a6763b924dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140194, "uuid": "b8be3fe7-d6e4-48f7-b372-a6f37170ef70", "comment": "Malware payload", "value": "26db06a2319c09918225e59c404448d92fe31262834d70090e941093e6bb650a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140194, "uuid": "78d51253-7e7b-4dbb-8b0b-3548cc4cf7e7", "comment": "Malware payload", "value": "d0333c48d32ee97569668f7a3aab073aa82e9657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140194, "uuid": "320722d5-fa0d-4992-a504-0bf3cb75bafb", "comment": "Malware payload", "value": "25f206564714058ed598a2f8de5bff7bd9303e0e198b17f1606e2d1b90d4b36ef3488099539cfc16da433ca7113e4ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140194, "uuid": "599e81f0-8503-4f30-b48d-9d537abc818d", "value": "T1C8A58D11A7936187C13E8B7884FF0B13F734F0262307979B9980A9B86F157E9AE39745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140194, "uuid": "94544cee-bc10-4194-a900-5d1326dc82de", "value": "cb24c83e9e0f68a811d65891b8e7dc53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140194, "uuid": "8beed3ce-562a-44f5-abcd-b97f69aa02df", "value": "49152:aWa+Lt0gaDp3EXA0Y6VNbvt/A2aeK8cXHla6Ou71+iQ5ef:wAa2cEF+eKnQqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773140194, "uuid": "c4bcffd9-2d14-4242-84b9-e508f8352c84", "value": 2213960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773140194, "uuid": "3428c290-22da-4ac7-8123-f8d802e63c35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140194, "uuid": "4be6dd02-6b32-4f8b-89c5-25c4082d7a6f", "value": "26db06a2319c09918225e59c404448d92fe31262834d70090e941093e6bb650a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a59201-1cc0-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773174911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174911, "uuid": "7eacf551-5722-4759-856c-7da90dc980d0", "comment": "Malware payload (njrat)", "value": "85c65dcbe69c05eb41c04c283428f4fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174911, "uuid": "f42d1a71-ee0a-41fa-a110-2a30ed4bff7a", "comment": "Malware payload (njrat)", "value": "279997c885d0624ed794d19abbe608b1601def6047ea0380112ca9a4efe33de1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174911, "uuid": "9e803625-ee2a-4323-9d5c-a874576b1e93", "comment": "Malware payload (njrat)", "value": "1c1271a28669304b60702100b7ff2319278c618e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174911, "uuid": "37dc9da5-6c46-4a8a-8eb7-b5a224a9f987", "comment": "Malware payload (njrat)", "value": "5d51a727256dfe1169d9d12586c674b60270687504120d03e096782e6b2c6cbab8aad456e3abe297a2833fd1460ea5c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174911, "uuid": "ee3a71e4-9484-439b-b477-df874002870f", "value": "T197F41267B1B571F6D17786BB81514A46E335B87187A1AFDF03A883502E272D08E3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174911, "uuid": "21799591-bc73-4040-b390-daf5603529f6", "value": "469e59bd592f93ae01ff61cd0d813e4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174911, "uuid": "cbeed862-267a-4b7d-a5e7-932d131da588", "value": "12288:Ir8VpxdYrEZRdGiWU3uDVdgx/NXvraXF1LPlcPVhjSzaSMZP/rtGODK/J:28VtRdGiWlDvK9ra2PVh2zpMZnrtZO/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773174911, "uuid": "55b8b698-13b1-42e0-b8e9-14b2700253db", "value": 753978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773174911, "uuid": "73376122-a365-4413-a0df-590418761667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174911, "uuid": "125b5699-b4ae-466e-b99d-561b9930a1c3", "value": "ZCGm9Ky.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7c2118-1cd2-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1773182415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773182415, "uuid": "ea6c9bf8-b88d-4aad-bb6d-0d4feef67195", "comment": "Malware payload (OffLoader)", "value": "3a8688215724b24dd2885059abadb487", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773182415, "uuid": "85188d97-3c7f-4079-9f39-903fdee765f9", "comment": "Malware payload (OffLoader)", "value": "2862dbcdc9546ab145d444a68b8112ce79487a93bdb7c4b45dc6649b640516ce", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773182415, "uuid": "52209bc8-1599-4104-8c21-0cabc8cc6eaf", "comment": "Malware payload (OffLoader)", "value": "32c61be006f4d2c22dc94009d5bacfada67ab7b3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773182415, "uuid": "341af6d5-1e42-425c-b76d-f384ee2b3924", "comment": "Malware payload (OffLoader)", "value": "1c3f1dd77cb1a7fe5fdce941e0b88b4c51a703e14ed94e1d24c5f4f846686d5ef9beb634ad9dda7f9e3096c614c9e06d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773182415, "uuid": "9898e156-4c07-4bc2-9710-c996d2645fc3", "value": "T1F396F133B24B673DE06A5A3755B292205D3B7E61A40A8C06B6E47C8CFF390E01D7E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773182415, "uuid": "826ad3f5-253e-4704-9a0f-0d7acd687445", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773182415, "uuid": "48e2bb92-5702-4006-b644-863df2ec7eaa", "value": "98304:3N66veMksHm9d7cgb6cDFNct15QLzCkCmqN:PDHmTctact1GzCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773182415, "uuid": "4cf57f84-4599-4b70-9e11-55f3fc9c1994", "value": 8921244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773182415, "uuid": "a0b2df44-0dfb-4ec3-a901-503d1f01c34a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773182415, "uuid": "a7bd4270-ee38-407a-8d62-6ef838f72e6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec195e4c-1cad-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773166874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166874, "uuid": "e4009fed-fc49-4298-a3f3-5f70cfd1d09e", "comment": "Malware payload (njrat)", "value": "8022a431defe921e29215825e181117b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166874, "uuid": "3907d67d-2a5c-49d8-ad3b-eb19002b6680", "comment": "Malware payload (njrat)", "value": "28785af486ff66d9d2cbc7e7730af93eadc91345cfebc8949d068cd4363acad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166874, "uuid": "5ccaff06-9e2d-4609-9d86-eed1750e3088", "comment": "Malware payload (njrat)", "value": "4d77aafe0a3213d0674fde656f869a048561eddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166874, "uuid": "bdc075cd-6fd9-4fdb-a689-15a6927a0f20", "comment": "Malware payload (njrat)", "value": "426d39df1a3a490e0934ccffba70f4705266a9eb284765fa9995b5698e4b5ce6f946a4c8c812604e5d891aa99d296276", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166874, "uuid": "7912e343-b728-4760-aa42-07b1a7cfae49", "value": "T12AD6332B2E236CBAD77926FF0454A204C7E50E5841E8C119B8CEF399AD7EE474F1E650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166874, "uuid": "e8f37797-0537-4cb5-9137-7a51b242967b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166874, "uuid": "3a78362e-9169-4230-8f33-21c0ce65290c", "value": "196608:5gMiLSBWfz2xRUYQu9ZoAEodnfedP51RgnTR2Fym7ldbtJrp:5Hi+w2xiYQwoAECfe9RgnTRNa7xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773166874, "uuid": "71a3bf85-23e7-4741-92fd-de2b2636f852", "value": 13136928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773166874, "uuid": "6686cd9a-5695-4a82-8d54-071ba763ec93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166874, "uuid": "cc6d3bc8-a18e-4a77-82e5-3b029964baeb", "value": "MicrosoftWord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149a6f11-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773127428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127428, "uuid": "0e8a34c1-8512-4cc8-9380-4248825e273e", "comment": "Malware payload (Mirai)", "value": "cc02a987b917365fa45859f2a980c328", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127428, "uuid": "3475ecc0-5a66-4607-95da-cd2fcd84f5e8", "comment": "Malware payload (Mirai)", "value": "2951895fa2be58006489555ffe9a66dddca706364914b0f7a65ddf44a8bb72ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127428, "uuid": "8bb7bfe6-fd15-4284-8d05-f8cd94e39228", "comment": "Malware payload (Mirai)", "value": "9910fd4520c6121146ea2ffaf580e96573971cbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127428, "uuid": "fb84c3f9-6d43-41f2-a5be-b6ffc0d5e365", "comment": "Malware payload (Mirai)", "value": "94415e4a2df984f0c74912f2aa5ca0290cc78bc7790301b34776a88d579b46f84798e8271c38c8f5a839766236e49c47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127428, "uuid": "bac9717f-261a-4985-92bc-9d7a91a19c4a", "value": "T10FF41959F8809F61C6C03576F65D82AC33174BB9D2E7720689254B343BEB86B0B3BB45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127428, "uuid": "e75a8fcf-4ee5-4d24-b845-fdccb2fc3786", "value": "12288:im45VoHS0Xugj6krBTL4XXGJ5rL+0+qm/PEQSoUgYmp6pIKoS:imfYatL4XXEvcUQegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127428, "uuid": "864ea38f-2086-4af8-b082-1aa81855966e", "value": 726468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127428, "uuid": "cc5255f6-2a6e-4686-9893-d83235bdb7bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127428, "uuid": "ff9d8923-a310-4b2d-bafb-586823ae622b", "value": "yakuza.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab30ac4e-1c32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773113937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773113937, "uuid": "74a29ff5-efdf-4b84-a69e-5ea74d53224c", "comment": "Malware payload", "value": "afa0c6fc7c903fcc01e946ba02ee765f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773113937, "uuid": "c826551c-1eef-4790-8074-82e939125d0a", "comment": "Malware payload", "value": "2a901331e9cfcfef61e1f89af3e036def58cb744964c2f89574097c7edd970c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773113937, "uuid": "9e5e1a9b-aec9-41ce-a72f-c95786832917", "comment": "Malware payload", "value": "a9805e18633e42c925e2082790002fe9074010ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773113937, "uuid": "7a16bbb9-6242-4ec2-9f59-3721479fb5bf", "comment": "Malware payload", "value": "6e7d9e5aa5d52f05621e44b78dbb6d55a255a06a369079f137866a3b61bbad4ab89a5c701ce8ad55d284f443c200feb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773113937, "uuid": "1d0ff71d-56f7-41a5-b10c-ef9498ab56f3", "value": "T1E034B60AAF610EBBDC6FDD3706E90A0635CCA50722A43B753674D528F55A90F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773113937, "uuid": "3d531c9a-870e-4661-a46b-6bfed49bc5f4", "value": "3072:iRoUHIe0ngP+MaKVUMaLHnZgMtLgfllseSulyvARncOpNhOWhvvl:iRoUsnIMtniyLg8efQvwcOp2Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773113937, "uuid": "1dcb0259-d75e-498f-ba62-f91b059d3358", "value": 232968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773113937, "uuid": "326f2d3a-3103-4585-a3ff-34fae13b9750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773113937, "uuid": "d16c7587-23d9-436d-9cd6-474e39e198a2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68531101-1c5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773131434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131434, "uuid": "e853fff3-27cb-4b39-9d0d-43efe8702e51", "comment": "Malware payload", "value": "36e9686112309a9388e5cfbb8184f9ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131434, "uuid": "1be7b607-5fdf-4e38-84cb-94e0d48b4dc1", "comment": "Malware payload", "value": "2dc1d57d7599fc665b4fc94811c7ff03de4950106772c52789147213abb2424e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131434, "uuid": "bd9ca12e-5f22-4aaf-87c6-47ce961f979e", "comment": "Malware payload", "value": "e23894d94356f849389333b1e214452fc86045bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131434, "uuid": "c946487b-a396-42bd-b2ab-413def1fa9ee", "comment": "Malware payload", "value": "73e230e56e614d3200b665f370cf168c7251bbd69d126cc7063e4cf05e287bbfe885a8468e62cc1bc1987fe454418223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131434, "uuid": "89bcace3-7573-471b-abd6-7e7bae276259", "value": "T152B72356E2F900E8E97AC0B8C6575517F7B1345917309BEB62A48A692F33FE06E3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131434, "uuid": "3afa6f2c-babc-4f8f-ad77-644324df54e6", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131434, "uuid": "fcec2bc2-9995-4690-b517-b5aab898ca0f", "value": "1572864:G7m/QVXgGSC5NOJfu4lYt5xg6Jf/r0IfWGzBNK:G79VQtlz2DTJ4IfP3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773131434, "uuid": "3b93416b-ca66-4373-aa69-34388c168fdc", "value": 52306024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773131434, "uuid": "9b51a01b-cc27-49e5-b5c2-9c800655769a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131434, "uuid": "1a79f87d-269f-4d7c-9992-9a45a9d76cb0", "value": "2dc1d57d7599fc665b4fc94811c7ff03de4950106772c52789147213abb2424e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb69dcb3-1c87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773150578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773150578, "uuid": "a872cebd-8f12-4a6f-846e-0f7dd2a37e68", "comment": "Malware payload", "value": "294815a992e684d1c37df48dfd5a0e96", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773150578, "uuid": "67394e38-8b3d-46a1-ac65-06600e501bbd", "comment": "Malware payload", "value": "3180b97a80123e8fdfd23c325d6037666c5eea86e0b67783831c137b22259b4c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773150578, "uuid": "819cf346-24fe-4f08-a9ea-fb1e393b8588", "comment": "Malware payload", "value": "7b23e2cd2fcd5c8663ef524339c9204e1764ccff", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773150578, "uuid": "d9a0a7ce-017a-4d9e-90c2-248080d67941", "comment": "Malware payload", "value": "f5b001982dc285f68e26e699e541f932da6cf0fc08534f24012876238aa4333a93c8874782c88e9d200ab08d99f5003e", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773150578, "uuid": "7097081a-f341-4e22-b184-68089a27deb6", "value": "T178C63327EAB46ACCE87ED17BE0E22B42C7E3221FC595D93A847165C870517CF24C562B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773150578, "uuid": "ca3f0c12-8c72-4bbc-8a0c-ee64fadfde6c", "value": "196608:+ZftOidBMTYR4JYJopo4fUY8jrKUka9NZZ/adhnaQ5YxD890uU+HB/OGUElH6XUe:+BsVYiYyS+UnjrKUkkZ4Tnl5Y589rU+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773150578, "uuid": "fdd899ef-1a43-4fbc-9e92-82db4631cfb6", "value": 11623521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773150578, "uuid": "a7b145b3-7aca-4abb-914f-39ee3b6631a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773150578, "uuid": "677038ed-0f00-4194-a92e-9c3afffcd952", "value": "bkmsiqop.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e5053c-1cc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773174696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174696, "uuid": "c9ba6a38-33bd-4b1b-ba28-6799fe925d80", "comment": "Malware payload", "value": "1ff84128a336abc72a3c2944608dd952", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "GoldFX", "colour": "#46AD9E", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174696, "uuid": "1ba98806-5d6b-4412-aa59-05c1ee65cc42", "comment": "Malware payload", "value": "31b0624d16882eec282adc3817b18e4c8b3c80a9dbaa82e057a902cf7a27732b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "GoldFX", "colour": "#46AD9E", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174696, "uuid": "9915a038-6b06-4d83-b134-73452d7d0233", "comment": "Malware payload", "value": "39d8cd558c8ed1e2fb17efdf627663f728f3a77f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "GoldFX", "colour": "#46AD9E", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174696, "uuid": "49da6ed6-9cbf-414b-ab0f-9a64b6891cf7", "comment": "Malware payload", "value": "0ccd77da4e5c75810c035ab83d20b39b190b299a34659ce796dd6e2a4cbebd5c86054489bc2b731facf9605a125634cb", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "GoldFX", "colour": "#46AD9E", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174696, "uuid": "c1a2de5a-c9a8-4e3d-9938-4e47c92af9fc", "value": "T18036E08BFB48A95BC4F753B25539432245478C268B83D6C3AD54763C18BBAC07F4AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174696, "uuid": "4bb8538e-d77f-4904-95e4-6aff541feb40", "value": "98304:ag+wDQ6yu9l3KNBWVfkIrOooAJXanuTcPnUriDp1Bo1gSszcmLcFBgLCrFqHdgm:ag+wDQCXkIaQJXauUWWfB6FFK9gm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773174696, "uuid": "0ff57923-872e-4dec-ad39-c5bffa80ad85", "value": 5313037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773174696, "uuid": "2b97c39a-6397-45ea-bcad-2e6fc6e7b943", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174696, "uuid": "eb4b8477-c897-4e7f-99a6-9922b137fca6", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2c4e1d-1ca2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773162151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162151, "uuid": "00f3aa95-f41f-4916-a3a5-c933f0e96b67", "comment": "Malware payload (Mirai)", "value": "6656759f4493d5b9b7b2999ecaaca700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162151, "uuid": "945d7031-1cfd-4cc3-aaa0-334f74efee94", "comment": "Malware payload (Mirai)", "value": "3247319c4f6220528565e6dc67893af871eb946ce9fb519b46c6a2ccb24dfc31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162151, "uuid": "3f92e2fb-f103-4b5c-b8a7-7da50e4ce1dc", "comment": "Malware payload (Mirai)", "value": "66e3a2306307820a3e4c04d837e301eeeb1d4563", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162151, "uuid": "6bd9fb2f-a2ae-458c-8ba1-8c06e459427c", "comment": "Malware payload (Mirai)", "value": "2e4255497e9e4d0f55422ff21ba7941a2b0623db9d478b9784e1630ff04ef364cb1e9aab3083f7d8cfbf63d2685cb6e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773162151, "uuid": "998648c5-ef03-4da5-9443-3d383f6f5f1c", "value": "T12D03E16E9A6A1B85F0B301F68FFF254E3C907608868C88A57A9012BB6550F78774CFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773162151, "uuid": "deb38c71-6160-4685-96b9-a098d271c697", "value": "768:VSzkTSweq75FvJN/dkLkQFNm5iNHGzRREWXa6lumEu2KxcUudWnbcuyD7UHQRjP:VfSZqNFHqLPFo2uRR86lunxK+ULnouyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773162151, "uuid": "273d0567-e16a-4dce-ad2a-b515410d1a5a", "value": 39252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773162151, "uuid": "2e5eb378-f95a-4c30-8fac-44281f0196a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773162151, "uuid": "a5a5b95e-9839-4cfc-8438-bfe5737e1eab", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7f8b26-1c93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773155519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155519, "uuid": "9570629c-8738-447e-b7a6-16612202514d", "comment": "Malware payload", "value": "7c8a4368f9fbdb69919e7ac5d77cb0cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155519, "uuid": "eefd53be-02cc-43ab-b06b-779fe0a953f8", "comment": "Malware payload", "value": "33a0c1309df9b0b010ae3c95a41f494371fed66d8c533b8d4e4ac5050aa7d578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155519, "uuid": "26d13fd7-a9e6-47bb-aac1-1fe2419dbdeb", "comment": "Malware payload", "value": "ae187037f5b0a2a66b2a3e63607b45c17c20aa5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155519, "uuid": "c4625798-7c0b-4ec3-b193-6b3d8fa311fb", "comment": "Malware payload", "value": "284813e5ec44b00bd3bd22eab14db245bbbd5273ef15f3b8a8156b6e42b988b56fa31840234bc1fdeffbd7bddc0e7dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155519, "uuid": "1863be5e-7494-4fa3-8e82-244f3bccd20d", "value": "T11FB723237684806DE56A02315E6F6EA4E2A96C331B2141DBF690FF591CF05D1BE33B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155519, "uuid": "6543351e-8077-444d-a815-9405c906ab65", "value": "a5a0f941862df8e0d01359e62a3aaaf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155519, "uuid": "725a02ef-5a43-4031-ac46-a4d38ded9aa5", "value": "1572864:J79AuHgIvNLcwMyHE0AoFAhs8blELYkahNm/w:JZNvewEkwsoEyPsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155519, "uuid": "3b438416-6284-4b8b-8ab5-a1c417d247f1", "value": 50347448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155519, "uuid": "15b75077-63b5-4793-acd1-ad48fbdafe3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155519, "uuid": "58e1e124-5d64-4d41-a273-80b342806a0a", "value": "SSA_eStatement.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6992b96-1c8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773152181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152181, "uuid": "31bd4dbd-4669-458a-bdfa-b3018151d944", "comment": "Malware payload", "value": "e57b9f685620923992867b59fc38ddab", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152181, "uuid": "1e7d2842-e126-4783-9dd5-2c55b86fee63", "comment": "Malware payload", "value": "35142083739865cae3d077b2bc96cdc348f871dc7d0d9d3e2bbfb27a91b7af75", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152181, "uuid": "285649e4-80e3-41f4-9910-7aa03225a1f3", "comment": "Malware payload", "value": "56cb934f07c3d445c3bb9477fa91750f9481e91e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152181, "uuid": "43fde01d-afc1-4c3d-83ed-908b3443afe8", "comment": "Malware payload", "value": "7dd5944186d2ef6ba4edf3a5439d46015a1612f8ba26229eba7727117e5d650c22460a228a7e015a9c36e8c401cb81ae", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152181, "uuid": "99809a5a-862c-40bd-b961-923ea4029c9e", "value": "T15AF6CD23F505299ADDC6A134F5E7579577301A4403A3A339271FE02AFDA21DECA37AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152181, "uuid": "3cb420bf-f6d5-4d18-a985-4e25c9ef09b3", "value": "196608:jyRWHpbw8y/xZ1rWlZwwJ+mkPLzmIbq6lOXJf2dSMLUO+vvhlVRxL:jhVPy5PII7Pk6MZfDMLUOcVrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773152181, "uuid": "da7f0db6-5ec6-4fa3-b383-ec71427cf30e", "value": 16576086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773152181, "uuid": "57932df0-2659-47c9-bc81-d904cc2c8ccf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152181, "uuid": "69efb862-8a29-4f89-812e-eedb77f958af", "value": "AGENDA2026.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1cca20-1c90-11f1-a769-42010a9c0008", "comment": "Malware payload (AteraAgent)", "timestamp": 1773154363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154363, "uuid": "a2a51234-d20b-45cb-96f8-b59d4211780b", "comment": "Malware payload (AteraAgent)", "value": "2db9a7aab1c3dc668e1300e8a74e0910", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154363, "uuid": "97190fe4-8951-4a97-8739-4c48eeac7743", "comment": "Malware payload (AteraAgent)", "value": "35ef0bf99c51eb00f0dfa0c6d6dd6f2d5abf321477097d167bc3dbc8ba451aae", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154363, "uuid": "e09f9a21-cefc-40e3-8c3f-3c4eb790f398", "comment": "Malware payload (AteraAgent)", "value": "96b0ee465dcc157febc42fb3f80d1f8d72732ba1", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154363, "uuid": "d283c1b1-2266-45e9-a271-f030686e6360", "comment": "Malware payload (AteraAgent)", "value": "fd71ff06343b801545c419e43b44dda8e9b18927687016a635272ce93c19a9e7343bbe20c277440831ce6ac600b027a7", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154363, "uuid": "0e02c3e7-1929-43f5-a999-5dcf0acdde72", "value": "T1C3862318FBE009AEE5778276C56A8520EA327C8D3720C54F47A4B6295F3B7A075BF701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154363, "uuid": "2a208753-0c67-42d9-a62c-b2cbec378837", "value": "196608:wW/FamnGYLnWgziirlb4/ieF3GrAfedpvCs3md8r:faqGYLpZreF3G82yc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773154363, "uuid": "b46c5c00-1263-4a66-b9d6-3a0d3c456a5d", "value": 8601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773154363, "uuid": "6add2262-9f68-4918-a18d-7c8becff8871", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154363, "uuid": "5ffc3f9c-4090-4ba3-ab29-3335f5a24dcc", "value": "Google Meet.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1049d7aa-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773127421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127421, "uuid": "3094715c-3f12-4809-9564-97a2129a6da7", "comment": "Malware payload", "value": "e68553d3a3ab02a97cc28360171a7954", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127421, "uuid": "47d6d7c8-b487-4521-b19c-4eff6199a5ca", "comment": "Malware payload", "value": "37ca01500ad02d3681a40f5dcb0f633dd33e6b9c65361f018ff4ceb087382d35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127421, "uuid": "f26c51ed-6ba6-4432-9b12-bcc3b011277b", "comment": "Malware payload", "value": "4aa8ddbe2b50624f89b04a5f4ba44a6b0967945f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127421, "uuid": "e1aebdf6-b454-4098-86eb-0b43a517800b", "comment": "Malware payload", "value": "9223d0b984e90cd8821eaffde615689ca3a53eebd2e9d4a7b89b585178c0869b3ee61bf6a65e08a65d8e466610a3563b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127421, "uuid": "73887d63-dff5-4dce-bb41-94a89d1e4329", "value": "T189B4CF56F61AEE43C4F3A636C5BBC2A07376D80F1B9293062609557C3C1BB3A4F2A745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127421, "uuid": "aed2045d-07fa-4f9d-8e20-437fec684116", "value": "12288:DJ7+FYPEso6sCQDbE6pC41XmlGqmcYrNWcN:t7oYPEiA2lGqmcINWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127421, "uuid": "a04f524e-9d59-4adb-8121-f05dece8416d", "value": 499148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127421, "uuid": "da4cda9f-0ec8-460a-9cd5-c34111016f5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127421, "uuid": "8f03bad6-17c0-4eec-827f-89622059cf01", "value": "scanner.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b52da5-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146375, "uuid": "9903102c-c93f-4981-b0fa-283c3036e662", "comment": "Malware payload (Mirai)", "value": "f9bacfd435a618e136c0226b7fc3dee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146375, "uuid": "79877f81-c812-456c-91cd-4068ab403a8c", "comment": "Malware payload (Mirai)", "value": "37f6367bbeec7391c1ab2df630399eca0e73b3b1c11a76174c2aa9235657e1fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146375, "uuid": "e49a82c7-6fc2-4479-9c4c-8d567dc94903", "comment": "Malware payload (Mirai)", "value": "0aacb9947d432f75845c56283695fe6ae4a0d54d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146375, "uuid": "257f3739-7901-425f-8767-41e81b99f6cc", "comment": "Malware payload (Mirai)", "value": "96c513797b5a1330c62e3580afd8dbb8564295a34827a96e794c8a688508d35c6de66171a8ca98995a5c6ea9fc86cbd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146375, "uuid": "ade4733a-5280-4f1d-b963-a4f2a1f9e2dc", "value": "T179C3C85E6F218F7DF768873047B38B21A75933D626E1D685E2ACD6005F6034E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146375, "uuid": "c2bd7863-3b52-4db6-afbc-247ff3eb098d", "value": "1536:Y88H1Lkwwe4eypjkqJ2IzjvCLEuMQpa5VB4nbHGvcEtueK7N5mt9puW6:Yr1L/wvZkyDVB4nbHPEthtiW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146375, "uuid": "e03368a5-2aa0-47eb-9e67-d37b98c9e529", "value": 118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146375, "uuid": "be6eb393-51f9-4bd0-9cab-73a6918171d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146375, "uuid": "f77663ea-1be0-4950-9d27-eca51154e559", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f01aff-1c7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1773146806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146806, "uuid": "0b4b568c-3122-445d-9bf4-33f8295b2348", "comment": "Malware payload (Joker)", "value": "f1b66596cd33e14130dc89c6edff044e", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146806, "uuid": "731b3336-6d40-4e74-ae51-ab97acef59c9", "comment": "Malware payload (Joker)", "value": "39da92a78551d93d2cc854b0e2358ec18ff2f0d73a419243ee4ba9d9d4dfa6d3", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146806, "uuid": "781dfd1a-93f4-4139-bd04-40985d4c59e7", "comment": "Malware payload (Joker)", "value": "c870805c4233a3159fc82e39d3c7ceccf5930f41", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146806, "uuid": "69cd22d2-235d-43fc-88ec-c302b4a2b98b", "comment": "Malware payload (Joker)", "value": "5e5dbff75a0b8afed632285815e20e362189dacf1adafcab99702d4d84c65e28e541ebe51ec644f7589e79d8b11fb839", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146806, "uuid": "e7b62ed0-715c-4504-8320-e33ae467a3a5", "value": "T18E77220EE30DA91FD9F3F478494A222178561C55F6019BF75A26F26C6EB39E48F0A3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146806, "uuid": "b07da934-4c03-4470-a2ac-0c9285def35f", "value": "786432:U+cKaSMSSQogKMmgjnkmXYKCxVQ7yTwhtGK8:Zl/0gjnJoKSmsoR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146806, "uuid": "a8ca4f13-a861-43a9-b064-724f3d843200", "value": 34042855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146806, "uuid": "c94da260-dc8e-459a-ae99-4a55d900fec3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146806, "uuid": "0d93c89c-70b6-4f43-b7f0-fecbe490e410", "value": "com.lcclean.phonehub_1.0.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7018e7-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126158, "uuid": "4340a493-ffae-41b7-a382-05580621d243", "comment": "Malware payload", "value": "12396c430f9d7314a3a12690e7c3b4b0", "object_relation": "md5", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126158, "uuid": "5aa9981d-529f-4349-8502-696c80168b92", "comment": "Malware payload", "value": "3a427a7551be62498c3cc90bd484c4b59acea862e090c858867bb70a2be83af6", "object_relation": "sha256", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126158, "uuid": "fb80d34d-e420-4471-8df2-ec32ce3fa859", "comment": "Malware payload", "value": "388c9f740a75079b613be573aeaca7a52d28a84a", "object_relation": "sha1", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126158, "uuid": "eef2f967-a448-42a2-ac22-c7321b3c935d", "comment": "Malware payload", "value": "7a74381457a738fe44c3dbd08cdff518dce87291b030e7f8e43b316e08e4cce2940bd8e9c5c99c50766d6a306df79875", "object_relation": "sha3-384", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126158, "uuid": "9ab1efbc-4548-4e0f-b231-28939a776bca", "value": "T1ED42BF87784E47ACAA2D2D380B21477C1E5A3B44E2B0788774C0A24194A6D7FA33D6DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126158, "uuid": "c3cd398f-25ee-447d-96cd-804aaff9f612", "value": "192:5csMRy36qyCdcuFUe1nAKWKdq2/Js6RMG0gx6kexIu9bYDUqTwC9rpv7JV0rw+6:5CRuEe1nAKWKp/Js6GG0gx6WxAqTwCl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126158, "uuid": "e931d801-c120-4bc7-b464-71826ca2625a", "value": 12119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126158, "uuid": "37971a66-3b64-437f-86b9-00a4cb94f5c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126158, "uuid": "1e15208b-e095-4724-9911-d31f203af6cd", "value": "5629be21869a83e9b9da86ab16a2d9cebd0aed2c04a9efe2ac044dfe0d5db6b9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a401ee2-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146389, "uuid": "86bbbe65-9917-40c6-8e9d-31e0a7a2740c", "comment": "Malware payload (Mirai)", "value": "66c7f1fb36a3fde69a1bf2dc3ea4a554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc440", "colour": "#ED6C76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146389, "uuid": "ccead438-9a62-4c0c-9ef6-eaebff931d8c", "comment": "Malware payload (Mirai)", "value": "3a6e232786a377ecc109e2be8e94017da339e8edbb0614be412e47ceb8523535", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc440", "colour": "#ED6C76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146389, "uuid": "5f216c77-0141-462d-bf32-db5ebc5c58ac", "comment": "Malware payload (Mirai)", "value": "b59dbdbcd79219838bd60987dfbf0e6c48f1d94f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc440", "colour": "#ED6C76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146389, "uuid": "e684e962-da5a-42cd-b157-950bdd0a4cf7", "comment": "Malware payload (Mirai)", "value": "dae7efd709c70db27bf147ec194bb6891845fcd845457e17c1d127029b8934679844c458a44ba5862bd4b5b0fc24be90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc440", "colour": "#ED6C76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146389, "uuid": "baf03b36-6f91-4197-a541-791ffdbd0ecd", "value": "T176936D42B70C0A43E1574DF02A3F57E1C3AA66A120F8FA89790EDF4996B2D325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146389, "uuid": "0633044b-1576-4083-8302-0adda000f876", "value": "1536:qf9jbHKubuZqESdJmL00CC0MaIy3qTfl3GwT1fm4ymM/0l1WrFVfTAeG2+c:6/gHTfhGaymMyWr3+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146389, "uuid": "9f36564a-9c6e-45fd-be0b-18ed380609f9", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146389, "uuid": "66c5aaf4-304d-4ebd-9a06-b712e1b7c672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146389, "uuid": "55433a46-59ef-4b7f-9e17-e55e2571bb62", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1763f49-1c5d-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773132416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773132416, "uuid": "d22c7abb-1f8b-4976-aa84-9f08ffab5dba", "comment": "Malware payload (QuasarRAT)", "value": "44b7d79f19d7df2bb5db6cece3d80330", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773132416, "uuid": "148ffa6a-6aaa-4588-a4bd-9ad91701953b", "comment": "Malware payload (QuasarRAT)", "value": "3b46e6a3843acbce890fa4fb3525ad232617f65e1d758a1a54c9c38ce78ddcfb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773132416, "uuid": "c3e8bef1-a0ff-460c-9aa4-773686bea552", "comment": "Malware payload (QuasarRAT)", "value": "0d388a200dbc612edf36369500889aba1fe4d5dd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773132416, "uuid": "77676d34-a523-4bc3-94c3-2fa4a3634bc9", "comment": "Malware payload (QuasarRAT)", "value": "c268a94b33988a44c6f85a288540efe7947248c941a08746ac81a8c77cf9a0079f33dd5d5aa011203a2b3e405e99a8f3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773132416, "uuid": "82e9977b-ffdb-4742-9a41-ab73c86b37ee", "value": "T1E5850250B7F5851BE2BF2BB9A4B308090B37FA53D93AC75F1948909C1EA73409E517A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773132416, "uuid": "5e66ebab-b78c-4ebd-bd51-4000757e382a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773132416, "uuid": "25c44788-6ee0-491e-a288-1c8d629b54b3", "value": "24576:bg0iZSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBkkAV:bg0OTYj77wRGKKm77LrwCB6hqan0hgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773132416, "uuid": "43bcfba6-f6e0-4511-97b7-55a77b1c5c7b", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773132416, "uuid": "5e43d8d6-d3fe-46f8-8830-4280cea71b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773132416, "uuid": "2e575d5e-2a65-4214-ad9d-58050c1282b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13e0e14-1c8b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773152199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152199, "uuid": "6bcf9a17-a26b-489c-9266-1992c0dfe847", "comment": "Malware payload (ConnectWise)", "value": "4f771c4c9072702af2b4fc3cf6bd00fb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152199, "uuid": "aec807a6-f808-409a-84f8-d7bf7dcbe14e", "comment": "Malware payload (ConnectWise)", "value": "3b5c618743ba3edf3ed0674de7bf5e58c73645d8c59ef626dc2016fafce571cc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152199, "uuid": "f142661b-e7aa-467b-a44e-feb06e713076", "comment": "Malware payload (ConnectWise)", "value": "63d866841ff2c9b2c63d73b1f3400df3e0641ef5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152199, "uuid": "21b23be3-eb6d-4b08-8066-a76c986a0af0", "comment": "Malware payload (ConnectWise)", "value": "f32114d5a860d0dccb6d45e639160c27bc448e46c3741194cefdda9d8db45b766f2e450d5a4dac15b3d394eb76d5ab25", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152199, "uuid": "544a6038-5136-47fd-8454-a282bca42a43", "value": "T1EDA6232153F9D028E0F35B35EE7AD165AA32BE618E12C15F1354780E39B1E8196B373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152199, "uuid": "88eb0060-4999-46ed-847f-d8478609b9ba", "value": "196608:MBn2hg5kEWmXhcfKjSVNh7vGeoBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcfKjSVW:ogdEEijaDGZgdEEijsgdEEijogdEEij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773152199, "uuid": "acd83194-157c-46dc-995d-ae48d636b525", "value": 10121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773152199, "uuid": "f453d3be-97a0-40c7-a764-b70cd98b7380", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152199, "uuid": "59837407-49a1-40f4-babc-8f49999578b0", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3287bff4-1ca0-11f1-a769-42010a9c0008", "comment": "Malware payload (SilverFox)", "timestamp": 1773160979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160979, "uuid": "9c0a7810-311f-40fe-a408-2f3fefcf62db", "comment": "Malware payload (SilverFox)", "value": "e2aa0ef5907998a2f63f8b4b153fb25a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160979, "uuid": "1e3f828e-5d55-4a94-8e0f-fab0cd50fb12", "comment": "Malware payload (SilverFox)", "value": "3c78c8b86ddec02a671907c723fe654b474797b5d19a8acdaa2af3251f655736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160979, "uuid": "2fa46289-86c0-49b5-a829-efa712f19331", "comment": "Malware payload (SilverFox)", "value": "61f2a0a2fd5d8bc2005228ea0d325a3ab32b5b62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160979, "uuid": "dcdab594-51af-4fee-8370-f67bf144568c", "comment": "Malware payload (SilverFox)", "value": "6b67f168fb1fa56f3f787e6b02a05f8bf4e3c6e3324e489c1ee035c0e23960765bb6df7de3a8b71d99d6222893de38d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773160979, "uuid": "4c85bf7a-32fe-4245-b18d-b3c9022fe204", "value": "T18C251286F6170FF6E9FB52F908734DBA392DE8A50B15AF9A13401B4DBCA13A4875D340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773160979, "uuid": "132f0170-95e0-48c7-aeaf-ff96fd705beb", "value": "b538e4224cf15f19a61a8c8cacf778b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773160979, "uuid": "a67a5a96-599d-4d5a-8686-838a862a069c", "value": "24576:2vi9/2iuC0zCvc8iTz3qf5uEa66uPHZw:2K9/2i1vRiTLM5uEquPHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773160979, "uuid": "1baff9ad-ce7f-4f6f-9938-ad348fb59633", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773160979, "uuid": "544672c5-b2b7-4ab0-83d8-c78a7a6ce557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773160979, "uuid": "564f2eda-3865-4db2-94d8-27667731aef6", "value": "2025\u5e74\u7b2c\u4e8c\u5b63\u5ea6\u8fdd\u89c4\u5185\u804c\u4eba\u5458\u540d\u5355\u4fe1\u606f\u516c\u793a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ad84c0-1c6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773140184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140184, "uuid": "fc4a0346-24f3-49cc-9421-d47463770994", "comment": "Malware payload", "value": "5751f87be05e6115fa018f99a23edde8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140184, "uuid": "6ee3a880-a366-4f97-95a9-5c4b25e89f83", "comment": "Malware payload", "value": "3da98d2e328c4878eb3c43ab560dda53370b87bbaa900253e5e871db457bb239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140184, "uuid": "3f9868b9-f0b6-44df-9258-c0cbe801e9ce", "comment": "Malware payload", "value": "c68841326d0a956c22d0d6dfe276ac8dbc9f888e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140184, "uuid": "2cd831f6-7da8-46af-80bb-4b31ce7f5fde", "comment": "Malware payload", "value": "acf8a7d6164ada09aba3bcbb2615d54be24195ed0895cb43117c8b02d00d09db91a2c4c34b909302208e1613ae3cab1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140184, "uuid": "cd026023-0f4a-4690-8f83-9be00bffe08f", "value": "T131B58D119B936187C13E8B7884FF0B13F735F029230A979B5980A9B86F157EDAE38745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140184, "uuid": "46279109-31d7-4bd2-ba59-8cd1bf9c5215", "value": "cb24c83e9e0f68a811d65891b8e7dc53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140184, "uuid": "da3f3ea8-7803-4e27-a0ab-800901904e56", "value": "49152:m0qnKqBqKdKdyvY5ifThKtf99Eaw9DGmr2Cwt5TJQzC:m0qK85O99EFFCvJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773140184, "uuid": "63e268b2-80e4-4833-98fb-cab748de14fe", "value": 2268744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773140184, "uuid": "d3b186f7-ee6c-40b3-b371-d3e2b5f59766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140184, "uuid": "e6f7a3d1-6ac4-4500-b346-e2cab05306a6", "value": "3da98d2e328c4878eb3c43ab560dda53370b87bbaa900253e5e871db457bb239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a902a2-1c42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773120642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120642, "uuid": "bd9e6517-cf03-48f2-8c52-96a99104adf9", "comment": "Malware payload (Mirai)", "value": "5e3ceb5a892c700fa5b9d6f179d8e67f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120642, "uuid": "a8ff35c8-c1cc-4d42-ae73-45611f6c7fa6", "comment": "Malware payload (Mirai)", "value": "3ee6a40138eae3dd86918bfdfb67402efb2d98251d4c4a8726acc7b555a5b735", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120642, "uuid": "18c8f97d-dfed-47ce-95a2-380b6124b81a", "comment": "Malware payload (Mirai)", "value": "fe4002640e10536fc0822d7b830b0859735bdf3f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120642, "uuid": "47a421b5-a0f4-4a71-b67b-9605c2ffa3d3", "comment": "Malware payload (Mirai)", "value": "b4bcc179ebc39864d916778d5c230a9d143c5a72d5374d2969b40cc9203e6db915ff5aaead17d8908d07a56c39e68264", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120642, "uuid": "17423a80-41ad-406d-9302-977083a15d4f", "value": "T1F8B4E089F2533F42C4E7D5350486C5458A56E6A723E3970A7B076ABF382E3B34F28359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120642, "uuid": "b14f013f-8a4a-49e4-8668-b6466673dcaa", "value": "12288:7I22AR32KcU/fsc+QZJxLJrrjyFyf+MD6pIDRlavD7:7IdARmlU/fsGZ3LJrVlavD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773120642, "uuid": "83031651-d576-4f12-aa61-bad400177927", "value": 529972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773120642, "uuid": "2f93dd9f-7004-42e7-9a8e-28dee814e8b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120642, "uuid": "01326e48-cfbd-4288-88ed-d0f74b8fc55c", "value": "yakuza.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2b4016-1c27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773109081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109081, "uuid": "08940546-ac6d-430e-b299-13892ccc60a4", "comment": "Malware payload (Mirai)", "value": "659168641522e8140a60dac1c792b1ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109081, "uuid": "ccdf4a4c-7e60-40b7-a3f3-ef334db3652d", "comment": "Malware payload (Mirai)", "value": "3f41bed9b6be25373a6076f71fd6f4c1555ba5c59dee7e3fc1d9069715a39284", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109081, "uuid": "a5c38d44-44f5-4ca7-afe6-8524cf8b1b6b", "comment": "Malware payload (Mirai)", "value": "c8aaa359fe1f1c54532697dde53f7a4f77eb4ae2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109081, "uuid": "8d371279-65fc-4e0d-8bdd-61059a777865", "comment": "Malware payload (Mirai)", "value": "d0c6a83179ce6df86b7c502db4923540bff4443946837699974b8065047a2905dc38c4e1b85afddf9f5d7c93136a7a69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109081, "uuid": "15a16dc0-3b9f-4791-a3f3-69df358463c9", "value": "T1E9144A43EE890EDFC46BCEB086AF839B1EE7559B4CE1F1F4483C8C0C755929A45A3648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109081, "uuid": "5e6b6135-d628-4f55-8fbb-add62a1a7658", "value": "3072:yBt8bTpiRxg6ExxVwRN+kM1k/uJvnuZRR7YVDFHUh/fbsq3nHXWkqd+4:3Yxghx7Oiv2RR7YtFHWAq3mkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773109081, "uuid": "b3a0ffd3-7918-4790-9f28-d6898f65a3a3", "value": 205248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773109081, "uuid": "2e379c91-050a-4883-a2b8-0d2479979cbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109081, "uuid": "352620a5-3a87-45fc-ab34-1c46181c55b7", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc83893d-1c7f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773147064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147064, "uuid": "5a08c816-f9b0-47f5-9f54-8fa2fdfcdc19", "comment": "Malware payload (PhantomStealer)", "value": "781409c66a487295a8cd092a917fa567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147064, "uuid": "12dbd936-d4cf-440d-99a8-5355e3368abc", "comment": "Malware payload (PhantomStealer)", "value": "3f470f09b2678cd0df645f1bbb33aa068a48a9ddded42798a9d1df85a822893e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147064, "uuid": "74b4745a-0e3d-4b0d-b3df-ee90b339463c", "comment": "Malware payload (PhantomStealer)", "value": "8dabac6c4a9290b29541f7a03c85766f88fd01c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147064, "uuid": "0e4a3ab1-59c4-4975-a207-5cb363fb88d2", "comment": "Malware payload (PhantomStealer)", "value": "421de6deb8c2da4e7913d74504ea7fb0f788ee7f8d0bd57e1cfd99e94c0345b412f1b64ea7422dfc8ced89585a211260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147064, "uuid": "b8fd3433-d003-4fe7-add5-df0c2d9bf999", "value": "T1B7269F70AF483772F298DB3CA4BE154EFFA94409E18B349D8D19A8558B563E0173C8DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147064, "uuid": "11bdf140-92c1-45e8-9496-225d8f7093c2", "value": "49152:2MKowfsqX4f4PrjuDxw6+iBvc3TtNeHLbbYohNd1teKF9sc:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773147064, "uuid": "674c1537-a93f-4d11-a4f5-5328c3268194", "value": 4612871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773147064, "uuid": "dc8dac3b-0c7f-4872-a814-5b0b7d88a22b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147064, "uuid": "10ef562a-0693-4e76-b45a-eaee3a0ea939", "value": "RFQ 10081.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac76a9c-1cae-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773166952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166952, "uuid": "672e8bca-df78-430e-89f2-305cdfa6ad8f", "comment": "Malware payload (ValleyRAT)", "value": "d41d3e8df3fa8de167bef5728324c5f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166952, "uuid": "c784f702-5aed-4943-b414-f0d261fb94dc", "comment": "Malware payload (ValleyRAT)", "value": "3feabe54f4a47c30cb8665b2e6aae44aa293d3784cf57e8d2bb2d88a169afb5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166952, "uuid": "9369fb41-a26d-49fb-84c4-b6e24e94e809", "comment": "Malware payload (ValleyRAT)", "value": "0f6f2e4fe369e3cf4df5867fed7ab6c9c24a2d83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166952, "uuid": "30ebe816-7a19-45a6-a1ee-78d7871e10eb", "comment": "Malware payload (ValleyRAT)", "value": "c825b73f0d30ccf021e5eef75ba6acd33a83d440e856fcdcdb106e9123cbce7b3f34de28d8447bc3ae23973cb3059657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166952, "uuid": "974dbf29-dcab-4586-9ccc-b27b20deade3", "value": "T103952993FACB9CEACAC657B896C743312338FD1587166F2F6604C6316D436C5AE4AB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166952, "uuid": "5bb4e946-e499-4a4c-8c25-692a8571d033", "value": "bf2535b8c63f7d9528e4a6f37ee5c9fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166952, "uuid": "4f942199-2b6c-486a-9f4a-6a11ca5ea2b1", "value": "24576:d3WHsegKO2fVKCsTdqReYSaosI2MtL8JsU3Aot+Ec0xMkxd0MdA926B:dGHsegKzVKCsTdqopsI2Mt6d0MdA926B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773166952, "uuid": "118b3880-4b53-4629-a9dd-0ec2e8b0069c", "value": 2024417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773166952, "uuid": "1b275923-896e-445f-8be9-820623a9134c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166952, "uuid": "9664d5f8-aa09-4151-a2cb-88b41a648019", "value": "2026-03-10d41d3e8df3fa8de167bef5728324c5f4.ex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185f79a9-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126146, "uuid": "2fef8ae7-7034-4921-bda0-37af23992840", "comment": "Malware payload", "value": "40ed7a9f1e99273bd679dcd6fb251e53", "object_relation": "md5", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126146, "uuid": "b5cb17d2-e73e-4525-85eb-a6445d8a2ea6", "comment": "Malware payload", "value": "41485557dca4ad28660d8de7bd5e42aec119680422a9ec3fe45a9bfff66524e0", "object_relation": "sha256", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126146, "uuid": "b3db68c3-96db-417f-9e19-928dd6d8a46a", "comment": "Malware payload", "value": "6385941b3f875a3c9520d4edb765d9ca2b85948a", "object_relation": "sha1", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126146, "uuid": "ae5a808b-3fee-4496-8f58-5e845410839f", "comment": "Malware payload", "value": "211ad8d32adab70b8137a805c325dc5ebf76b426b2387841ce5beb390122d308dd51eb8780462a86fe493d3ab9e9d1d6", "object_relation": "sha3-384", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126146, "uuid": "89d2eecb-a51d-4805-8760-2e149dfbd0b4", "value": "T1C282D0AD4DFB757E5A3B00680B35D119DEF1A7A403388E96645335AC01B83F38E592AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126146, "uuid": "e7ec08d5-f463-47bf-acc0-16a1cf5e1ed3", "value": "384:0IRGRwD4faMqop26cycUneH8sYcOHh3CPPDWE/Sb4+9/4M+aiRVlac:p8RwDuatoGyoxY3C9/ROwMsrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126146, "uuid": "4bce95b9-18a5-485d-b9bc-f22f31965e0a", "value": 18472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126146, "uuid": "4a724ae8-7fe3-4df8-b3c2-3d242eff38ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126146, "uuid": "3e467dcf-53f4-408f-8069-2b0686533124", "value": "a25a3e108f62a10caa2b736123ca7350e9dbc1b888c44e909cbd6866205ca671.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90383b0-1cd5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773184048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773184048, "uuid": "0d17aeb3-9380-484a-92e7-2975bacc29ee", "comment": "Malware payload (Formbook)", "value": "323197302e9f5e7e2cc53e85030b1435", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773184048, "uuid": "6623b051-eef5-4575-9f9a-03e1368d9229", "comment": "Malware payload (Formbook)", "value": "41f15692bdc648a75ada7c9df6a0542a40e2c050f846539b52eeac8035c5af5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773184048, "uuid": "2b6e39e1-2741-4fbf-b05c-5c3ef5e91524", "comment": "Malware payload (Formbook)", "value": "38564a193717e2302c41cbbf62814dabfdb24434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773184048, "uuid": "5c966154-d0d2-4bd7-82b7-0e68cd838a87", "comment": "Malware payload (Formbook)", "value": "a92f1edd0af5bef29905891b6c32478f1df3314c8eb4291e54e9c98d1adcc7ee8dfe5aab88a3ba9e5b8b6a96b9d883fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773184048, "uuid": "50347942-5a54-4063-9afd-55bbdec4bd2a", "value": "T13A3502AC1A66C907C85A97780DB1F235436D6EEEB451E2572FECBDEBB875B004C14283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773184048, "uuid": "fe1a2f64-06de-4c0a-8392-e5030f93231e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773184048, "uuid": "4cadbe5d-85cb-41b9-ba4a-104585bdc0dc", "value": "24576:9EEL32pgdurfpf2DIqbwRN+6F5waxRuQ:qESpgcTMDIqbwM4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773184048, "uuid": "6c4bbd80-dc5a-4748-b968-17e9d86896a3", "value": 1060352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773184048, "uuid": "c48de09d-6cc6-4862-84cb-13d9327c627a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773184048, "uuid": "3adcc4b7-1a2d-4a2e-9f41-2c2360d480bc", "value": "RFQ-MV. SEIN FRONTIER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ad157a-1c2e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773112023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773112023, "uuid": "acc4654f-ce61-4e6a-a6a2-e987f54c9ca5", "comment": "Malware payload (AgentTesla)", "value": "c276656be1cf557489fef8441c674ec5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773112023, "uuid": "d3be9eaf-984a-44d3-a04b-792080cff8e9", "comment": "Malware payload (AgentTesla)", "value": "43063e72f4684d346da8b8404d32ba8fd8be7565dd77e0a92faf0a50e792ad55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773112023, "uuid": "fe2de9a5-8508-4712-848f-94607900a172", "comment": "Malware payload (AgentTesla)", "value": "f266a677499b9f53bfb0d4b64227d882ef81cce7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773112023, "uuid": "e77f56e4-27a6-4648-b213-e2f703bd9dff", "comment": "Malware payload (AgentTesla)", "value": "1d98b3501007dd32e3bb6a74b8aa73609c4ce8c34783a8f1a3aa2dc832dd407de6bf604d8c959b6643d1e0e9d4053546", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773112023, "uuid": "705d15de-e903-404a-a5b0-41b75eff39da", "value": "T13145F19431E8C967C11982B80A71E1B15F751CAF9411D6C6BEDE2DEBBFC2F500A07A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773112023, "uuid": "d44ef8f7-d6fd-4728-940b-63319d73cde4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773112023, "uuid": "f43f44c3-7327-4603-9489-8c7fd405d33a", "value": "24576:pJ0Vi0VgLAWQyKxA6GcLy9GuRDcr+iN55GAwQ4LAOoOr0V:p+VtVgzYGZGCAr+ib5YZkOoOIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773112023, "uuid": "69ece1f9-815c-4262-9eb8-46c23f2d5501", "value": 1245696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773112023, "uuid": "ced76e56-ce12-4a88-af21-791dbcb4a88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773112023, "uuid": "ce3d5788-f0c3-49c0-b4b0-03ce8f52f60d", "value": "Urgent Inquiry For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ff8b89-1c7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773147006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147006, "uuid": "0b0f98fb-5e03-41c3-a720-064e33270463", "comment": "Malware payload", "value": "f31e9446266ebdc21c99524a37633a2f", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147006, "uuid": "dacbeb4c-0b37-4846-954a-d65bc4720470", "comment": "Malware payload", "value": "4394c347c4a2ebb9b5db21abbfbbd25b8280e623f3f7a0445afe9fed9eda877e", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147006, "uuid": "863660ba-a3c3-4988-b09b-e1df5d355105", "comment": "Malware payload", "value": "4f218f53751f95464cb879102256cde68e97c803", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147006, "uuid": "cb5b151f-c90d-4c70-8155-4983557a1ac2", "comment": "Malware payload", "value": "f3c0c7701d8c01e4c8f94262dc1a7c8280288cbc7f92857400bd74d5d388736cc416db36e4f745f1edbe05544070d7d6", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147006, "uuid": "56bc87d9-1e02-4b95-af71-638e15039d3f", "value": "T14924A41BF03719B425406E88AD2325E79ECCD0529BB0327066EDE6EFC47E87860D9677", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147006, "uuid": "3c091259-efe9-429a-95d5-9844581725be", "value": "6144:FHPsZpSr6pOyfTQiwkFwSMQX4wMc+d5q1:VPsZpm6pOkPwkFw7QIwMBno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773147006, "uuid": "cd790aeb-7066-4cda-bd88-b807970765be", "value": 211705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773147006, "uuid": "6911fb6c-8443-4305-bc8d-ee08a2ad1cb5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147006, "uuid": "d92451e3-da9b-4980-ab77-01942874235e", "value": "4394c347c4a2ebb9b5db21abbfbbd25b8280e623f3f7a0445afe9fed9eda877e.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2ff01b-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126342, "uuid": "da57c690-a5c7-4c22-a7a5-84589be02de3", "comment": "Malware payload", "value": "358d0fe3bf515e058a3bf87dbc28c26c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "roverlink-io", "colour": "#5F846C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126342, "uuid": "b2c65968-68eb-4135-a790-0e6553275bd0", "comment": "Malware payload", "value": "461fc7b0a23fe2a9100720c6d5712987f07e208a84c479ce60093bb7ba135921", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "roverlink-io", "colour": "#5F846C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126342, "uuid": "d009a525-1386-4181-8791-21f7b02b6b0b", "comment": "Malware payload", "value": "8ae2564a9b41979a60395e5d4ce1708486655981", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "roverlink-io", "colour": "#5F846C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126342, "uuid": "5991bf1d-bbb3-4327-aa38-4f6215c5e856", "comment": "Malware payload", "value": "67f0f225a23f1f997c5621c87a0bbfe4c615b7cb9b1c786600763190c837461c51ecff2ef6fdbcf2f34d0f53fdb7432b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "roverlink-io", "colour": "#5F846C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126342, "uuid": "3af10986-af07-40bd-a550-8051e3725973", "value": "T1D315F1118BC42FA9CFA8591AC0FE160E63B14B8A955A65CEEB377D07AFEFD40010B1D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126342, "uuid": "a35b528b-111e-4cdd-822e-645ac490e808", "value": "12288:y5r4DxHBjKsJD/No9WOO/JGRUcIfYKZ1jYeUfYCouBPLSEVHG0yzVmH28Sv4VFk:y5kdZKMi9ffIfVYeUgc90P8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126342, "uuid": "ce37b4eb-63b2-42fa-8e67-6c6eb5b2becb", "value": 883370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126342, "uuid": "5fdbb5a3-ce1a-4f9d-972a-5bdac4213d98", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126342, "uuid": "f9756936-bda6-4051-b767-fa0d41d9f207", "value": "killxd.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d51e7a-1c65-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773135614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135614, "uuid": "4b134d9b-f91c-41b6-bfb7-152759d87576", "comment": "Malware payload (ValleyRAT)", "value": "31ab710b59f896d44fd2ed8ce7faaf3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135614, "uuid": "04cfc94b-84e4-4279-a57b-03108a3dfa20", "comment": "Malware payload (ValleyRAT)", "value": "490a5bf534bc615c35443551adf8e23208a2b89b694cbeaa678f5206117b053c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135614, "uuid": "7d3631fa-bc4e-4a16-8528-144e8059a41b", "comment": "Malware payload (ValleyRAT)", "value": "7914a2de3e4ce421dca51154d5cad9c4221b21f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135614, "uuid": "4c4b4009-6508-405f-8204-36eb72a2e084", "comment": "Malware payload (ValleyRAT)", "value": "4d9322a8cd2118388fee034763048750eac7e783e9b2e890376bc2defa83a1239bf4af3cb24e53d49326f67bcf54f838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773135614, "uuid": "fa778993-f8f7-487a-b4a3-fd81f7592b0f", "value": "T1F5936D1275C2C472E97615311874DEA19A3EFD101F619EFB3788037A4F346C1AA36EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773135614, "uuid": "2994405f-e54b-4acb-b9b5-4adccdb024b4", "value": "bf5235ce41f501cf894253dbc248cbbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773135614, "uuid": "46a8af82-94f4-4ea1-9698-287801b59694", "value": "1536:sgExk7BzUpD+/d8VqQXt/MH6CX+bnWNTTKDdX71NL4HQAvN6pm3ZoHnSsWcg2cdI:xL428VqoFMHz+KNTTKDRrLAQAvNl3Zo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773135614, "uuid": "805e5d3a-bb48-46ec-8259-d32613a29d65", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773135614, "uuid": "63a50733-b310-45ff-8dc8-0721b90d66d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773135614, "uuid": "ff275151-559f-486b-8f20-90299ed2796d", "value": "490a5bf534bc615c35443551adf8e23208a2b89b694cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754fd73e-1c91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773154648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154648, "uuid": "c203369b-300a-4b00-a1f2-4d2b80cc420b", "comment": "Malware payload", "value": "4a6f7669a7a31e9a72064f070b5416b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154648, "uuid": "49d36e5f-e4ec-4605-8c4f-5675813e121b", "comment": "Malware payload", "value": "4959425cfe2d5c25c90c20fbb0ec8aad78afee7bc7a6d8b70498fff4b63c4d31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154648, "uuid": "998123b3-c822-4432-b58c-c894fa7af7e8", "comment": "Malware payload", "value": "9f9c9ccc94659c5e3bab6f49a741d09ea1381303", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154648, "uuid": "1aae658c-83aa-4896-aef9-dee1ab9885a5", "comment": "Malware payload", "value": "714c7d8edf1f9fcc11b28c3ca2a67e4c5147bbb13792fd1458ca3335302cee7a6b6bca0a71ee53a8901692a48f39d4fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154648, "uuid": "36299c5f-5fb6-4cc9-b057-18f5efa44fca", "value": "T1A2D319C5BBC6ADE7CA16123884A783791338FBC51BC697030D39B2391E236D0AD97657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154648, "uuid": "ff7048b6-848d-403a-bc99-72ae17867e6c", "value": "d67f58ceb8e76da12c0eca798ed7c8b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154648, "uuid": "f910298b-6627-44c2-9688-ad646967aa21", "value": "1536:2V9CKH+W3OXcSeMq0gta4TtMtFAo6J75O9XX7Fj2dnyw9BK4k84HF+rbqClcqWEu:2V9CKHfDSeMqbvwQC7AR9dYHFymZFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773154648, "uuid": "bde8d918-723e-423a-8988-75605db77ce0", "value": 134261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773154648, "uuid": "2758413e-97ea-480d-8067-46df820f3aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154648, "uuid": "3aaeeebd-662d-4dd3-a172-caed8196a78c", "value": "updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f005fe-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773146623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146623, "uuid": "46bb4ecc-22a2-4a2d-a05d-b054d1c215e0", "comment": "Malware payload", "value": "f3655c09ae7c93b1d0cdc37c9dc00dc4", "object_relation": "md5", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146623, "uuid": "0fb838c4-1a35-4bee-be37-afa47f1b0234", "comment": "Malware payload", "value": "4a187d1d3dcc1e684a3a9e7bade340d032d6b77a7a232067eb55f85685c971ca", "object_relation": "sha256", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146623, "uuid": "aa381da6-9552-4522-b8bd-b467f574f129", "comment": "Malware payload", "value": "6077e4847fbcd66f47349000bd79901708fc6592", "object_relation": "sha1", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146623, "uuid": "e6cad77e-5acd-42ba-95c0-16525e6b770a", "comment": "Malware payload", "value": "db505c3803ecce0277929d3dab323092041d56d3b97b04c46ecdfa259b0cb58ac7a3983723cda7e88f47c623c0601f6f", "object_relation": "sha3-384", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146623, "uuid": "b610db8d-3667-4c28-9b19-ec5038808970", "value": "T12063F727EBBC8E66C0FC8534C4C48B653114F4A536CAA7171B55C7DE6FCC3A55A00AAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146623, "uuid": "92d53a82-5997-4770-b22c-0980040884c3", "value": "96:EwUGMV0ScbB42xWIYcVBA7+XudQBWLzqeL5UdV2rgr5RfkCnvueM8:Ewj+KbBlnf1Xa7z1LdrgrPMC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146623, "uuid": "e1aba7a6-aadd-4578-8f06-def57cc1dcb9", "value": 69152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146623, "uuid": "c86c40a6-d6ae-470b-8af6-8eb6a964cac7", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146623, "uuid": "015b334e-31b5-4c4e-9c16-febbb252c65a", "value": "localfile~.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fce3bdb-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126185, "uuid": "b33614fb-14b7-43a2-8ad0-752ea1527f1b", "comment": "Malware payload", "value": "619e67b95626523bfed51993a1f3df95", "object_relation": "md5", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126185, "uuid": "fb0adaf9-52a2-4feb-af10-7088794602bf", "comment": "Malware payload", "value": "4a2f0f1893527e4c419f36c2e4f95a61617074200bb67218fb96ae74125e433b", "object_relation": "sha256", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126185, "uuid": "3458bdd8-62cb-49ed-a885-a55a75f75893", "comment": "Malware payload", "value": "d26e38884a0088303b16b47bf3629ed0cd66ec74", "object_relation": "sha1", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126185, "uuid": "6019d799-393a-4172-bf56-83a3e857cb56", "comment": "Malware payload", "value": "968f87beae98472e00d5bef98d4f98188e9ae53d2d78efd9e4d71a2698dc134749ba1c88a84b24808affb0d6f1cd3b4b", "object_relation": "sha3-384", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126185, "uuid": "0ea8792e-5da5-4611-8990-153b1f8140bb", "value": "T1224633F0A196022AEF614C7C1AD7B781BF07A160E0BF5B673C5E28B95ED1126E613CD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126185, "uuid": "5f1cfee6-42b9-4ba4-b150-051369d74d3d", "value": "98304:aAdKGQ5fbLlgjYt64Z7Ka5c1mJPEfwERD1E3ZVBJraVWimYUNP/zqfPi/6Ar090+:aAu5nlgkt/5c1mJPEnRREJ32WtPbqfP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126185, "uuid": "fc8069ab-7dc8-452c-a1c3-dc9f9f85c1c9", "value": 5808576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126185, "uuid": "86bfb59d-3d9e-4f22-aa58-6d76b0732c54", "value": "application/x-chrome-extension", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126185, "uuid": "12cc073d-5580-4c4d-9e64-373af4019f47", "value": "4a2f0f1893527e4c419f36c2e4f95a61617074200bb67218fb96ae74125e433b.crx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc407812-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773146607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146607, "uuid": "15a9a255-6154-4108-a4c9-17bce6bcabbe", "comment": "Malware payload", "value": "27fe183f8c4824270a9fc03317f4134b", "object_relation": "md5", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146607, "uuid": "3b0e41a3-5d94-42c3-bcb5-974dcea79048", "comment": "Malware payload", "value": "4a6250d7dab7d82255cc526f6b857af8f53378c186700dd8682408180b92cb6a", "object_relation": "sha256", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146607, "uuid": "26626798-e8c4-43bb-9d18-4ca0773004e7", "comment": "Malware payload", "value": "f8817a2a1f5cfdb853873bf9108436b19af1bc39", "object_relation": "sha1", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146607, "uuid": "2dab9e2e-5b59-4d27-b4cd-8a201e20cdd2", "comment": "Malware payload", "value": "35cbd035bc59c158b7d3325b5dba5433e45b3ffabdfd6ac4d6182b6cd76910afb6fe3ea41f91a4d37a2afeb5d0ce05d7", "object_relation": "sha3-384", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146607, "uuid": "a321d1d6-1ebc-4ed0-8800-dce8244fc155", "value": "T14DC30717F79CAE01C0EC4134D2C98BA76592F0643BC6B31B1B51D6E97FE83A46B01A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146607, "uuid": "6939058c-5657-4239-a06b-6daf5f8fabda", "value": "192:7fTs8Q6+pEV+Dh2tSQgrgrPL8kfT6uwj+KbBlnf1Xa7z1LdrgrPMC0:7bi6+CDngrWLI+mHn9XabrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146607, "uuid": "8383bb7a-bd76-496e-ab88-c890f130ecf3", "value": 118304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146607, "uuid": "050a4f08-0e05-46ae-a965-3c26d581ce18", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146607, "uuid": "6ab3b8c7-fb2e-4da8-8015-452c0f9d6c51", "value": "BarkBlitz.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6767d209-1c46-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773122413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773122413, "uuid": "57c301c8-b475-45fc-a5be-c5047eed7712", "comment": "Malware payload (Formbook)", "value": "bd71f70bc73e30f5e7db0dfa5e55fcf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773122413, "uuid": "e352dd54-eddd-4701-84cb-00f71c304660", "comment": "Malware payload (Formbook)", "value": "4d2d2c6efbb042ae0af1b79c8cc52237998ec70df56afd418abbacc48d9d3395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773122413, "uuid": "7a660ede-dd09-43e7-9f54-d0f4f9fdcd04", "comment": "Malware payload (Formbook)", "value": "65680f96db6b80c59dcdd93cb97771ec1330a06b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773122413, "uuid": "2f3a6281-a589-4b03-a550-2d2ab2f752a0", "comment": "Malware payload (Formbook)", "value": "143946ec23ab17a0d9645f2a9496d0c2d7b9db17421f3075503530296185a6e9ee4a352978419456feb52057d392b3ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773122413, "uuid": "168b6e55-149d-468a-af0a-14439fcc6ef9", "value": "T1D355F1A431E9C427C12985F90671E1719B751DAF9451E1C6BECE2EEBBFD2F001A02B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773122413, "uuid": "e56edd06-db09-464f-a41a-1214f098e2e5", "value": "24576:SQ0Vi0VQLr57Qe6Lx7WaJzJtWvln9QhNhboxUU+U2ROoOU0V:SDVtVQR7QeMiaJzvWvMPWxUd9OoOHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773122413, "uuid": "234b6ffa-bc30-446e-ad90-178a5371fdd6", "value": 1307136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773122413, "uuid": "caa12cf4-47d6-4e61-86b9-a76bfbdb631e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773122413, "uuid": "9e45b04a-eb57-43f0-8bee-338638af2cd3", "value": "r103_26HU100790_1707260304AFRIBFBFXXX0304171827.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1756e7-1c90-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773154388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154388, "uuid": "72782e90-d3ee-462d-90f1-ba87dc09ce3a", "comment": "Malware payload (ConnectWise)", "value": "63ac07a0c5aeb0647c063c19dc72264f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154388, "uuid": "bf9fd522-60d8-4ae6-8f89-1941c4e6c75f", "comment": "Malware payload (ConnectWise)", "value": "4d3e09fc8cdbc33b55c5d58b92ebb483fa348cb1228f94050a6b43a170e81ddf", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154388, "uuid": "f8f910ca-5479-4258-8318-2546d92d405d", "comment": "Malware payload (ConnectWise)", "value": "cc89540d4b6caeeada44b66b6444c3fc9b73858b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154388, "uuid": "098b3fb8-0bff-4f85-84a7-29938da635af", "comment": "Malware payload (ConnectWise)", "value": "2f744692cec60191b826e260e0b8e407ea3b73efc1e1c97907cf96b9af2af051022dec4fd343e943704ef926a8c25715", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154388, "uuid": "5ef1a9ff-f0a2-40e0-8815-c4e505918c6e", "value": "T162D623116BF89278F1F22E39E876A0B1A5377D525E22D12E2324791E2C71EC0C963777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154388, "uuid": "0c0d1a97-3fee-49a2-8ad0-86e3093aaa1c", "value": "196608:sHxcp9ym3nltDUJVbHxcp9ym37Hxcp9ym3nHxcp9ym39Hxcp9ym3OqxHxcp9ym3u:KGplpcGpFGpRGpvGpTGp9Gpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773154388, "uuid": "831f8395-65bd-4529-80ee-878cd488a1f7", "value": 13856768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773154388, "uuid": "bc1d6bec-3e1e-459f-8952-3d413887ecdc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154388, "uuid": "0a2473fd-4592-404d-bde9-96b6d3d9355e", "value": "ZoomWorkspace.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a876ba-1c93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773155511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155511, "uuid": "4c832435-6416-48ea-bb49-0a64ff80058e", "comment": "Malware payload", "value": "b088b50ef51a28edcd814e7dbd1aef40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155511, "uuid": "1544337f-1eea-4729-8d5e-6414381ff0e1", "comment": "Malware payload", "value": "4e2a7cbdb9dca018bebe1e7efa75715b90bf8d0b97f3872eb79d74f1be07b084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155511, "uuid": "77f4020b-473c-4a3e-b853-9db592212e70", "comment": "Malware payload", "value": "89134678c102d0504743808b60fbce500c85fc75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155511, "uuid": "64183b57-db77-4878-ac9f-1c618add884e", "comment": "Malware payload", "value": "670d665886f6e01c55669ee4008510c37bcb4d8f7e4ad8fd580b259e5f480c00773e1da5bf7f80d036c7768d05cffaae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155511, "uuid": "ff628ded-700f-474a-a06b-842dd72f86bf", "value": "T157B63347D9778DF0CA330B3890D2196B3305980E486BF4C9E509277ADEF35AA9D2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155511, "uuid": "a161a31b-3586-4794-931f-92ccde2a03b5", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155511, "uuid": "7c0e2fb4-af5c-4f01-9266-b5667d6b5e66", "value": "196608:AaZk+wVP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2G:anYmzZFw5S9pE7Asjp29qIT0jarlZr8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155511, "uuid": "9b4382c8-b521-4ab1-a052-d559a7dbcc38", "value": 11056040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155511, "uuid": "fa42ea56-d4b0-4b93-9b2d-508d76139912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155511, "uuid": "a8d7f847-5e82-419d-bf50-bdd9c900cc3e", "value": "AjaxHealth_Product_Overview.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c03852-1c9c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773159595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159595, "uuid": "cb9ef390-956e-4157-8e3e-4dbab6a6fb7f", "comment": "Malware payload (Vidar)", "value": "1ab928b2c6fe1cbdfcaec9369d07ddc2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159595, "uuid": "69c96e1e-fa4a-4afc-a576-9b1177f352b2", "comment": "Malware payload (Vidar)", "value": "4e6510286238e7e1ea8faa3a1374233e5f321e905def433f8e769b95d6472b6a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159595, "uuid": "64ffad67-efd5-4f44-beca-605995a7d371", "comment": "Malware payload (Vidar)", "value": "698189b7da7ded850714050ca010e479b67574ca", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159595, "uuid": "caf888c0-5847-4705-bd70-7dfc0dbd7430", "comment": "Malware payload (Vidar)", "value": "27159b0452b097922568c4c0cb7ecd86690e780a34db33150dce29138a5faa5e3d8c8cbfbfd9d9d39de16859b2778ffe", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773159595, "uuid": "73c5ca2b-d0ed-490e-89be-5073bc5a02e7", "value": "T16AB6D42BE2589168F599B2FEFD928B15B5FF61B71B23D6E3439013644A0E8C44F39720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773159595, "uuid": "d9543dc3-0b49-4e4e-a86f-72d56d3c6ec3", "value": "be27ca3e2433d9854a57851ddb822150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773159595, "uuid": "8cc5d0df-2a87-49c6-aa2a-73c0d373b0fb", "value": "49152:024+J84zmrSOJ30Fz5h/cetKxvqS9TWNKDKv+yUMCUYfwieJ7ivXQGOSsMvnoaVk:0gI2AmsvgPSrLVRuus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773159595, "uuid": "854c23e7-2b74-4cd4-b274-d6b3fd8aa3c4", "value": 10655232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773159595, "uuid": "9149f794-f89d-448d-af97-e6fa8a52e0cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773159595, "uuid": "2880fc79-fc34-40ad-bfdf-2c0fc202b252", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496825e8-1c89-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1773151139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151139, "uuid": "b5466c8f-47a0-4c9f-9d36-82fd83626f05", "comment": "Malware payload (ChromElevator)", "value": "e573630aa0a908265adff951a534a12a", "object_relation": "md5", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151139, "uuid": "cddf1edc-fba2-4ad0-9aa2-e1942bffa6bf", "comment": "Malware payload (ChromElevator)", "value": "4e90d386c1c7d3d1fd4176975795a2f432d95685690778e09313b4a1dbab9997", "object_relation": "sha256", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151139, "uuid": "75a82dad-5a42-49db-ad2f-ed3b0d0740c9", "comment": "Malware payload (ChromElevator)", "value": "84a1d0e1d7676bdb3f6e979c204493719a4c80cd", "object_relation": "sha1", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151139, "uuid": "45810b9d-2030-4c69-898e-267af25ed611", "comment": "Malware payload (ChromElevator)", "value": "c6adefc61478217d9da389cc2be57c7127645514fc7527abf54a932ba639c18068e590158e65f40013ce2e7993d72078", "object_relation": "sha3-384", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151139, "uuid": "ffabcbec-5f4f-4b8c-bbcf-b04c75035275", "value": "T1C4C5E11AE36401FCD06BC2B9CA528A13EBB2B845133096DF57E58E963F17B705A3DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151139, "uuid": "7f24ed1e-a917-43c2-9173-2f3caac96459", "value": "37c1fda3eacb25e39fbd1596b6aa2a4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151139, "uuid": "80cf6f03-b4d9-42d5-9c72-579b8bf46b89", "value": "49152:urY6VHDXRuYo3r50V0xTJUbaNnqZFjM8g:ul0YgfTJ/8jM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773151139, "uuid": "404d2906-660b-4f46-819a-a31952e639f7", "value": 2541056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773151139, "uuid": "4cbfc3ba-4252-4781-a5e2-f35848a92f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151139, "uuid": "d3464484-e5ef-48fa-ba58-c53067c7b7a4", "value": "4e90d386c1c7d3d1fd4176975795a2f432d95685690778e09313b4a1dbab9997", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc59b755-1c95-11f1-a769-42010a9c0008", "comment": "Malware payload (N-able)", "timestamp": 1773156512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156512, "uuid": "6ce67800-8007-4296-8a3b-a8fa6f93ba6e", "comment": "Malware payload (N-able)", "value": "83c0fa65568f0e110a8188d6b8afee26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156512, "uuid": "f8b29d3e-1734-46c3-8de0-3d308606ee78", "comment": "Malware payload (N-able)", "value": "4f47ce22c877b4b2a8d3b9e48608da7576eae1f8c70f94f0e5e563224dadc3a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156512, "uuid": "fb4df493-f793-49b6-844b-76710396f360", "comment": "Malware payload (N-able)", "value": "ff7f94c52b25d87a55b84c66cb123037184ce529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156512, "uuid": "b67e7697-df2c-4ec6-8c6b-5428f586bedf", "comment": "Malware payload (N-able)", "value": "cf1274a82c9ae03fac7face5fad8e9c67d7113c84670d0b7537101ae77ccd1e1631e2a00c8bb72124561cd4e61debbde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773156512, "uuid": "bdb22d91-ad8a-43d1-9fce-6cb4e31dad76", "value": "T19AE633527C88DBBFD4212770C6429B77529BBA744810186B6F0C1CB66FB28CDE529F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773156512, "uuid": "a23ebb8b-a4b1-4186-9e16-51ffa6717616", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773156512, "uuid": "24942282-d581-41c9-96ac-812a96d7aa53", "value": "393216:mMF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1l:VrRxvoC/7a0jUxX7h1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773156512, "uuid": "15e1185c-b3c4-4cbd-9815-0ad821efb194", "value": 14782040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773156512, "uuid": "ce16736f-f041-48ec-ad29-5edfd427be8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773156512, "uuid": "2df31374-e6f3-40d2-9304-697f0cd3fb13", "value": "AGENT_473907_V10_14_4_RW.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2a067c-1c80-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773147172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147172, "uuid": "6438c15d-0573-4bf8-8bf4-32aed437bbba", "comment": "Malware payload (VIPKeylogger)", "value": "b0ce7685995d3232d5c6edb675d81aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147172, "uuid": "00207659-bad6-4b74-b419-35036857f4fb", "comment": "Malware payload (VIPKeylogger)", "value": "4f5aca204276797aab39e792ded509c0e6a02805b2eba94bdb1bba5aa7e901d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147172, "uuid": "cb89af63-a2ed-4e7a-938d-92511b4df95e", "comment": "Malware payload (VIPKeylogger)", "value": "7924105b350e21c8bd95c32461cf35ab2759a658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147172, "uuid": "dd6aa325-e2db-4565-b475-82d19c84daf2", "comment": "Malware payload (VIPKeylogger)", "value": "8fd3e3649af9bba6298ce29a562f7535ba1fcd4f801a699bb580b8a0f4690f0d5447d58f994e4529b2cf1587366d8a7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147172, "uuid": "2f1295e4-87ee-4e6b-875e-419b4a76ff65", "value": "T18EA4BF622666DC62E38452B48159F73DCE61FAD62D31C2372AF1EC9FF518F723829250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147172, "uuid": "84419e1f-4f46-43b2-bc07-7fc019dcaacb", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147172, "uuid": "10b70899-eb5f-44c0-ad6f-c469fc469296", "value": "6144:MlgvTRHyTKm50kpXgMimxd0VWz/0OWlixPfeiGYBFwRf5VEBULFC2ot25GnCgWTy:k2kgkPfeiGOut5VEBULinqTnxGaOli6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773147172, "uuid": "f205963c-690d-4cc1-b867-3b76e51064a2", "value": 487256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773147172, "uuid": "66fef0a7-168c-4392-8b81-f16e930b987b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147172, "uuid": "fa41944a-28af-4bff-b5e5-1c5ec4b0379c", "value": "Unsagacious.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6542d33-1c63-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773135081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135081, "uuid": "a1196dc9-ac8a-404d-b0af-e60867b150b0", "comment": "Malware payload", "value": "25a91d91cbdc222ccfffe996c3ed32dd", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135081, "uuid": "f38f2da5-8554-4cb4-bf66-ef00808b4efd", "comment": "Malware payload", "value": "4f92cd7523c47140107c05570cbd97ba82ff626d8b60c9832ca0a68d66760b62", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135081, "uuid": "2fb1d567-4aba-4bef-83fc-08b98c7a03da", "comment": "Malware payload", "value": "2ac0d4a0052a110ffc30ae5364868d52b9d6f845", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135081, "uuid": "5d3200b3-1fc4-45b3-a74e-7ae8d817ea02", "comment": "Malware payload", "value": "37fea7667cd33fc013644c3a7786aaf67604c2c4df9a79d6b93681065539f794570594a108cf4107c49a58590718f726", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773135081, "uuid": "d23fec6e-e5a1-4396-9b8b-c734c7b299eb", "value": "T103C3EF641BEFD0F5D407A059A69F0582EFF59613871CC9C0FF2CBAE62F54D2890E98A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773135081, "uuid": "a967fd90-b2f1-4279-bd95-6c91bd31d24f", "value": "1536:Dh61W3TFvjs+hBznZqqV9133e5gVsH5C+glpCj:RJV7oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773135081, "uuid": "068b9da5-ab04-48fa-af71-94f79ba471e4", "value": 123138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773135081, "uuid": "b7bdc51f-0f25-4723-91fb-04df81d432a2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773135081, "uuid": "e6c53b18-4030-4f77-9f09-0e3954e69802", "value": "Finance_Gamma_Config_487.webp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd142df-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146338, "uuid": "9afe0e8d-f74f-4bd5-bbb2-848fe63e9fec", "comment": "Malware payload (Mirai)", "value": "cd1b53331fd1b970a35a66a3d521f737", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146338, "uuid": "e95c5e4d-5f9e-4a6a-9d90-9b2f640cef46", "comment": "Malware payload (Mirai)", "value": "5211db02ea06498a46c24102e6071a6e17d979c66c2cfbfcb2edbbcff2aa0882", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146338, "uuid": "1311ac26-e32f-4604-a7d4-397b1f556143", "comment": "Malware payload (Mirai)", "value": "3d176178693736a9bc69d844e8c1b5616c4ec725", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146338, "uuid": "a6d9cf02-e1d1-4c28-8f4f-eb32a38ccf9f", "comment": "Malware payload (Mirai)", "value": "69c41cc71b24e3501676faa3508e8c7d4941b257135c7e4f1aeb7b41e2c6d8c6cb4649e008cf39acc6eb4a212a1fec1b", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146338, "uuid": "85e15291-e83d-4342-a3ff-1958ea547e69", "value": "T1B9932952FD814662C6C016B7FB5E428E376613A8E2EE7203EC255F2137CB95B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146338, "uuid": "f60dd9e4-b7a7-4457-b043-bb577b76a3af", "value": "1536:axXoCsplHVme8dAA9PX0LEk9mwLJYHz+WbZMeVnSDMvzz+:axXoCelHVmdX0BguYHNiClG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146338, "uuid": "c19c2e63-282f-49f5-b325-ad73c50fb22e", "value": 93372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146338, "uuid": "8c5ef8c7-6bac-4285-a0b0-6ea933db0b51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146338, "uuid": "1f39d7b6-1a27-453d-97a6-3100d189cd6a", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d27eb6-1ca0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1773161197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161197, "uuid": "ef7b7f8b-f782-4018-a410-ad473e768837", "comment": "Malware payload (Gh0stRAT)", "value": "a4c0f84f92f6c709ed4e9cc1e4220da2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161197, "uuid": "7bc847bf-2b80-43c5-a9ba-102ed1a1eeb8", "comment": "Malware payload (Gh0stRAT)", "value": "525b4900ffc072129610dd162567bf8d66358799e760573e3fd44d3c65c3dc05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161197, "uuid": "e8959ab3-77af-4500-b1ce-a12cd7a794f1", "comment": "Malware payload (Gh0stRAT)", "value": "27be6fd9ee8fffb804feea4dbce6c96975beacc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161197, "uuid": "32215492-559c-47bc-841c-fc26a190929e", "comment": "Malware payload (Gh0stRAT)", "value": "7ec26832f88a7f90c23e865e1e77298b4845c5fbc6ead0608e38375c87f9074754b61f0bd93398a3782ee241b18a1a58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161197, "uuid": "687c800f-007a-43a1-bb69-6b618bae6ff3", "value": "T16D173312728B223FE07B46B55D7ADB13143FBA69A5060C5B76E3886DDE150D22E3F207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161197, "uuid": "2d075a4e-7460-40d0-a0c0-e3f6b948827c", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161197, "uuid": "c061ac65-5a45-476b-8314-43e7bea5c24f", "value": "393216:BNHd0Wm7MgsGQShMuiXz30Y2xD8WBTseEMZ2Mse/SCJQPj2fYJ:DdPmIgsGQShjij3h2xw0rxbsed4j+YJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773161197, "uuid": "7d705beb-8c03-4639-8ebe-a2998bc10eb0", "value": 18899887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773161197, "uuid": "f3581620-42b7-4623-969d-34544ee4af3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161197, "uuid": "e4f2df7d-05f5-494f-a05c-28caa97447ae", "value": "Glnstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f0ccc7-1c2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1773110416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773110416, "uuid": "3f33ccbf-72ca-4621-9f0d-aabb3e55b864", "comment": "Malware payload (Joker)", "value": "9830ce94e8a87aa4ba263ff8c45171aa", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773110416, "uuid": "ea3a7071-875e-4f4c-b418-74aef9de4df2", "comment": "Malware payload (Joker)", "value": "52669a02ca991baa25a942bc86207a46992262387a52f0ee0a23c1d1d99afb99", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773110416, "uuid": "073a3a27-8fc7-4250-916f-8118668c6ac8", "comment": "Malware payload (Joker)", "value": "126a14ecbaa4c7c456974c5338e16fd7f9623b97", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773110416, "uuid": "d1b6f36c-e1ea-4eb9-8adc-8d37b8210c9d", "comment": "Malware payload (Joker)", "value": "b541ac8988bba493104c0038f8b6e226c3d92f6322b12f3ac13e763a340955a81198046a8f0f09df82cbb1b5a3c65e77", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773110416, "uuid": "d3e1adec-52fd-4c17-b153-436ed4ba512d", "value": "T10AC61256F768EA1FD837703249AA2235415B4C168E87DB47A90C3B0C38B76D81F5EBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773110416, "uuid": "c494771b-2644-42a9-8a94-6f59f287fd76", "value": "196608:5z1HFpfa7qUaG/81OSdvzUxF8jiYKyZmg2ETtX5db8aFDhzi5bympeaOln0PR2:5FFpqFSNaF8jicQgbTThvcea6n0PY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773110416, "uuid": "7b6a44bc-f047-4fdb-ac90-66a2b962f863", "value": 11467574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773110416, "uuid": "7d27c7fd-3c86-4652-910b-2f61f0a3bb24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773110416, "uuid": "4f0edfa3-c556-4517-8874-55ef06c22a05", "value": "Simple+Cleaner_3.1.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4d51ca-1c48-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773123312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123312, "uuid": "58b47b63-31a2-4219-959e-3d9ac5f225b6", "comment": "Malware payload (Mirai)", "value": "802ded11be4876c56bff06cc10ae686c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123312, "uuid": "9d0b7ae0-1f63-487e-aeb9-1f9a8b854fae", "comment": "Malware payload (Mirai)", "value": "538dd5e7791ab04d0b4f8964884322f3cbbc76b91c8c4ec3849d8aa35ff5edc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123312, "uuid": "3567ce2c-225f-4f31-a542-9b13b1a15bfe", "comment": "Malware payload (Mirai)", "value": "84c2c8ab6934a52bf11fdbf2d6e954ed93484f12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123312, "uuid": "24949d77-486e-43ae-a350-a7903c2235df", "comment": "Malware payload (Mirai)", "value": "d03a59b03e55645f993e180a1e7f181a910665836462ceb2063d723ff40784ffe6c05f148e28cf5fab6559be38827c66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773123312, "uuid": "3ff76971-c835-4e93-a5a0-3a3c0eb31594", "value": "T12734B60AAF610EBBDC6FDD3706E90A0635CCA50722A43B793674D528F55A50F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773123312, "uuid": "40cc25b1-7b21-460b-b008-502067e1070a", "value": "3072:iRoUHIe04PCMYKVMMaKJxcExxOgfF1aQ/AzCeExmNMF/VXHC/IXw:iRoUswy0x1LOgv9/A23xvX3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773123312, "uuid": "a0ca5a84-084d-4eff-84b2-93d0b4695b4a", "value": 232968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773123312, "uuid": "e03f3e40-23b1-4b0f-ac90-11098c48af74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773123312, "uuid": "e5fcdf34-7a9a-43e1-a1fa-8556895b0202", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1efd0bad-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146343, "uuid": "cec28551-49ae-4078-8c57-b519ff20f8bb", "comment": "Malware payload (Mirai)", "value": "1531bdc225757e56e5e557e9ec2dd2d6", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146343, "uuid": "b7cfcb1e-3d88-4fd3-9cef-cc546006a289", "comment": "Malware payload (Mirai)", "value": "55416add9dca9ecd3f2e6abf15df0ce0f29cb40d299dcced4c7eb47f06a59d46", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146343, "uuid": "7ed391ae-a32a-4884-8764-87d8ff39531f", "comment": "Malware payload (Mirai)", "value": "ecbe54c1aa3e7e556ef2bf86516aa92531e305a8", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146343, "uuid": "6526bc20-95a8-4a58-ad19-6ad411d46231", "comment": "Malware payload (Mirai)", "value": "844bbd106cee73fc5eff4d9923ca6476bd20a620b2b1d2b1910209d4a93737aa1ead0951434510940e6fafea5b814be2", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146343, "uuid": "4ae61501-e4cc-4350-b4a4-7a967cefbe63", "value": "T19D933A52FD818A62C6C126B7FB5E028D376613A9E2EE3303AC255F2137C795B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146343, "uuid": "75e0b83b-0a50-4ea5-b7d7-bd664452d14c", "value": "1536:0dUPnGONu+lSsri463wNoRU4apeDd19VjzDoSVp3dQbfCpsgjq:0dUPnGOu+lP5NlpeLbfDoEObfUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146343, "uuid": "cedf4e31-996c-41aa-bd55-51405ac4e173", "value": 89844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146343, "uuid": "2deba0b7-6771-4b84-b877-da7beb893391", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146343, "uuid": "be794cba-710a-4ea7-a81a-df0564e7810d", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6ddc19-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126178, "uuid": "d15e9334-143b-4eec-8bb1-fca84b9398ef", "comment": "Malware payload", "value": "9944a0726b3be42c02f7825da1da44c0", "object_relation": "md5", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126178, "uuid": "96d613c2-4470-489f-909c-79979192bf30", "comment": "Malware payload", "value": "5629be21869a83e9b9da86ab16a2d9cebd0aed2c04a9efe2ac044dfe0d5db6b9", "object_relation": "sha256", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126178, "uuid": "5b185a6e-6ff8-49ab-8390-5ada6d4b941f", "comment": "Malware payload", "value": "42186844de45d488d9c4a429d6a8db06ff9964fb", "object_relation": "sha1", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126178, "uuid": "36efda73-b424-4a11-bfe9-c2b9fae88292", "comment": "Malware payload", "value": "ef2237adde98a7f126b84cf2b726861bbdc6734670eeeefe2cda5da7ce94001b9cfb0f23e3d1c6ad806a6a23b3aa1d29", "object_relation": "sha3-384", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126178, "uuid": "ff1c13cf-ba0c-459f-b3ac-833bb453d3d8", "value": "T17942AF5A7B0A4422E9CD153611ADB176F728FB0DB1A1590F042628BF2FF07216F20E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126178, "uuid": "1581668b-1184-4a43-9a9c-68d0a756e1c4", "value": "384:2jfzuoAUlMvYM0HFboj9N3BreybGu2jrM+sgewpRn:2jfB71M0HFs9VA2GusA9wpRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126178, "uuid": "139dd68b-78d8-41a0-bdf7-1bec0400cd18", "value": 12669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126178, "uuid": "745f911c-9804-4e17-a426-2d6805c65ca6", "value": "application/x-chrome-extension", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126178, "uuid": "69bba3a8-0684-4fda-aca9-83a386b55958", "value": "5629be21869a83e9b9da86ab16a2d9cebd0aed2c04a9efe2ac044dfe0d5db6b9.crx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1053feb-1cb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773168519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168519, "uuid": "9eab7f68-092e-4f8a-8b96-522f8dcd360d", "comment": "Malware payload", "value": "0d7f4865a8c73cf937e67829d4790787", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168519, "uuid": "88f9342d-6e5c-44d7-b114-561ca0aa5b7f", "comment": "Malware payload", "value": "56b1db6d6aad59f2fc90d107b0d27e905528e23689757627ed0e4fd1061d0a96", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168519, "uuid": "f2f72039-4c40-43fe-bc8f-815cfe1f9e44", "comment": "Malware payload", "value": "187cdd4d4502641bb09f33172f3f7964270142a6", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168519, "uuid": "3dcf3b9a-4692-4862-8873-fca1a1fd20d9", "comment": "Malware payload", "value": "de02174869d159bfa6766bb62b9d55195ddea83b0926ac25fed85addb46d4b569c77cb62eb8fe958fb9fa9a3905781b1", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168519, "uuid": "0d99c866-1fe1-4f73-aeac-ad330cf7288c", "value": "T1AD9002208460107E6B474A78A958500005627629C965A2EA7900451945D15A48594509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168519, "uuid": "16093b03-b125-4146-89d3-54fd14eb08c7", "value": "3:VSJJFIqF1F65IFNpRqLqOn:s8qF1F6LqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773168519, "uuid": "dc6e52fc-5214-4065-ab6b-064e65040436", "value": 55, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773168519, "uuid": "185c154d-0e4e-4f2f-b607-04b8f8bf86c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168519, "uuid": "ee60e585-1396-4329-8892-ab04747cec6a", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddcd5d1-1ca2-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773162072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162072, "uuid": "e9f446f9-620c-4a17-be64-9157fd952e6e", "comment": "Malware payload (Vidar)", "value": "9f8ba85fcc2943941e53996f56ca93ab", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162072, "uuid": "c5ff0f04-1c61-4b6c-8f7f-6b9d359fb2f3", "comment": "Malware payload (Vidar)", "value": "56bbca4571f9e27aaff4dc07fa5edc403d41ed2069fb9fe5e1c26bb9c9889058", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162072, "uuid": "230cd09f-a53b-4fca-95fe-585a97d37225", "comment": "Malware payload (Vidar)", "value": "06b7dcb13e6245a72d5e5884e3b39f42540ddcb6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773162072, "uuid": "7498e883-1662-4119-9186-1565e0621701", "comment": "Malware payload (Vidar)", "value": "c77864b4c1922f7c1bb47404d6e4da9263b5a765558fa64571896cbcb1fcc8519f48ddca31ed8c5ba3eb8ab9319d44ed", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773162072, "uuid": "5e4d1836-48c6-4111-b4e6-4501e62b3560", "value": "T114A6E77B63D081A8C15D813AC3A28F70DDF763B51B37CEE7429107694BDA8D49E3A621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773162072, "uuid": "c387021f-c93f-4362-83ca-777ca178c137", "value": "be27ca3e2433d9854a57851ddb822150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773162072, "uuid": "a6af0996-4d1f-446e-8ac1-17959c5aefd6", "value": "49152:V24+J84zmrSOJ30Fz5h/cetKxvqS9TWNKDKv+yUMCUYfwieJ7ivXHGOSs53FiU10:VgI2Amsv3PSs3FhxhvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773162072, "uuid": "1096c4f1-3062-40b9-b999-b1fdea00453b", "value": 10381824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773162072, "uuid": "74cc64f4-4b72-4832-952a-f37c1071ddf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773162072, "uuid": "9a8b52a4-1337-46cb-af16-d40971891567", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fb9d40-1c89-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1773151126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151126, "uuid": "39864cb1-7594-45f4-a2c9-11c458fafe04", "comment": "Malware payload (ChromElevator)", "value": "33751d47f0d7e63dcfc9582111810548", "object_relation": "md5", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151126, "uuid": "46dcfc0a-d23b-4874-b0f4-b7fdf898c25a", "comment": "Malware payload (ChromElevator)", "value": "56df7d5ef5e7d469b209d6240254d0a4339ff92ed1a4b8ee81673053612fc13e", "object_relation": "sha256", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151126, "uuid": "bc65a271-de15-4478-b77a-96c01720a156", "comment": "Malware payload (ChromElevator)", "value": "1f6da484d45b23bfc006137e10f849052bb99a31", "object_relation": "sha1", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151126, "uuid": "b32f1790-012d-481f-a393-61b0eeaf6cdf", "comment": "Malware payload (ChromElevator)", "value": "c6a23df37e1cfced217c0b2bd2ed331c76f11c9c5687c086e1a2e114858c6f9e08b02439e4c72de5514d0e50a33babc9", "object_relation": "sha3-384", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151126, "uuid": "27ebd979-b142-450f-bd01-b71dc7b18095", "value": "T1EAC5E11AE36401FCD06BC2B9CA528A13EBB2B845133096DF57E58E963F17B705A3DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151126, "uuid": "e32323b7-f628-4869-9b8b-72e23f0b433a", "value": "37c1fda3eacb25e39fbd1596b6aa2a4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151126, "uuid": "81d4a504-2e0c-4e63-ae36-7db9111d0c7e", "value": "49152:brY6VHDXRuYo3r50V0xsJUbaNnqZFjM8P:bl0YgfsJ/8jM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773151126, "uuid": "6bb22736-2cc8-4f0c-8864-81ff831e04a8", "value": 2541056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773151126, "uuid": "2434170b-dd57-4450-b645-d0440739f7a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151126, "uuid": "072b032f-d578-4bc2-aafb-bb3e6639db28", "value": "56df7d5ef5e7d469b209d6240254d0a4339ff92ed1a4b8ee81673053612fc13e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5c23a4-1c7d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773146210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146210, "uuid": "769a997d-3871-4009-a534-d7d8b84e462d", "comment": "Malware payload (AgentTesla)", "value": "fec0591de18d415e2a9ac6cb471099a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146210, "uuid": "cb0b13ad-b2ad-4099-bef4-75015ab22a39", "comment": "Malware payload (AgentTesla)", "value": "5992a834e1bcdd68b42024c54a1e90367d8922aac7d8d3a8ffdd21fbe12e186d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146210, "uuid": "01d7fbc3-c596-42bd-a029-8263b78ee807", "comment": "Malware payload (AgentTesla)", "value": "99a7903c7e83de5e98f4d72074aaceca655e9725", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146210, "uuid": "7d7b1c8a-edf8-4596-91d6-716f8f1d4438", "comment": "Malware payload (AgentTesla)", "value": "f42814df8ac7f86f6e916bc091bee8faaf705bdbbcdafa9da5d68df0f98d71fce3b7b2005a7a91a4d46c148a9072327c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146210, "uuid": "8d94a68a-220b-4671-bde5-35f047e83d6f", "value": "T187558E1F03B1AD5FE3D647E02A66687E97F6CC09801614CEB4623ABA1F785173367938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146210, "uuid": "4e4456d0-c15f-423c-b8d8-6ed9b9d1d634", "value": "12288:zKYGlIlP5VaRabKkntTYkYIc8rzdnDFy6:LlP5VaRabKkntTYkYINrzdno6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146210, "uuid": "c2cac7a7-29a6-41de-b80e-0d3e635ffca1", "value": 1340975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146210, "uuid": "ca52a8b1-955e-4b17-8b20-54bd4076c491", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146210, "uuid": "2929cf15-a8f2-49e8-99f6-baa70c93d093", "value": "2610539900.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f32c52-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126140, "uuid": "f2e7449a-7637-42a5-942f-8980bd5d19f7", "comment": "Malware payload", "value": "3c154e58b19665bf1fdedc1456fe324d", "object_relation": "md5", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126140, "uuid": "3815d2f2-4173-4845-a1f8-81bb4808be1b", "comment": "Malware payload", "value": "614a1489f6a19d80b1edc036eb95b418641df21cf61af8aae7cbf4fdcd2dce4e", "object_relation": "sha256", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126140, "uuid": "68cc7f71-3404-4069-ac99-3f7f5128deb0", "comment": "Malware payload", "value": "65cf3b406f3ceaa883c6ef78718bcac5297a95b0", "object_relation": "sha1", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126140, "uuid": "a4c348a7-1ca0-4749-90d9-b0c72dcebc55", "comment": "Malware payload", "value": "0063724c267b58a38b4bc067e5b161e0260954e06e032d946b67a1af23299a4dad9a59740d577377c8499bc379d42ba6", "object_relation": "sha3-384", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126140, "uuid": "f0c31d91-1afa-4c60-aaa8-816e5d231ce5", "value": "T1D1229ED9522BFBB8C82664F14B8FA7F085CC57002F0AB153F62B305D694B8F69756289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126140, "uuid": "1339e5a8-68fa-461f-a46e-6d745bb26890", "value": "192:FKr2pDAVP5U28UuEEs/FVCpM+GwECh/KveaJxCzn8DfIinG8QSDHKObYVa/:FKrokVPNuEnNVD+JKmIxCz8DXG8QJOSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126140, "uuid": "3af34eba-0f6f-495c-9d1f-6221ab5d7070", "value": 9931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126140, "uuid": "52a69d03-8721-4d14-a00a-02398f41512b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126140, "uuid": "a05ef93e-dd1c-4718-9430-8efb2f4d82e0", "value": "9d0f550ac883455ed64da402cdb0c822c90de405c540678e0697b77fe20de3cf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c8251a-1cb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773168252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168252, "uuid": "04abeb97-b6ba-409d-a4b3-5c88f6584b19", "comment": "Malware payload", "value": "2bea413875c5516ab9969d7ea3e370fd", "object_relation": "md5", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Multiverze", "colour": "#2E30B1", "exportable": true, "hide_tag": false }, { "name": "RedTail", "colour": "#84ADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168252, "uuid": "59e3ba51-d7d6-4f41-bf71-c40048ca1964", "comment": "Malware payload", "value": "6168f5d053f4c3d413327947c37b927a759b316d68ac341908695879edcda246", "object_relation": "sha256", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Multiverze", "colour": "#2E30B1", "exportable": true, "hide_tag": false }, { "name": "RedTail", "colour": "#84ADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168252, "uuid": "18919dc3-f11b-40fa-bcbd-7f4a9e891735", "comment": "Malware payload", "value": "9a0c3a89bedb0d4c6c5db54350f19cc8dce00782", "object_relation": "sha1", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Multiverze", "colour": "#2E30B1", "exportable": true, "hide_tag": false }, { "name": "RedTail", "colour": "#84ADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168252, "uuid": "d8486b06-5a0d-459d-9376-4d82702f5006", "comment": "Malware payload", "value": "6cc8f8546bdf9dddadfa6467dc7860111cc909aa02e7a9e72250ddc528412d45ddb19b42f314d8ab27f0277a7fa98d37", "object_relation": "sha3-384", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Multiverze", "colour": "#2E30B1", "exportable": true, "hide_tag": false }, { "name": "RedTail", "colour": "#84ADCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168252, "uuid": "7776f5d5-2952-4ff7-87ac-c1fc59b67c2a", "value": "T12EA5F757E49590E4C0EEE174C726A213BEA13499473837E36FA187F11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168252, "uuid": "2769ac04-e336-41a3-8618-46581b93d7c6", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB4:cqYUQuVDt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773168252, "uuid": "96021d21-233f-4b77-b1ac-cbdc98f806ca", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773168252, "uuid": "00dfa311-5b01-4d46-be68-9c937984877c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168252, "uuid": "3d02d51e-dfb8-407a-b44a-e467c5a25837", "value": "sample2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708c460f-1c93-11f1-a769-42010a9c0008", "comment": "Malware payload (N-able)", "timestamp": 1773155499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155499, "uuid": "0726ade4-9d40-47de-a9eb-b194ce91b815", "comment": "Malware payload (N-able)", "value": "ab2eb30965da62d1bfbfe7e2ad806bd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155499, "uuid": "178b27ea-b07b-4637-b64e-8eb58da06a7e", "comment": "Malware payload (N-able)", "value": "61a0c4331d0aef0d840b7bc5ae333c2cd1f1810c3fe223e762c2914f9a2b835b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155499, "uuid": "52af6c0d-6a0e-489c-866c-cd5f4f137198", "comment": "Malware payload (N-able)", "value": "ad8eb2e650a4a259c2b05f762c6c0327525268f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155499, "uuid": "e3d90a5b-83cf-4517-903f-1982ed524c1a", "comment": "Malware payload (N-able)", "value": "9facf6bfa89794c9f7c3c2bb14ccca3baa7ba6cf20a48ed93f4e8d85d825ca32104018084bcb9506ba4924562b08f3f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155499, "uuid": "d1dae980-06d7-4c5e-a373-15a1781f4f89", "value": "T1B0E633527C88DBBFD4212770C6429BB7529B7A744810186B6F0C1CB66FB28CDE529F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155499, "uuid": "e7d19075-84ac-4310-9a5c-dd48cac02b53", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155499, "uuid": "ea947d8c-9d37-48c1-a1fc-20ac934fa0b4", "value": "393216:tUF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1y:6rRxvoC/7a0jUxX7h1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155499, "uuid": "33869e5e-c28d-48a2-819d-b843ba5b2f37", "value": 14782048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155499, "uuid": "df8a9f5d-d0c5-4529-8812-9b0a5c1330c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155499, "uuid": "790a0f71-2a68-4b6f-bdfc-9b2450e8a0f3", "value": "folha de cotacao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6666969-1c48-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773123404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123404, "uuid": "4455e445-dfda-4deb-8d1e-0943b83a5df3", "comment": "Malware payload (AsyncRAT)", "value": "3c7fc20755929c8cde6b41da7767214f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123404, "uuid": "b3cc0b4f-04f6-4f6e-ab01-38d8019f3d2b", "comment": "Malware payload (AsyncRAT)", "value": "61b1bf909875d0ae463f2f5351e2b5f2c969abe95150a805d73a96dcbb651379", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123404, "uuid": "684f503d-d641-4bac-aaa7-74c2e1365d79", "comment": "Malware payload (AsyncRAT)", "value": "9c66b95178c80f888f0e201352f5e03e440eb168", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123404, "uuid": "96f05868-827b-4c4c-bc58-e156c1645753", "comment": "Malware payload (AsyncRAT)", "value": "753e8839a092d7c0935a9d91e2c90e7f58b28a60ab799900d4a8eb4fd9e403ea01d597772e445e27399edbd8a7846011", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773123404, "uuid": "a1252e32-9a9a-4c7a-a870-d4cf9189aad5", "value": "T1E7033908B7F84965F2FE5B7D8DB582004335FA579D22C79E1EC4508F5A63B88CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773123404, "uuid": "65a39d1d-0c61-42f1-8d57-1cb7afed39ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773123404, "uuid": "f05e9c58-221f-4fd8-ab75-a4522530d1d9", "value": "384:X7DC9cMCcE84mr1H2bnTn8QHmp2M7739393bayse6QxnC7O+WRl3uuhGfrNP7UUq:XnCIcE8r1WbTpwFRbJpB+WWP7L/1Xj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773123404, "uuid": "794038fd-c731-413b-919b-e256bcf4f541", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773123404, "uuid": "0331de76-a864-4768-93fb-9175d93f168b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773123404, "uuid": "68098aeb-547c-42d8-b776-854dc1a62445", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeb5081-1c4c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773125158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125158, "uuid": "b19ddd2e-7112-4002-9e8a-5af039199ec8", "comment": "Malware payload (RemcosRAT)", "value": "74aef6a20c82be4efd681fcc76f6debc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125158, "uuid": "7090eb2c-7e13-46a4-9c95-ff6ef7bb2e19", "comment": "Malware payload (RemcosRAT)", "value": "61c61e5c4d5caa801b3d6ee7ba915ce19793274d659fc6e2bb14076fc5fdcb59", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125158, "uuid": "8309c49c-5ac3-4660-9558-780e69b902d3", "comment": "Malware payload (RemcosRAT)", "value": "a76eee58a19c1b66d057d3cc980693bc7ddf8c98", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125158, "uuid": "1d2d6f4e-73b7-4cb6-afa5-48cefa8cb811", "comment": "Malware payload (RemcosRAT)", "value": "70d34946b231de86fce8c1c73137c566584753439fee77c503000f4e4d3eb7fe63359ed234aa288343c64f2b124fc0c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125158, "uuid": "b6d6f67e-370e-40c9-8476-37ee52709a55", "value": "T149F5124508CF61E187124A1898FF66814C85B444FBDB6A1F7C6A87CEF313368B5A33B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125158, "uuid": "a22ba78a-56e7-40ad-8b27-e52288f80a90", "value": "384:M8RaahjUpgnbpxEqNPNZ++0dKlApdNHdKPQPOFydPvakGFbNJaVabcxZaNpa9hGS:z6RpzyVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773125158, "uuid": "0c2cf61c-d006-4efd-b830-5b63332f4258", "value": 3419475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773125158, "uuid": "2b0f30c4-40a8-4f05-b753-88f2a6bb6963", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125158, "uuid": "aeb6d55a-3e6c-45cd-881e-4caf52901579", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1752ef20-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773127432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127432, "uuid": "2a4fca7b-b43b-4b49-a11f-c33bd02ab021", "comment": "Malware payload (Mirai)", "value": "ce2d055c715edd6ee045c5cebb29516f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127432, "uuid": "c50595ae-4310-4a42-a7e3-7c9fda00f8cf", "comment": "Malware payload (Mirai)", "value": "63327c9134b7e3599299a13e4752a1204d108af61ccfe5928aaa1b8a942ca2fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127432, "uuid": "2d0ff02a-2b95-4d9c-b8b2-567e8cd4423b", "comment": "Malware payload (Mirai)", "value": "911289a1ac014456cdd68ce0a4d3b4e439899d05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127432, "uuid": "de2192d4-761e-4e2a-bf64-901f9a905411", "comment": "Malware payload (Mirai)", "value": "b0fb02b91b9f74f4e8abc911ce824fa80a8d64d1fa216b7187461fbafc64b7ffd9a9c1846f0240299a7e4c6b51213d88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127432, "uuid": "40425cec-713c-42d9-a697-7c98d85c1b3f", "value": "T1AA053A06EF405FEBC4AFCD70852EC31714DDA8D752C5A63A72FC4A8CBA5D25A0AD3498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127432, "uuid": "5bd5a0b7-4bf8-4b40-a694-aeaf0d5c242a", "value": "24576:Ffi0yU+HKLw2X/h2BE71Xp5S9Rg+UQFX:mHawEsmX7S9W+UQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127432, "uuid": "cff9c5f7-d642-478d-aba3-003db93655a5", "value": 863336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127432, "uuid": "96dbdf1a-50af-49fb-8758-ac4f75fef0dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127432, "uuid": "58ec9221-b077-45e5-a0f2-40f855d9f74e", "value": "yakuza.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18570ef-1c95-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1773156521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156521, "uuid": "605c76b6-d2ce-4a71-bbcb-a9503a85849e", "comment": "Malware payload (DattoRMM)", "value": "c579dd0b113b5afcd7b6476a480e1002", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156521, "uuid": "a2b1f494-c467-453c-8341-efbf60d9c3ca", "comment": "Malware payload (DattoRMM)", "value": "63b9f3f2b575d73b01c117952a202422079889f1a3c04aeb64ab0d66c5c477ec", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156521, "uuid": "3e16e390-f71d-4c5b-9b25-1199d69b4287", "comment": "Malware payload (DattoRMM)", "value": "52bbef068d63443b9a8bed23aa5d8d3383335bdd", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156521, "uuid": "373b32f7-7ee0-4e47-b8c7-0fb0d31c7bd1", "comment": "Malware payload (DattoRMM)", "value": "03f8779ce6c96003b009f66e81d1b7906f472bd12ad7f2c6361df563d893f1ad166a507a8f8a54afc2839039e8a78e94", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773156521, "uuid": "c0bc351d-b59e-42b5-b8b7-b362e4e619d1", "value": "T1FDB63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773156521, "uuid": "0821d38a-d2b5-4856-8f90-6586a18679a2", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773156521, "uuid": "c351fa79-45fb-4bde-ae15-c62bb9a72359", "value": "196608:PaZk+wnP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:Hn2mzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773156521, "uuid": "c0a4c7eb-5d36-4445-9b92-c74653fe0c92", "value": 11056104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773156521, "uuid": "4d3bfb78-5352-4f98-8fa8-c68ce9baa7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773156521, "uuid": "0d28f0d3-348b-4ecf-8612-684c5d92e94f", "value": "vviiew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c83bc23-1c89-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1773151117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151117, "uuid": "ec4931fc-13d2-4bf5-b4c0-83fed967d674", "comment": "Malware payload (ChromElevator)", "value": "8a7ef892399bf9434dd9d8ed8cadd229", "object_relation": "md5", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151117, "uuid": "43feb3c4-a4f5-4254-87e6-1ab0f25a9f35", "comment": "Malware payload (ChromElevator)", "value": "6485f0627ef676f5c7653a89c69db86dc5ed5c84db183dd4741c836ae79acc7f", "object_relation": "sha256", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151117, "uuid": "8898e894-26ee-42cb-acf0-a69421261449", "comment": "Malware payload (ChromElevator)", "value": "af8073d0aa846c6a81608039f1d1cb98dfed1fbe", "object_relation": "sha1", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151117, "uuid": "6f77b821-d4d4-4aee-8818-77723cdc7608", "comment": "Malware payload (ChromElevator)", "value": "fcc9b573bc8509bc255054c7176b38bbb8e613835832a916a630af594bb88e9b606ec8cf180a566825e3b98262a1e02c", "object_relation": "sha3-384", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151117, "uuid": "93cd3490-42e9-4242-a3c1-e84b2b911f00", "value": "T1F1C5F10AE37400FCD06BC2B5CE525A13EBB2B8451334A6AF57D58E962F17B705A3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151117, "uuid": "89e66beb-41e8-4545-bc50-e6e2dcfffff0", "value": "37c1fda3eacb25e39fbd1596b6aa2a4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151117, "uuid": "a4ab4276-3d31-4f3a-8cbf-e1b0c0d8f773", "value": "49152:dugW+f5wWIt6NvnSdoJeJUbaNnqZFjM8d:d98tszeJ/8jMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773151117, "uuid": "269d1194-5434-4c28-be93-5cfdd6305c5e", "value": 2542080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773151117, "uuid": "f543322b-d982-4b8b-931c-b6ef173863a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151117, "uuid": "2bdbdc50-c6bb-40a1-8df9-3dcff7f54877", "value": "6485f0627ef676f5c7653a89c69db86dc5ed5c84db183dd4741c836ae79acc7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926b4e55-1c3c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773118190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773118190, "uuid": "422d9729-b980-4c70-93c0-2819448d9dda", "comment": "Malware payload (Mirai)", "value": "ab060c02afb0b625436050cdb359832d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773118190, "uuid": "e97d9b6f-0656-4663-95b7-fb30e0391159", "comment": "Malware payload (Mirai)", "value": "6488ff7929c4313e9d9e0f2e0877cdba39ee60c405851dcb71a78016708b8b7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773118190, "uuid": "29f6a4d0-7c07-41d2-8c67-849705729058", "comment": "Malware payload (Mirai)", "value": "a55a91167cf70c55229b41ff0ed333acb00f50a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773118190, "uuid": "a3ae8207-ca26-4a1a-a14d-f41ee4b48d3f", "comment": "Malware payload (Mirai)", "value": "d86931d4dc9c4e682d03ee919530176ee4c0349c88bbeab355960c96865692540b3c5d8f589c83bf112af5e4a132f5a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773118190, "uuid": "af63eaa6-0b82-4b1b-99a9-05a0c20661b7", "value": "T179F30745BC519B17C6C626BBFB4E42CD772A1758E2EE7203DD156F20339B86B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773118190, "uuid": "28e6bcd4-5aa7-4ac0-af1a-00f6f1577b82", "value": "3072:6ScPUUeQ6wtwn6qSzBK8eQ/90uQK4UZkY0+/hx6JgrW1:6BPUUeQ6wtw6JBK8eQ/90BK4UaY0ghgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773118190, "uuid": "39cb0c56-4320-4b75-bb30-fc607601297c", "value": 164248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773118190, "uuid": "aadb0fe7-05fa-45b2-8f34-8b5e4994627d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773118190, "uuid": "3751398b-bb73-4feb-90d0-c969c31aa79b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f13ef0-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146321, "uuid": "331f1f1c-39f0-4e2b-a3b9-e46eb57aab47", "comment": "Malware payload (Mirai)", "value": "fcff59b225d0234d46728d1bd6f53785", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146321, "uuid": "65e51773-4e3c-46b4-b1b9-988fb7f7703d", "comment": "Malware payload (Mirai)", "value": "6909c26a6559dd03b2c667d04c6b58e40e972f13a46964f729df3c702f74012f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146321, "uuid": "a6e46f60-ebad-4b10-bcc9-658b0a8cf147", "comment": "Malware payload (Mirai)", "value": "7c6f9ae47231942bfb37ed04a7a497220f476f19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146321, "uuid": "8df5b3ec-0b09-4dc5-bb28-3dad68fede01", "comment": "Malware payload (Mirai)", "value": "a6b2152c7cf46f67913086387285eac9e6d03de5a925b6dbfa857a049dd3abc112f4ef0964a16d2e5eda1bb2fdfedd67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146321, "uuid": "4d8b4422-af91-41ea-a146-ea6037541909", "value": "T121F3C61E2E65CF7DF368C33847B78E31A799238226E1C685E16CF6112E6024E545FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146321, "uuid": "51fa48c8-e5b0-4765-b5e6-214bd69ea2b2", "value": "3072:zHPosxR7pgASU9GwoWIugR8GqhI4Chp9uYCGRKdywTuu:zHPosfO6GrWIugR8NIFfBCGg8wTuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146321, "uuid": "71bf2a5f-3361-4e7c-93a6-0736199c8218", "value": 157660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146321, "uuid": "e2e57afb-9e18-4ad4-a047-b78857eb6f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146321, "uuid": "59e0446e-27c6-4853-ae54-3bc44f209900", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0087b5-1cb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773168538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168538, "uuid": "675c90cb-6424-45f6-9d96-d85c5fcf4c29", "comment": "Malware payload", "value": "16fbde1d669c939873c6b0b72f3a898c", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168538, "uuid": "e6cfab69-7d08-46c5-8d40-29e1a7a7f2ed", "comment": "Malware payload", "value": "695af1fa1e6492496c721f401bdcb3c4cc839f0e884158ad48c041ef895a2650", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168538, "uuid": "3350ac2d-f59e-4b72-a326-5fe31bd23f8d", "comment": "Malware payload", "value": "5ae3df3ac8e8ce47a49727aced1dd966ba55b959", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168538, "uuid": "3009e6b1-1fa6-441f-9583-0a8c2d91153c", "comment": "Malware payload", "value": "7b1a09161e821a5def6addf2a0edec2bfcd00ad59600c70782eb71ef319f3c4cdd00e43e3b07017de05178f7bb29b56a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168538, "uuid": "03ec9b4f-7da8-469f-bb33-1bacdd4720b3", "value": "T186F63377E85116C5EE3BFA72D0602FD887E3520FC2B2782BD6861FB924C424916DE647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168538, "uuid": "a7d541d8-5b15-47db-a759-e7719e565f33", "value": "393216:+Bjm8o48gu9dAFWhyUTlaW9bzhF93az2zyx6qjqrU+h/PUEl0U8YYlbEC:Z48ZTAMDwW9NXe2m6qIhnUuDgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773168538, "uuid": "8c3c7b53-394f-45d6-98af-c3a932f021ef", "value": 16111987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773168538, "uuid": "77adb6e8-6f48-44c5-a758-f156ffe2caef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168538, "uuid": "591a5c9b-a9b7-4f5f-afd5-7c1e04f222ec", "value": "asfixsoftwaredev.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053da062-1cca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773178942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178942, "uuid": "32a0763a-0fd2-468e-933b-e701a4cc6d82", "comment": "Malware payload (Mirai)", "value": "3bd125a1904af408d7148939e1a8b361", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178942, "uuid": "c0bc8c3c-41e9-4c41-914d-ff3d44661fcb", "comment": "Malware payload (Mirai)", "value": "6a98058ab7df28cd4ea079b803987136048819ee1000a40a4b3aba8a7bfcbe26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178942, "uuid": "b3f504f3-6a60-4732-9566-14c3184395ff", "comment": "Malware payload (Mirai)", "value": "a5c571aab7ee3ef4d6b6a9cc64f9d0efecfb0663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178942, "uuid": "ed1a2c04-1d5f-47cb-8277-dbdea6f0c999", "comment": "Malware payload (Mirai)", "value": "a421c4811143231717bde98c08d26740706428fcfbded765298fdf42559e61ce82d282f4f6a89c7b81b85f99aaf9f750", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178942, "uuid": "bb752782-515d-456e-a363-4dc816c0c76a", "value": "T1A3831982BC41AA2AC7D0137BFAAF508E3311B7DDD1DA3242DC254B647ACA91F0D67B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178942, "uuid": "c8167e22-981f-4d40-85f2-8b8d8e12c676", "value": "1536:bijwMUaa2nvKSH+/qgeQky2NX0CsLkY4AJCB8t46zGoky:+UMUa3mqiki4uy84MG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773178942, "uuid": "2acaaaa8-e378-41da-bc79-acc7822fed2b", "value": 81560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773178942, "uuid": "a5356f01-eaa6-4281-ae73-dda10c7eb2cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178942, "uuid": "c437e9dc-83cb-4904-8077-eba28175218f", "value": "MMaaRRiiOisecTanee.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbeadc09-1c32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773114072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773114072, "uuid": "bbad5157-55f7-4dbf-9609-10dac5e84bf1", "comment": "Malware payload (Mirai)", "value": "fd83a3263ae3fe590cff2fc0671540f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773114072, "uuid": "2e635488-54a3-4b6a-a62d-a8645c19974d", "comment": "Malware payload (Mirai)", "value": "6bab957764149d659c908092f57bad0bf9102aa4c6a2f9df1fba5df8615b6928", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773114072, "uuid": "2eb756f7-f107-4e35-8fd0-cb2af557971b", "comment": "Malware payload (Mirai)", "value": "bf2b9bf9e2b905ceeedd71e71a8c77139a78e6ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773114072, "uuid": "81737421-8e7f-4175-b4dd-4174d20ae994", "comment": "Malware payload (Mirai)", "value": "924b984c3decf3b1edf0b5c72275863f39787dc96c8b8dc4dbfc6259aaf15838cff1f1f0a84f742122651643ed828405", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773114072, "uuid": "51e7faaa-0f93-412e-b5b8-1a3f57834ed9", "value": "T1F9D31959FC819B15D5D626BEFE5E528933531B6CE3EE7202DE145B2027CA91B0F7B002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773114072, "uuid": "f2c5fd16-2898-4f19-b8c9-ad81bbbdbe47", "value": "3072:BHtfPPDhRdCfTYkp2I2rGwymCZTka/NpnmIbmRAMkxIgIEI7q:ptfPPDjdCfTYkpcCwy3Jka/NpnmIbSAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773114072, "uuid": "fbc94257-2b0a-4bb0-94ba-d2bd8eabd1c6", "value": 130236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773114072, "uuid": "1c79c37b-56ad-46eb-8d91-692ad62d13d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773114072, "uuid": "85edf46b-bed3-4b5c-b86a-046b8331502c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74620258-1c93-11f1-a769-42010a9c0008", "comment": "Malware payload (N-able)", "timestamp": 1773155506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155506, "uuid": "40c42169-bf10-4fdd-a8b0-d06407043a1c", "comment": "Malware payload (N-able)", "value": "f3b7bd28b1b08d450aadeaf14c240612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155506, "uuid": "9ccc3be1-1368-4a51-9eeb-05120dfa6135", "comment": "Malware payload (N-able)", "value": "6d868cc1c25b1fda266a2f94b6ff58b20cd2b72a064c2004a97392ffb6fb6b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155506, "uuid": "6643fab7-5e06-4d46-b0a9-f5f1bff0f69e", "comment": "Malware payload (N-able)", "value": "aeb775dbb0c0c5531707d80002943113de19ed96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155506, "uuid": "b02cc83a-67f3-4491-8d25-a0eeb7afb088", "comment": "Malware payload (N-able)", "value": "617bcfd35125a4c1c34e3b3192134b220e806282541bc70f5fc504727c98bc5d724da45ead4ae56c4fc72a28e7abd5c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155506, "uuid": "17d11925-dc73-4144-b0a0-6fea6dd633db", "value": "T17EE633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155506, "uuid": "1b9b8e62-cd51-46ac-8e76-af4fb4400c19", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155506, "uuid": "1e3a1ac3-2323-4f30-9255-41a200c7c470", "value": "393216:G1F/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1V:irRxvoC/7a0jUxX7h1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155506, "uuid": "85ae57b0-fc55-4172-b4bf-fca43ea26d24", "value": 14782000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155506, "uuid": "831c9cdb-77f8-4d67-838a-981aa904f5dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155506, "uuid": "5e915042-db41-4fb7-8c17-f25f5ffa2a49", "value": "Orcamento_697135_V10_14_4_RW.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab51b7a-1c29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773109990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109990, "uuid": "a0cec3ea-5af1-4094-b53e-0dc2be513bae", "comment": "Malware payload (Mirai)", "value": "f80e545033d815ed8e38e090b15b55f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109990, "uuid": "a3ac1ed2-d31c-4ec9-95c4-d3b3be9b305a", "comment": "Malware payload (Mirai)", "value": "6eeb520a139786c3d432bf139636fff24b9990ed6b93da3bbbe04a3f3e2d1e7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109990, "uuid": "8d91bccb-306f-4ed8-89df-574fa2e9dfd8", "comment": "Malware payload (Mirai)", "value": "73a7524bfb7882f834b7609ea04aecb83e53e865", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109990, "uuid": "629a6d35-d1ca-4fed-a20f-49414ad31028", "comment": "Malware payload (Mirai)", "value": "6a1e041922fba7faa4d384e19d7bfb53426522673fee2024a57b3d5e70d54a9f49667b11f77d634d534952af8cb3ff37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109990, "uuid": "892b8d43-b4b7-4fe6-81a4-21ab685703cc", "value": "T1ECF3F745BC519B27C6C616BBFF4E428D772A1798E2EE7203CD156F24339B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109990, "uuid": "b9a6eeb0-cd3e-4d67-868f-a0c95632cf45", "value": "3072:v6uPPiIcclIuqP4vnGxFe2TU98hsk4bcJ74QunGIwZ3t:vzPPiIcclIuDvnGxFe2TU98ak4bg74Xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773109990, "uuid": "8edcd3cf-7b8c-4cf0-84e3-d2ae85e9e5be", "value": 164056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773109990, "uuid": "927c1e1b-f233-4b29-8b0e-a8fc5b0f7af2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109990, "uuid": "b5156073-5bba-48d5-898b-aea9e88c5773", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fff822b-1c6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773139876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773139876, "uuid": "61b1a6a8-a803-4e47-b77c-9e11474a6453", "comment": "Malware payload", "value": "0b5fa3c85d9e3bd70caf15c83cf55ab7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773139876, "uuid": "97f852ce-6075-4929-b7f1-9d7dfa10f1da", "comment": "Malware payload", "value": "712737cdde50fcce895f263ea18ed7f8e425dcb72f8ec63101ea0361c6602140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773139876, "uuid": "caed2da8-db79-4e63-a5f1-63c1a1f21829", "comment": "Malware payload", "value": "3cc764d3f6c88f21574dfbee820094217a6aae83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773139876, "uuid": "eb7b6afa-677c-4003-815a-873038ff5e03", "comment": "Malware payload", "value": "cdb6687f9fe748a2d2f6bc9b121f32ece9f5f1c17388b715d1408b3b4e30e52f0b9ae944c3ef4cb3e6f7aa6117aa5c05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773139876, "uuid": "fd0914f9-3a14-4df3-b4bf-54b0813dfef5", "value": "T14A1633F351A09A6DE041E0FB8714270F4BD5D5A2EDA40FB5BFEBA494A9FFD06A413024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773139876, "uuid": "c7b03766-3fae-4181-9927-fda518985c72", "value": "98304:yAz+kDycSKzl8ajlz6lh2XwTknntmvTimGbZV5LnyNhFoJDNBf3:T/1zlVF6lh2akntcimQQg33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773139876, "uuid": "da3b6cb4-a447-49c4-b825-4f093f932f1b", "value": 4196540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773139876, "uuid": "77f5dc8f-2475-4a05-b075-a6ff8d32d6bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773139876, "uuid": "8aa6694c-c15c-48ae-aec5-f49639cf4a6b", "value": "CZRmrtxnrNONBXhwfFeqjNfBrliNaShG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cf5c8a-1c2c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773111240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773111240, "uuid": "6e92ba9b-bb6b-4a6e-a606-4d9d254fa4a4", "comment": "Malware payload", "value": "649053939a1a4f0f1ff11fb6d9092fdf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773111240, "uuid": "5e4b0789-b02c-4cb4-ac95-21a7a3c741cf", "comment": "Malware payload", "value": "726cfca5430c146eb82b8cb13a7f066931f2334258872538b94a0e9877e25fa7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773111240, "uuid": "fb3f28e6-1413-416e-8225-87d868e6c18a", "comment": "Malware payload", "value": "a9d6af99a05a507c5bb762cfeb432b9a56cb176c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773111240, "uuid": "7fb87a46-939a-4d57-bbe9-34d920314865", "comment": "Malware payload", "value": "473ff08468d92b2b8928538da372a8b3103c5a95706bb6b3ebf4fdb76d45ca918c4a7052170864f1c29d420944a3a214", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773111240, "uuid": "8ed3dc9a-0d61-4da5-b616-3d69a8dcbeb4", "value": "T1F0925DB512896C79FBD0CE39AF3C7F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773111240, "uuid": "a6111e9e-fbf6-4cc3-b27b-d4f5bc17fcd1", "value": "384:APRFcuQpWx+BL0SWL0gZmzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:yF8i+BL0SI06mzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773111240, "uuid": "ce035ac0-86e6-4289-89f9-a25d39687988", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773111240, "uuid": "57d046b6-4b26-4356-aa65-566b48830324", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773111240, "uuid": "560a853d-a576-4a45-a8d4-ec249eb7b6a8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83d3e9f-1c80-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1773147567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147567, "uuid": "2288fc88-92c8-4506-9274-39ac4cbf1b60", "comment": "Malware payload (Joker)", "value": "930b853d0888a91732f6ff37977f3522", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147567, "uuid": "1ec0823e-d7fb-4e98-a066-509d246e0ba5", "comment": "Malware payload (Joker)", "value": "74179870e66ed931f3c4a2aecee550d0b754d15a42b6687706540c165e90b6e4", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147567, "uuid": "011bff47-bbff-4a8d-be38-1af9ef6c9b99", "comment": "Malware payload (Joker)", "value": "73e5f4115604c472a1348f64c612d37cd2ec619b", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147567, "uuid": "af30f429-c2e6-4de1-952b-7528620ef161", "comment": "Malware payload (Joker)", "value": "ec0266203af2753dbe0530f00b8f98eee7df7b61be48a4df1238859121f5a18c02afb0b53a1e5719129136a57d82e624", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147567, "uuid": "90619895-eaff-4c8e-bf11-5690f9641e17", "value": "T18A272252F358DA2FD4374035186A223E11574C2BDB82DF43AA59335D38B7AE40E69BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147567, "uuid": "b95a0790-4d45-4e1f-b4cd-5fc625fec75b", "value": "393216:rjG4iL4lCJU3I8NquL5pucELsjkQdfjQsCdBcRD7m5SBXtmjoXrn9Xh8:rS4iLh63I8tHucEwQ2fjQzdBcN7tXtmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773147567, "uuid": "aea8f052-78dd-46a5-9ee0-8ca222db5214", "value": 22247227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773147567, "uuid": "e22962ed-90f0-4493-9f97-997fe55988a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147567, "uuid": "1ee67ab5-4672-4949-9baf-2188812ac03e", "value": "com.jouro.junk.cleaner_1.0.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c228a8e-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126152, "uuid": "1b1798e3-7645-4057-9e9c-5a958b591834", "comment": "Malware payload", "value": "f589125cbce8dc390a569a024a2d248f", "object_relation": "md5", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126152, "uuid": "6d8e9df8-9a59-4447-9de4-f185a3e2c45a", "comment": "Malware payload", "value": "75b680572fe7d8decde178be67941ef8067a05f085c2437002ce208626954d77", "object_relation": "sha256", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126152, "uuid": "46b2757f-6972-4e4d-8a47-ff3419a962cd", "comment": "Malware payload", "value": "64b0d8d67412546f8c9517ecd93ef9c017dde6fb", "object_relation": "sha1", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126152, "uuid": "8231aadb-e23d-4c85-9b27-c520b026d375", "comment": "Malware payload", "value": "056bc6662ec6db6aec3a237f621ed8f13a2f9132f3d85c0937fe4fc66f1038fcc11115c6a1fd5186414852785358d926", "object_relation": "sha3-384", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126152, "uuid": "e5327ad4-f455-4743-b499-fa1fa09800f0", "value": "T1A34633EA887B10031E65C8972BCFAB857B670510B1BF6EE739B74192D583376CA43D18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126152, "uuid": "65dd9ed0-b171-45bf-8a08-9f34b3948179", "value": "98304:xejxWc7Rw18jvRSUS5cqDVibrRkyKLfsABxKKMtmeckTcNM0dLXRXB0Mm4+F9+S3:xe95F4IvgnDVibraRfsAf9o+nM0zXB0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126152, "uuid": "de3d4db0-f109-4b80-9cde-36e3274fdbd9", "value": 5781409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126152, "uuid": "dd517c7d-4933-44e9-9e16-6cc3b27d0555", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126152, "uuid": "5ecf8804-3e05-43f9-bfe7-5e7160a02faf", "value": "4a2f0f1893527e4c419f36c2e4f95a61617074200bb67218fb96ae74125e433b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedd60d6-1c82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773148329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773148329, "uuid": "7cb12acf-8f7d-4b77-ac1d-7bde3bc5738a", "comment": "Malware payload", "value": "460f47938c04a6fdb9d2faeaf0b16c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773148329, "uuid": "61eed38d-0b09-45f0-b27a-c584a7c3096d", "comment": "Malware payload", "value": "76005b67d11c0e89c76655b2ddc16f5bb778ee547f2a4c6fc2e2e1d7e2dde7d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773148329, "uuid": "ffecb224-d170-4cc4-846a-e729254da196", "comment": "Malware payload", "value": "10940bd935ccccef2d9c4aaae9bbb6f04ddcd0e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773148329, "uuid": "fd6a15ad-2130-4f81-8681-9cdb7f0e0efb", "comment": "Malware payload", "value": "2b4f4d2134e5d3a9c77c67fe33bbb22a5b6da53901f3b9893b1e2b0353f024b05d3df22143269c1ab6da3ae26bae0eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773148329, "uuid": "6a204912-c323-4029-bf43-c45fa4a63133", "value": "T1EE45D70FE3A801178AE3037BB2175292B73BD27487C5426654FEC02936939FD879B6D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773148329, "uuid": "4d3b2716-7434-4629-8354-66c4530fb96d", "value": "2f611bc63293ca885a70090be8df0f3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773148329, "uuid": "3aa272d4-0c8a-4cd1-a4fd-dfe5e2a5e6c6", "value": "12288:4e9TDZ1hSZ+gjWurE6q5u6Z8Axy9uyfjr2hzZzDNXv:nhSn/r1jg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773148329, "uuid": "07f3bfc0-0463-42c5-a056-4ff834c8e93e", "value": 1196544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773148329, "uuid": "cd850576-9d87-49a6-b33b-c563607c4718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773148329, "uuid": "79719ff7-e2e6-4d72-8ffb-f04dab5be961", "value": "digest.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b98744-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146405, "uuid": "8e8d4847-90d2-4a81-9b43-4460859f0dd2", "comment": "Malware payload (Mirai)", "value": "0ef4228fdcda0e0d7465c869ef974c69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146405, "uuid": "9c68fedb-b4ad-4916-8e1d-68badc96ba20", "comment": "Malware payload (Mirai)", "value": "761aa3683f48c753d371488d1312294003d9639403592caa1f5eb6b6c2a465a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146405, "uuid": "20307b97-3d81-48ec-ad2e-7ddb239f658d", "comment": "Malware payload (Mirai)", "value": "5690612f53b7bbed3173a5fa51d0b60cfdd63465", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146405, "uuid": "c5ed62dc-98a6-4d85-bbcb-e2c51865d3d5", "comment": "Malware payload (Mirai)", "value": "811502e159c2201913b83cadd43b2bb4d8ad0f62a58ed566f38f0541031d33711ecf367e61adeddd158e9c50ad36516f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146405, "uuid": "58bc8e23-4dca-4b5e-ac00-e881a72bffe3", "value": "T106935C13B9C480FCC849C13087AFB536D963F17E1279B29B73D4EA127E9DE511E6A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146405, "uuid": "1c38b3f5-49ca-4841-bd1c-849331d74b49", "value": "1536:yc50J45j1WS60TzxMJQ1JTidyRgQQ1h1Ms6fuftHHZlmpnahs:vf5j1W0TzxPJSyR+1h1Ms6feHHXmQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146405, "uuid": "13643207-18f6-4d0a-af70-b2ad74238b86", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146405, "uuid": "f0022333-218d-42bf-b2c1-950117d669eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146405, "uuid": "022aa48c-5c55-4e99-b57a-2598f38775b0", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fbd802-1cbc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773173271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173271, "uuid": "0e70bea5-5b81-49a8-a5f4-44323561203d", "comment": "Malware payload (Mirai)", "value": "5b7b48087f21561f87db0368c13952a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173271, "uuid": "d2528ee6-1d03-4f89-99d9-41fa919174db", "comment": "Malware payload (Mirai)", "value": "7675c9f4af0c0f311a2427a0c1da3df9b861703478441943dea20498f2f38ce9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173271, "uuid": "f7f63301-4f4e-4207-a725-a1300b00116b", "comment": "Malware payload (Mirai)", "value": "6d2e17cd9c173c67035a18569a532ddb1280f392", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173271, "uuid": "407e1e30-7b94-4cf3-88b7-a8c73deabfe8", "comment": "Malware payload (Mirai)", "value": "ed767fe7ed763757f06769ce1d4439eea172b03b3b5eea4e5854f6a3dc0ff150e4978d992bd4d902a8a797cd8be190d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773173271, "uuid": "3423dbe3-a57e-4efa-81c5-cc8d337e8a41", "value": "T162B3930A6F600EF7ECABDC374AAA174924DD241A25A87F75BD30D818F24B25F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773173271, "uuid": "5f85e4b2-d635-42d7-8a15-1959f79355ef", "value": "1536:RjEbgin9bHc2cAd88YOl1pY1dZsKTmNWTxZn96tUFbs:JEbgin9bHc2FhD1peFTx3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773173271, "uuid": "c7d5e9b7-24fa-45c0-9819-933681763299", "value": 116916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773173271, "uuid": "8764d445-3633-421e-82da-e91f45050df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773173271, "uuid": "7c160319-797c-4a15-b7a1-8ccb0b2232dc", "value": "MMaaRRiiOisecTanee.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13a9dc9-1c6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773140200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140200, "uuid": "b4096edd-c516-48c9-8c26-4c67f25d75b1", "comment": "Malware payload", "value": "c75237d89a0042b7c20255d666c25a1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140200, "uuid": "fc24305c-8018-43b1-bdbf-59005c0743b5", "comment": "Malware payload", "value": "77d916998e9e9b5c248b464d83ec199dec6ad56b8c12e53f3d60568975b8580d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140200, "uuid": "f7ac0dd2-eb9e-44c1-9a34-e8028753a97f", "comment": "Malware payload", "value": "fa184527fcd3e680d3f042acab758eec65698c8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140200, "uuid": "1524663b-ff8b-48e9-91fe-adf07d372afd", "comment": "Malware payload", "value": "c95f577b985ebb49a23d4330f576e5649e9f947313952a675f8126cae986cde3e8718ae7118f05a39677d3c1565de2ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140200, "uuid": "5d6c101e-181c-47c5-a5b7-219acf303c5c", "value": "T1B8A59D11AB936197C13ECB7880FF0B13F734F0292306979B9980A9B46F157E9AE38755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140200, "uuid": "7e6a3c79-a31d-416b-82c8-e2d10cbbdfa9", "value": "8f1fd2927973be754986ef34afeba09d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140200, "uuid": "46ef8ab2-c200-48c9-96ae-d855123ea2ff", "value": "49152:W3hAQbZ4ZlDhH+QuHEMtrbKayqVtr9ietDsRJP:6N9aGdbM+toe2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773140200, "uuid": "5fde7a4f-73f8-4aed-a0da-b616cd301816", "value": 2184776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773140200, "uuid": "ce0535c4-f1fb-402f-a976-2f1f1af02312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140200, "uuid": "c63dd2e0-111f-4dd3-b959-d8d0459b8ee3", "value": "77d916998e9e9b5c248b464d83ec199dec6ad56b8c12e53f3d60568975b8580d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd463dca-1c6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773140166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140166, "uuid": "1c649d2c-f1e8-400d-826e-e93e55434250", "comment": "Malware payload", "value": "58db9f3b4520f6ead096bbfe3f348d21", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140166, "uuid": "d601158c-70cf-4f3f-bc96-a8b5c2d75e63", "comment": "Malware payload", "value": "7a1914bdc09b3f4cb6c64d3ff13585e52cb1e61acb96b798f811674a67f528d3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140166, "uuid": "a02c4c20-ab3d-4e28-aed0-f3061e20ce79", "comment": "Malware payload", "value": "74618fbff3819f901d115c2876ff9bb325df9f59", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140166, "uuid": "d9b9e287-b273-43f7-ad1b-08f395c49b41", "comment": "Malware payload", "value": "d928731b93a9a56e48c9479b7c7d142ad39fb4162c77375319d161184323f0928a4718784f04e0b1be7cd7578462c33b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140166, "uuid": "e531fe74-f093-4de3-8010-b56976464607", "value": "T1CFE50122738BC626C55D02B0159AEB5E1139FDB34B3450E7B7E8392F98F44C26779B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140166, "uuid": "a69ff76a-2a6e-4314-949f-22e3acccac58", "value": "49152:92SX7jizoL5laI3xBBkpu7+is6PhvIg6Wsl5q0hWrACxtFTSxKP8pIEmM:J0ssiYWsBQZHSCMDmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773140166, "uuid": "27c2ed9f-ab64-4281-9658-98cd01905f99", "value": 3075072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773140166, "uuid": "cd503d02-e340-438f-8f6d-42a7289518a5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140166, "uuid": "0332b196-41c5-427b-b02d-4812f088ba3c", "value": "Update.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078f06bd-1cc2-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773175510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175510, "uuid": "90e7dcba-9cc6-47e9-8e60-9b97a067cab5", "comment": "Malware payload (QuasarRAT)", "value": "0d59800d2c3053699a175b176422a11e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175510, "uuid": "19386581-8191-4c2b-9fbf-ef560ed111d8", "comment": "Malware payload (QuasarRAT)", "value": "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175510, "uuid": "67086ddd-2af9-4238-953f-074ad33119ee", "comment": "Malware payload (QuasarRAT)", "value": "6cfdb81829e1554facee6244ce9eeaa35962cb77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175510, "uuid": "a8847188-eda7-4bd7-8202-abfce48cc0c8", "comment": "Malware payload (QuasarRAT)", "value": "5fc891e31e56678c23a7c745b0e4afdd5a28359fc3a9c83f3e73749284399408076d21fef240de8ca19522fb9f2d97f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773175510, "uuid": "2a33956c-f186-473a-874f-3d5b6dbf5845", "value": "T1B0E55B1437F85E33E16AD673D9B05016A7F0F82AF363EB1B518267BA1C53B508C41AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773175510, "uuid": "3dfb921f-2ec7-4451-9420-13ffc5ad3c5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773175510, "uuid": "c20ecaf7-0a38-426c-904a-a2019741dac8", "value": "49152:KvIt62XlaSFNWPjljiFa2RoUYIplvhKoGy9THHB72eh2NT:KvE62XlaSFNWPjljiFXRoUYIplv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773175510, "uuid": "44883265-2801-42c9-99dc-e480367a9506", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773175510, "uuid": "5ba00b94-0960-44c0-b633-89b46e21b2f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773175510, "uuid": "4c9e1694-036c-412d-b81f-7dcfb713f86d", "value": "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3572e2bd-1c6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773139938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773139938, "uuid": "c99687d1-af02-4a1b-8418-c74e4c5fa645", "comment": "Malware payload", "value": "562adf1d3a4e51d73200822a2840e788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773139938, "uuid": "be1e2ac9-7140-4634-867c-e3b5abe39236", "comment": "Malware payload", "value": "7a71a17bde3611a1b147f8946106d6da4d859c0e322fb2bc437cc6c3eddb5390", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773139938, "uuid": "d06a400d-a321-4e76-8525-bde49e4a7c2e", "comment": "Malware payload", "value": "c0a500a25036a8cd8d24a9f05d3de67d87a53caa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773139938, "uuid": "94f1cdf1-3d82-48ef-8e63-b8648eca1df0", "comment": "Malware payload", "value": "fa5ddd3dcfb39553086c5b3c3410211acc45c97e93d1f7d6505230813eb26239eda67bd85bcfd2f27fc254a108aaf1e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773139938, "uuid": "58887c0e-46c9-40fd-a720-e845bdccae3f", "value": "T115D66D87E8E11D95C4EE8174D529826BBA727C091B3823DB17E0F3341F36BD0AA76B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773139938, "uuid": "349ac344-293d-42d2-afa3-fd030b67433a", "value": "98304:MzKhgBETIsl2e8WlCsoSsG/iZUtSTQoF9AL:METIC8Wl9/iSl/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773139938, "uuid": "bfe7da8d-6b75-4a93-a869-00843fbb3d08", "value": 13754516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773139938, "uuid": "a925bc6d-9062-4277-b2b6-5d3722869826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773139938, "uuid": "f9bd30d7-dead-4583-95f6-eb7ef0f9a611", "value": "CZRmrtxnrNONBXhwfFeqjNfBrliNaShG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0beae180-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146311, "uuid": "2fe3575b-0ae6-4139-a056-1956135139fe", "comment": "Malware payload (Mirai)", "value": "62fc53ed50d1e47c76d3cdbeae47b7a9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146311, "uuid": "4a541cb2-383d-4e64-827d-921c52e0f983", "comment": "Malware payload (Mirai)", "value": "7a7a5b3cdf51fb859d5832cf117e492d78d74c628467d1a98361c2c7d2559ede", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146311, "uuid": "9f184244-a640-49be-89ca-ea977e84c478", "comment": "Malware payload (Mirai)", "value": "9ba08dc5543ec2aa0b598bd96fc78cadc64d526e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146311, "uuid": "0cd9b63c-3242-4855-aef1-238af362d0cb", "comment": "Malware payload (Mirai)", "value": "029058ae6e7791d2645020aaff25b022c177cca20d78b4cfc2cc02824c584a3224d11c585736e46da3279b6a71eb7c34", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146311, "uuid": "f3f51a31-cedb-4719-80d1-3ac8a0a75212", "value": "T1D401B99011B020B434AE98DB9D320C1C31C7E5A93DC7DCBC7DE5A4D71E99C00F082699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146311, "uuid": "56c1b9bd-90f9-4ea7-a49d-270f3e0164e1", "value": "24:ZDkH/FbeeHFTSJeHFNeHFWx+Fv20FM5gFG/x+FF20FMDgFGreD:hOFbeeyeDeoy2l5g2Xr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146311, "uuid": "efddaa17-e0b6-4a1f-8707-db10d0166149", "value": 771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146311, "uuid": "93ff56e7-9eff-4ab0-9d23-65412437c0f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146311, "uuid": "4234468d-8697-4b2c-a974-6dc7cae2766e", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214ca61d-1c66-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773136039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136039, "uuid": "973691a7-52bc-45b8-b0cd-4cdea3c5a86f", "comment": "Malware payload (RemcosRAT)", "value": "9153dd7775cf8fc6e696ed671328a52b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136039, "uuid": "1e3756be-8df0-4415-a85c-374b821adea8", "comment": "Malware payload (RemcosRAT)", "value": "7b0d1275328c6d19b44c89746d0dd459723c2bb7b28d93a23139ca00cf40ba56", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136039, "uuid": "a1002f7e-ede5-4db6-9784-c8b1bc5d1ad9", "comment": "Malware payload (RemcosRAT)", "value": "0e84e6369f2b116cf56954168c74bb8a0fc3443d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136039, "uuid": "c75774d5-ea5f-44fd-ae5f-1f45b49e47c7", "comment": "Malware payload (RemcosRAT)", "value": "8b5a73e827dff49619fa1b287516e1c4eaebea25440255769c21d5bca63fd551a0f61755aa04f699063e5c35533d9ced", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136039, "uuid": "c0814ba2-4761-48e7-a2dc-5d454006cc37", "value": "T196252366DDA2770AD113743507D3A85081A9FC293309DF570B4932AA3133BF2F9D282E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136039, "uuid": "351a98c6-c0ab-4b43-b613-c877cab525e9", "value": "24576:r9Q3TQLFoCA2LavQho3bP1w4ZHrTRCEnI:WDQO52Lal3b9BxCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773136039, "uuid": "42f58d00-c298-4924-9466-037ef5fa59f7", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773136039, "uuid": "2388f2ae-9989-4453-9de4-312168a0244b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136039, "uuid": "6e9c1b5c-cad9-4632-8fbc-95a1cfb4188f", "value": "New Inquiry List2.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db13e6a1-1c55-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1773129049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773129049, "uuid": "08e3dedb-9375-4b79-aa9b-6b68da723e99", "comment": "Malware payload (SnakeKeylogger)", "value": "2cb8030ff93885556ada3ed782889f0c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773129049, "uuid": "a4327731-6cce-458a-9b87-9309f9bf717b", "comment": "Malware payload (SnakeKeylogger)", "value": "7b2b9ea6e5cff58284987f53650c13bf0d724f9805baff80ea0396ca1dd255d7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773129049, "uuid": "a1ba4053-34b5-41a1-af97-b9d4440dc579", "comment": "Malware payload (SnakeKeylogger)", "value": "7d02ed1e8414578e0de1e7bb3f0cc5274fcafe3b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773129049, "uuid": "e1f6981f-d6f5-4a15-bfd7-6ff304b1d196", "comment": "Malware payload (SnakeKeylogger)", "value": "eb1c1a866a3a760f8acaf9cf4efbbc8688b114eb25a299f0bdfb08019ecb3ee1a0c145fcd1011fefc9250c7035db52d4", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773129049, "uuid": "c866951a-f6e4-4a3a-af54-ad464559b18f", "value": "T17B356D680E09DB5F657070A2043A52C86F8A173F70F5F5B3EDF2AD2456AD08D73A46AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773129049, "uuid": "fcf010bd-d488-4609-a414-d4b1e05f9b8a", "value": "12288:aeStDH1EJQYApnBrStpZHU4d1velJQ+p84arCW1pzX3BNlyNpbd:AyIpnBrYpZHU4d1ejvp3W1pzX3BzYpbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773129049, "uuid": "4348b0ee-dea1-4018-87e1-2a7b90a19181", "value": 1162123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773129049, "uuid": "8647f12e-6b96-43f7-8c64-251c3db41d5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773129049, "uuid": "3cdc7a3c-3e04-485a-a99c-0bd024457d3a", "value": "d1a0yc.Ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff733528-1c47-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773123097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123097, "uuid": "ee5545a7-d092-405a-89d7-6c11a629524a", "comment": "Malware payload (Mirai)", "value": "ecb13ee55a45c97ea33928d01e4d439b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123097, "uuid": "f177fb9c-72c6-465a-87ac-eeef96c70742", "comment": "Malware payload (Mirai)", "value": "7b615e12aba119156299feaa2fc1072fd017a856d9b7fa71fe7a9f8e7f241b4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123097, "uuid": "365aef0e-93eb-4d2e-9a75-fd74201f72fe", "comment": "Malware payload (Mirai)", "value": "39d6aa88c6ea18dbc5f23fdbf8a0907addc76fab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773123097, "uuid": "9b944f86-bb23-4e51-9013-581926fdac03", "comment": "Malware payload (Mirai)", "value": "05092c7ed16530e236c68d70f0931b6888ea0048d9805d00fd6e8fa1d6cad645b230da863dae7cb279581c6c16dcc317", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773123097, "uuid": "3aac9939-b777-4732-9f1e-96d3ca7950c2", "value": "T1CA24A65E6E228F7DF668C73447F74A31AB6D23D623E1D684D1ACC1101E6438E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773123097, "uuid": "25e3b4d5-c289-4adf-840f-a02724be1fb5", "value": "3072:por0tOfTrmljJltF6wQjcpqWY1OEDkBTJ95Zij+EH9HCvt5sr/vlE:prQ7CjD6wIeqWsaSCEAv4r/dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773123097, "uuid": "8f4c860a-4dd8-4388-b8f5-7195cf3c23dc", "value": 229928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773123097, "uuid": "e3509f3c-9a49-4bd8-84bc-a0f6b8e16797", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773123097, "uuid": "04280352-7b7f-44a1-82c1-8ebd15620823", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b625372f-1c64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773135430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135430, "uuid": "b0ba86bc-75d0-4f3e-8e6f-ac92ec3c44c8", "comment": "Malware payload", "value": "215dbc252196299a328ab7038f75b27d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135430, "uuid": "8c8ce9a4-e67b-42bf-bb71-e39f50930ce7", "comment": "Malware payload", "value": "7c53914914fb8318ae43e37d08eef2b44df0478c3cd423480beda8994dd32e26", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135430, "uuid": "22cdf2ae-fb54-41da-926c-9b0a0f243e30", "comment": "Malware payload", "value": "a0f03539fa36b14e7e03816db7a67f3c1d2d5827", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773135430, "uuid": "c086b57d-1c79-44aa-a403-46647fdb1b91", "comment": "Malware payload", "value": "3f27c669746c8a99d900498b47c6435f867ad882b048b57d4bab4c7bba1a6289dc8ff0a2905ce511c4ec6f2756f7389d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773135430, "uuid": "4538a053-354c-4145-b047-7cfb32718dc4", "value": "T1D3925DB512896C79FBD1CE39AF3C7F4CADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773135430, "uuid": "d79d8d8d-d234-40fd-a7c4-f89fe2f46e0f", "value": "384:xQFcuQpWx+BL0SWL0gizsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:qF8i+BL0SI0xzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773135430, "uuid": "9dc9ccf1-5d4b-439a-a0ec-284ed824e272", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773135430, "uuid": "b3d7bf99-cc02-43b4-a24b-8bba869edcd6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773135430, "uuid": "5f0c3897-922c-421d-b3f5-58177b4a1e9a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c657e9c9-1c8b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773152207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152207, "uuid": "5c8cf30b-ab1e-445e-bae5-82e63377186d", "comment": "Malware payload (ConnectWise)", "value": "ed14b38c527349033d368ac3eb9e8e39", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152207, "uuid": "f8034b5a-56c1-4010-8dc6-e4321b95ab6c", "comment": "Malware payload (ConnectWise)", "value": "7c55968917d7614bf2c4f3b452aaefcdf7bb564d0bd263f368c1d3eb231048ff", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152207, "uuid": "892ed8d0-e585-4497-9181-78d473f31479", "comment": "Malware payload (ConnectWise)", "value": "8c08ef351d1244228340134ea9bfe9f247e09c5a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152207, "uuid": "ff9e154f-d0bf-4f3e-8491-62848cebedb0", "comment": "Malware payload (ConnectWise)", "value": "6656579b1a96579aebd6d50ca1602ff7b90f6ceea9a7db4eba159c446955dc6cf6c58ac4f7bb29435e9efc557c9e1e67", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152207, "uuid": "6c524743-7c60-48eb-842b-8b899b639874", "value": "T1AEA6232153F9D028E0F35B35EE7AD165AA32BE618E12C15F1354780E39B1E8196B373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152207, "uuid": "ccf21dc8-c8a8-4d0e-a660-cd39c9d1a52a", "value": "196608:aBn2hg5kEWmXhcfKjSVrh7vGedBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcfKjSVg:WgdEEijYDGegdEEijsgdEEijugdEEij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773152207, "uuid": "dfa37ff8-b36f-4f1e-a01e-a1157527eac3", "value": 10121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773152207, "uuid": "fab190ea-d73e-4105-9967-f5f1006de673", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152207, "uuid": "d6db1ae2-72cf-4fcd-b527-e700a3dd29af", "value": "ScreenConnect.ClientSetup.msi.1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac16c43-1c95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773156563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156563, "uuid": "1877bc26-da98-4af7-af1b-84910da4413c", "comment": "Malware payload", "value": "5048510de1e2efe1f53d48fe3da8f6bc", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156563, "uuid": "f1e96e60-ea4d-482d-ac8e-5dbe44a9f414", "comment": "Malware payload", "value": "7c7f0a3d44309546c1d6c42d7cdc60956bf3ff18f9e9ab41752a19526364942b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156563, "uuid": "5ccbf5f7-3f07-46c9-bc91-c032791f3d6e", "comment": "Malware payload", "value": "f832e3a7f61dbc779f5745157fb96d437f272ba9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773156563, "uuid": "bce2eb4b-f18a-4202-8336-ad497d244d96", "comment": "Malware payload", "value": "536f48aae81f823c8d7042b4d1b2d3f33e7c53dad132b9f853974e6c7ce26075a926739602ede2411911699db6b64d51", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773156563, "uuid": "561ebbd7-8c06-45fb-b56d-70aa8893bb7e", "value": "T1DAC32F0E44AF106257132EB49BEB556FEB3454234E64CE6073ACCEA2BFD6FA050F9194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773156563, "uuid": "f4529eb3-22aa-4b48-9a9b-e95f88342276", "value": "768:xyiljNSe5q4gOPDPl1TSxTLMmCJU8Au7siyembIC/NMmzbKAPBavEp3utbpHZ/I/:XljNSe8Knl3+vFIP+k9C5R7hCVBO7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773156563, "uuid": "0a31eb49-54ec-4fdf-85e8-2b4f9308ca24", "value": 123060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773156563, "uuid": "f1bcc16f-e56b-4c62-9a1e-9c5ddf04e411", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773156563, "uuid": "f8447a02-ba61-45ea-a0b9-f5b823b6deed", "value": "User_Archive_Raw_3885.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3b936f-1c4b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773124490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773124490, "uuid": "ca8fc4ce-70b3-474a-b7ec-90070299d849", "comment": "Malware payload", "value": "b877be25cd9a874c26ccbe39828d9342", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773124490, "uuid": "64d30c7a-f63f-4b87-929d-d90818a22f31", "comment": "Malware payload", "value": "802e3a8de77a50ace30d380f9d02f0179047a7eb2768efcd5d39b16137cbef08", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773124490, "uuid": "c69c4b98-8abc-4ab8-b452-b50e366a9b19", "comment": "Malware payload", "value": "bff61ba21b8f4ba220681cba1bf721632bcff266", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773124490, "uuid": "67a84075-487b-4071-928b-2402d45be0c9", "comment": "Malware payload", "value": "ba1b905c14b07c5a6fc59a957d20de783c80256b4d53aef16f1c8b7070a2d15bf8452cbbc5dbf2f235f16f1e84696e3d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773124490, "uuid": "b000c56d-83d6-40ae-b2f0-bd2fa4202547", "value": "T1D3925CB512896C79FBD1CE399F3C7F4CADE9C2C42124A3ACBA4F39205A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773124490, "uuid": "4fb79cb7-2efe-42ee-a176-355b7d080f4d", "value": "384:TycuQpWx+BL0SWL0gbzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:Ty8i+BL0SI0AzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773124490, "uuid": "cb18768c-7ac2-4646-919e-f427902b21e6", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773124490, "uuid": "29239f39-e905-47a3-a662-1a851d843673", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773124490, "uuid": "4df1b921-9e75-4960-aeae-8bb3e1418e4d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c54e502-1c67-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1773136621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136621, "uuid": "21272232-ab75-412d-9383-3ccba6eda1d0", "comment": "Malware payload (GoToResolve)", "value": "65dbc1c8e5bb5d878d9b2aaf766cdfdf", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136621, "uuid": "5c91265d-a74d-4998-81b1-3956c0f1961f", "comment": "Malware payload (GoToResolve)", "value": "8259aa849ddd7f1dbe5d4074ae7c6b23a202732a7b3e346629201b2073c63f69", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136621, "uuid": "4b7a9877-1b65-4b67-86d6-c0b1cb352c75", "comment": "Malware payload (GoToResolve)", "value": "4a4851c3043ce9265aca443990712986737f23ee", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136621, "uuid": "44741874-b746-4da3-829c-c45675a7204b", "comment": "Malware payload (GoToResolve)", "value": "c80a1a1860eab61e4fc7b785721647aa4a6893387e5e13b384b1ca00cc405b88958c486f780c35a65eda29d1655633fe", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136621, "uuid": "f7f222af-dc47-4c39-9896-2e9cc1360007", "value": "T12F8185CBF50960314EE35AB7C66645EEAEF0444A2423145C764AC1C81B3EEBDB3C75A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136621, "uuid": "025b73de-a8d6-442d-98d0-44d3ee61f12d", "value": "48:twDJH3e23HKbmQR8Z6/cG0w0RkYrEvXmptf46ZPCFbC0QijAuk6UjgaX4XxPaSjD:tCXeU48Z6/cG0w0OyEvX6xRaHKbNUUSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773136621, "uuid": "0f235e5e-5ca5-412a-b0cb-94d5c98c8935", "value": 4147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773136621, "uuid": "6201f767-97f8-4d77-bfd1-d16eee47415e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136621, "uuid": "d9bcb426-9567-4289-acfb-a40c243f7ba4", "value": "ZoomInstallerUpdate8.3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbc2b62-1c33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773114474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773114474, "uuid": "1d4cd8ec-8633-4b51-952b-30ff25a3ef46", "comment": "Malware payload", "value": "e375f8e8461fbaa3f8a0d81edb2c7e75", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773114474, "uuid": "37f96c25-6b69-41ba-aef2-cb740be3fbc8", "comment": "Malware payload", "value": "8295ce23ecc3dd9644d14cdff63e9956782dd106270915c343955af559ef6217", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773114474, "uuid": "8e853d6e-d846-4e66-8717-9401bb3bc235", "comment": "Malware payload", "value": "3f027928d6ae67bddc8378804c4aeba1e0dc526a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773114474, "uuid": "e1129763-556e-4c34-8f46-7a24d93600f4", "comment": "Malware payload", "value": "968aba56d5fc7e3e7335c8762d99d56889aa4690eb996cdc892cd4aeaec9d610b74e26d756c9fd077fe51ca86a638b2b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773114474, "uuid": "d4886b77-b30f-4a12-8055-88436676b76d", "value": "T1D8923AB916497C34F7C1DE799E3C2F0DAEE881C42124E39CFA0F3A215E516ADD60935A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773114474, "uuid": "d7bf7090-b562-47b9-8808-dcf1b251888d", "value": "384:AEhk/xNd9xaBTfJs5P/5zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:zhC/aBTfGhzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773114474, "uuid": "3b606014-55e5-499e-867a-bd5fcb79c4c4", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773114474, "uuid": "2d61745c-8954-4b64-86f0-ad8fc295a800", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773114474, "uuid": "83e83382-ece8-4bb1-9cf4-b1ffdde2b9c9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2324ee6a-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126164, "uuid": "13815977-92dc-461a-840a-a5b6829a68ad", "comment": "Malware payload", "value": "9d793d9c445015c02e22b90615790096", "object_relation": "md5", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126164, "uuid": "8c42a054-c04a-4e54-a7ff-2775ebaa4943", "comment": "Malware payload", "value": "83dc31c54679fc521af1a4659fdd82a3669a38796c3e460e4d9f0f3f34cb2883", "object_relation": "sha256", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126164, "uuid": "fc3685f4-522a-49b9-b8d8-b97f29648547", "comment": "Malware payload", "value": "9650193991cf391b4597b942f810b56dbc652e5f", "object_relation": "sha1", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126164, "uuid": "aa59c138-7f72-4de8-b8d0-d8cf6b0591d9", "comment": "Malware payload", "value": "8a52da8e668d8545b0d2de5514b9ba2bc3aeb455d67c0491c765643e121914a158ee14c0b1fe30dd5c53acbbe6ccc659", "object_relation": "sha3-384", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126164, "uuid": "47791785-848b-4072-99e6-f49b559d3cf4", "value": "T14B32C00145042873F8255FB78204E8BDF3E1DA2BF9FE5D67170A591AACA025FB35F429", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126164, "uuid": "24e0a3ff-44d5-48ea-9874-500e8c54192d", "value": "192:QOaZpguewTSrEENKJ4YZDmnxtREiB9ijUxRm0xgzKnEMUP0qsWNeA:cZpgc+tPYZMxtRPijJ8OlMa5VeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126164, "uuid": "0a55e3cf-6a23-4928-8f1b-a6df25733008", "value": 11647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126164, "uuid": "21afc5ce-23c0-44dd-886d-fbd9a462eb3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126164, "uuid": "79fbae36-9426-4935-b4ea-829d1fcdf565", "value": "cdae573ab468b24c28a42d6078daf2da1a4b4c5657a4146ad966e2fe8340cb49.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fc8c55-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773127531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127531, "uuid": "ecdcb2d9-3104-49fa-b240-d6fb02015a27", "comment": "Malware payload (Mirai)", "value": "7337bcfe3075f0a927c71bc5d273128b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127531, "uuid": "e0cdcd7d-9d7c-4817-aa78-310bf40e4da2", "comment": "Malware payload (Mirai)", "value": "844c1f4257f757fc2973806200abf65fa5fcb882f1c6a394c880ac0fe3dae941", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127531, "uuid": "9a31489e-4352-4d9b-af55-72a538b33967", "comment": "Malware payload (Mirai)", "value": "400732935df467f71c9d14cb1c8b1a121999b2d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127531, "uuid": "4e01c3a4-22f2-4215-8a76-519396d85ae7", "comment": "Malware payload (Mirai)", "value": "350b424f802ee9e33b1d442367b4bf4f5c7194e353592f00c862346aed9cfb2bfeb4daa73531bae2702479a100e834ab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127531, "uuid": "367040eb-5052-40c4-b50c-5e39556f1c95", "value": "T13892EC54FC42BFD82AFE51DB23E0694010488727B8543D1A3A7EE38F6FB36E94D54261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127531, "uuid": "7f6a599a-1227-44f1-b97d-96501751b731", "value": "384:1ucv7XtfUvKtRNDb5etPYtVtv5Zt5MD7tVtv5Zt5tRxD3hVu:4cv7XtfUvKtRNDb5etPYtVtv5Zt5W7tA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127531, "uuid": "032d0c9a-6f71-4070-9ae0-5199fd7b0f49", "value": 20794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127531, "uuid": "4360ab9f-30f3-476a-a685-a8d31461f77a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127531, "uuid": "2ca9f56e-3160-44ab-a9c6-bc4533f3f7bc", "value": "sc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83749a77-1c93-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773155531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155531, "uuid": "c1106176-956b-4b4d-a912-202d2b6448f7", "comment": "Malware payload (RemcosRAT)", "value": "0171b5030ac36251c57a9679a47828df", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155531, "uuid": "af6fa853-cfe6-42cd-95e0-8131d96db6d1", "comment": "Malware payload (RemcosRAT)", "value": "84e26c86f51eb57df53130ef7dcdd79a8eaa4763168521fda74aa08669122e81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155531, "uuid": "6065b1c2-a8bd-4619-b363-5bdc6ebb86db", "comment": "Malware payload (RemcosRAT)", "value": "819e243bb9331cc98edc90382e9e03ab622dca8a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155531, "uuid": "18e3c162-c2df-44b1-bbf5-3eb8b31176ff", "comment": "Malware payload (RemcosRAT)", "value": "cd76b50e8a4219fec4f0a2700a168b0fa1b4210239d02e790b716f83a72911607310f6c40afb816c740afbd5de3dfc2c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155531, "uuid": "1db99335-a54a-4cdf-9251-8fed74a4b93d", "value": "T10A461A1655E4CE8391BA098DC50BF7F20C46E4FF5EB4F782B25C5D5B199888CA3E8E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155531, "uuid": "d37f91bb-5759-4744-be09-9e2f3b4d0e9b", "value": "98304:kPQrj7c6yUr7l+NLxylRvwjPGVWu4KGe1lluupM5RlexVirEi00MJsG/V2v9Ym1q:TrjAHUcNF04W57p0MJV/pm1BZj94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155531, "uuid": "94fd7a72-d7ad-496f-98e3-69c89e3b73d6", "value": 5758971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155531, "uuid": "97770537-756e-4f86-9b81-c00b5741a042", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155531, "uuid": "a835d5cc-ef3a-4a3d-a533-a8783f847daa", "value": "Request_for_Quotation_19008_Trust_Marine_Management_Trading_Limited.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e636eae-1cc3-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773176112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176112, "uuid": "57399cb6-db6f-482b-96a6-f13d967b9ce7", "comment": "Malware payload (njrat)", "value": "25d0f0ced50afbc7da5fe18c0658345a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176112, "uuid": "674a0446-c7e5-4360-bcb6-a3749fde5e35", "comment": "Malware payload (njrat)", "value": "852a844b0f8c5807d32842a7708f209be148a540f5503f5a25308dc19da1b5b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176112, "uuid": "d03078fb-aef3-4e16-943e-78bb2c38d5b2", "comment": "Malware payload (njrat)", "value": "ac523e11b5066efd16e28b87d53771725ca144cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176112, "uuid": "d111e9fe-71a6-447a-976c-2f96820074e4", "comment": "Malware payload (njrat)", "value": "5dadc880869430d49b258c4fff4cc5443f8ca535a253f00f04c1bc62823a1e60358a431327105a5a5a1be2b76621877f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176112, "uuid": "c4f74136-bd37-410d-8096-69863030f527", "value": "T123F3295AB78A4B24D57C0DB0D0FB963003F18A835A32E79A2FC455DE8E023E65E4D7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176112, "uuid": "eac03af7-b08f-4cb4-9148-098bb6f8590e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176112, "uuid": "154736cf-216c-4b48-8c61-235de114fb5c", "value": "3072:JldDM/hnm5sgDYkyQzK1Wbm9vu29OEzi9GAEHyhbBQzhbYJ11HGNVqD:3dHUdQzsrvu2AciySbBQNbUGNVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773176112, "uuid": "3d90983f-487a-4be7-a2de-e7a5d650bad6", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773176112, "uuid": "bd65b33a-fc04-49e9-8e1d-a5013bf436b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176112, "uuid": "95fa7736-d8e2-4d79-b578-c95590255ab9", "value": "NewClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd410010-1c69-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773137616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137616, "uuid": "1e95dd91-fdbb-41ae-9d68-12cf2e4bd38a", "comment": "Malware payload (GuLoader)", "value": "e2d50816fde5ab6748051d1266c6bb97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137616, "uuid": "7013ab21-5252-4000-9471-4bdb1211853f", "comment": "Malware payload (GuLoader)", "value": "85bb77ab50e307210eac33967c69a15d31f38277ba82a88020eda2c972100f19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137616, "uuid": "056ec398-2769-46ef-a69c-8f659e21d44d", "comment": "Malware payload (GuLoader)", "value": "ade37c2ac5116a6d74a8c0bfa74774b91e253510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137616, "uuid": "f7aa58f3-5b6e-4731-a3d2-01c065e502db", "comment": "Malware payload (GuLoader)", "value": "9e9919b0fe85e39d2af6236917150ace09f023a43bbe4d52ba4e5afec1a357c96b38ebcf0f6671d887fbf28aea018792", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137616, "uuid": "d7cd9f60-88c2-404d-93d6-d57a31caac1c", "value": "T133341224B3A0D433D8664BB01EB6D6BB65E6CD2020C9E76773806B75BE363C6C80B5D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137616, "uuid": "c83cdf8f-559c-48e7-8162-6b75eb1a4eb7", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137616, "uuid": "0793345b-7df6-4eff-9db1-c0b7bc5f6d90", "value": "6144:0MBaO5bpVKoCIPx/S2JH5O8aFMZ/SDMmF0XTpVeaU:xLbGoCINSIxc/OFVeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773137616, "uuid": "c8eb8adc-9fbf-4476-abd0-36245f39eaf2", "value": 242586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773137616, "uuid": "085d0620-7d2c-40c3-9b15-7ba5f5bcb1b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137616, "uuid": "2521a5a0-8bd7-4bee-b833-c528e73fd955", "value": "QTZ250722902_SPECIFICATION.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ce10e0-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773127405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127405, "uuid": "1d7386ee-3ec9-4761-ba73-4e6c0b3734dc", "comment": "Malware payload", "value": "e902c8f04e4a1de3485c1f6e2a702c46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127405, "uuid": "99e69127-a63b-4bfc-b36f-da2119c8a18e", "comment": "Malware payload", "value": "8696f4e6b41b7592ea9f4f1e3391284a53349d541c08caba7b32e477ce162809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127405, "uuid": "a2fa98c6-c076-43d4-8668-d49d1a1e7215", "comment": "Malware payload", "value": "438b5c48d36ed79c7be365f65ade941caab7d969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127405, "uuid": "d842bdb1-162e-4341-a5cc-d9bba208513b", "comment": "Malware payload", "value": "6029a6d7dff5f8bebf2ae97aa1490f97b258f7f8c016e8ea39a632dd392f8cd64a676ace99ef6bca41204833c5e45617", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127405, "uuid": "fe45c157-6603-422b-9ddb-0ec37c18ddd9", "value": "T1DB8512A031EDCA53C11982B90A71E1725F751C6BA401D2C6BEDD6EEBBFE2F010946B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127405, "uuid": "1d0fa103-dfcb-4261-bc66-3f400c5cd089", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127405, "uuid": "b8e52b53-6be8-451d-afd2-774a3fb484cf", "value": "49152:PlVtVPwrU/YsEznNhWG7CcoiSszyzQrSeuiOoOyV:fwr/bhhZixCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127405, "uuid": "a58e1f95-5208-4549-97fd-415a48ed7330", "value": 1781760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127405, "uuid": "fbdb88b2-7537-4a2e-88e3-53bf9380ee5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127405, "uuid": "50ac65c2-3302-43bb-ab3e-11c730213619", "value": "SecuriteInfo.com.Trojan.PWS.Siggen5.32333.17769.12347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2d89a9-1c43-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773121267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773121267, "uuid": "66241d9f-65a8-4662-8d7b-c34033130457", "comment": "Malware payload (Mirai)", "value": "c3818cd40747627427d6443fefa7b038", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773121267, "uuid": "6ed7f21c-586c-4b47-b43b-eb1e8f933e06", "comment": "Malware payload (Mirai)", "value": "8751287724a8d1f223292ff0df6bab74a9f96e96cca50a8f1dfe4b7d944d289d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773121267, "uuid": "a0d6e73b-e0f6-497e-8b9b-a67708e61a48", "comment": "Malware payload (Mirai)", "value": "156f2e6e95a8e7eeea1df42fb5281245e3985173", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773121267, "uuid": "77e31989-4907-46c0-b942-dffa80df3d70", "comment": "Malware payload (Mirai)", "value": "5df92b00faeaa122f3aefeb517f0a1a5c39a92ae440894a9331f8ce5bf55d73fde31183abdde7cbf22df63f61eee1356", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773121267, "uuid": "932f4c4c-5e61-4fea-a997-d387a7f555ed", "value": "T183D3185ABC819B15D5D626BEFE5E528933531B6CE3EE7202DE145B2027CA91B0F7B002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773121267, "uuid": "8dc8311a-21d5-4446-8171-d2fa19ad0d97", "value": "3072:OBtK45GSaTVI6QgFJrbRymCRT4aDpJImIbURAjBWoOIooLW:etK45GPVI6QgF1dy3x4aDpJImIbEAjBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773121267, "uuid": "23a9fbb7-6879-414c-a34e-4edba0480dbe", "value": 130236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773121267, "uuid": "5070e852-d368-47a9-b6d1-4606dc3c0be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773121267, "uuid": "ab73dc3d-0b64-40c2-a33b-43f9032cbf22", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34771a1e-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146379, "uuid": "6c2a0a5c-48d4-4886-881b-f5d317bd6a41", "comment": "Malware payload (Mirai)", "value": "66de07961abf651e0234e1b34f0537eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsl", "colour": "#B28E96", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146379, "uuid": "eef8990a-e004-49bc-8fda-20b1e642c9ad", "comment": "Malware payload (Mirai)", "value": "883a4c1b2714f4a00e7e9ab32e33771b6410434caa49228379266912d6659946", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsl", "colour": "#B28E96", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146379, "uuid": "437b3941-7b1c-4334-bdff-a233cf27478f", "comment": "Malware payload (Mirai)", "value": "a15d927c0856195e553692d227489b4f670fa56e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsl", "colour": "#B28E96", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146379, "uuid": "9dc08f58-7a26-45a7-91c2-b70a6efe7e08", "comment": "Malware payload (Mirai)", "value": "ffc371b9d4981dc50f102f92ea62af2d6cfefb2c40c33994a0fdd7b2e06bb86276fef04ebc4cf2a6bd21c44e6d910026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsl", "colour": "#B28E96", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146379, "uuid": "81c69d8d-7161-4db9-9642-673c671b482d", "value": "T13DC3F909EB614FFBE86FCD3746E90B0529CC551722A83B7A3574D828F64B54B4AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146379, "uuid": "25ed756e-5f97-4fe7-8d6c-749f0fa4a267", "value": "1536:xNZqs2lYRB1f+g6z3jL3pFLUeXkb3+YEwIvF2E+7hQqw5HxZp+/praXbr2F1lIl9:jZqs2lY56TXHMmqw1xi/h+2bmFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146379, "uuid": "54bf8c00-bd1d-4e6d-a5d3-30dda558cab8", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146379, "uuid": "e1a9cf52-9a95-40c1-ab2e-08986d2bfb9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146379, "uuid": "ee9b1a20-458c-4f55-ad58-dab6b7993d6b", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2276f5bb-1c89-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1773151073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151073, "uuid": "f5421920-2481-41c2-b1e5-a49c6474d700", "comment": "Malware payload (ChromElevator)", "value": "de203b2a42291fd6b174191324449786", "object_relation": "md5", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151073, "uuid": "43204d77-352b-467f-8aed-f40d091c4db5", "comment": "Malware payload (ChromElevator)", "value": "8d8744f3539d740e4da5790cefaa5e22b20a1fcdfddaedbbec7a4e53afbcf506", "object_relation": "sha256", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151073, "uuid": "e0ac0fac-1733-42d7-806c-559771ed57fe", "comment": "Malware payload (ChromElevator)", "value": "9ce142ee7384655eff2675fdc1adb3bc3c86705f", "object_relation": "sha1", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151073, "uuid": "7a602e65-bf0b-40d5-a62b-5b2601ff5e8d", "comment": "Malware payload (ChromElevator)", "value": "19dff22f86f3123def134e0d0da9e8cc4f5123ef6db1a8ea37334ee132074b850e8c7a10083d2b108a2b6493caa28264", "object_relation": "sha3-384", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151073, "uuid": "18da0535-e3d5-42fa-b5c8-178ed1854245", "value": "T1DCC5E11AE36401FCD06BC2B9CA528A13EBB2B845133096DF57E58E963F17B705A3DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151073, "uuid": "2f4b7e79-03b5-4601-868b-4c6eaebbf8d2", "value": "37c1fda3eacb25e39fbd1596b6aa2a4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151073, "uuid": "c18d9ee3-7bfa-48a9-8b0a-a83fbdc8e748", "value": "49152:ir06VHDXRuYo3r50V0xTJUbaNnqZFjM8x:iZ0YgfTJ/8jMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773151073, "uuid": "d2e2835a-581b-420d-a1e0-99a9c0b39d26", "value": 2541056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773151073, "uuid": "0acc6dc7-4cde-4617-a8e8-c3d1a252f67c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151073, "uuid": "61be382f-e489-44a7-abd7-c5233442ea6e", "value": "8d8744f3539d740e4da5790cefaa5e22b20a1fcdfddaedbbec7a4e53afbcf506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d397f1-1c90-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1773154376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154376, "uuid": "3f454389-af82-4c78-81d9-e2b9507b6eeb", "comment": "Malware payload (DattoRMM)", "value": "74bcee8852b7f5018a4f59eb5b6fd7c1", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154376, "uuid": "b37054bf-6335-4659-9263-1315d49ecb67", "comment": "Malware payload (DattoRMM)", "value": "8f0248e222a4c9a1ef487b21fd6deb3c017c7f45fb446898ceba09502ebd2769", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154376, "uuid": "01e703a0-a042-4720-9cf6-2a62f0506887", "comment": "Malware payload (DattoRMM)", "value": "4c0c6ce6d8f362af3fd4572fa67d2cec8fdf7697", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154376, "uuid": "db7d2932-91f4-4276-987e-5a3dfbfe90ef", "comment": "Malware payload (DattoRMM)", "value": "650ac6ed557e8bd1a1ff133e802083e23b367446acb7ecf85b29c1822041fd8564c83b772f4af771958a0a5920a1c7fd", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154376, "uuid": "2e8a43fe-5a00-4ab3-9530-e109260ff241", "value": "T185B63313C57BCCF4CA234678D6E10A46BB4A058A9C5AB8D4F584633E55D34ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154376, "uuid": "c43a4b77-e0b6-4d8a-bfa6-3a64c17240a7", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154376, "uuid": "b7e62383-ac36-40be-8dcf-80b18b3399b5", "value": "196608:jaZk+wp0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8m:Dnp04RT9R4PkE7Ap84p29qIT0Z6rXr8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773154376, "uuid": "dcf0d17d-fab3-49ba-95cf-8758c028c52d", "value": 11055784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773154376, "uuid": "842cbcbe-3892-402f-b9ad-81d510656c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154376, "uuid": "2b8bcf18-50cb-4333-969c-4ee1ffb5f8be", "value": "GoogleMeet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f4dbf0-1c91-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773154641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154641, "uuid": "c8c0c308-8319-483e-8be8-ce1626469815", "comment": "Malware payload (AsyncRAT)", "value": "7aadc64fa09e43ae6f8cba189838bcfd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154641, "uuid": "913f7693-1f25-4adb-a2c3-c4b21243d3bc", "comment": "Malware payload (AsyncRAT)", "value": "8f1cd9f9d91183640475d4226a734868375f5b6cc15d8ed861ce711a589e54c7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154641, "uuid": "2c270d82-66f6-4e8e-b33e-de40230c390c", "comment": "Malware payload (AsyncRAT)", "value": "1d0654df52e027601dda93ea706db8fe3b02f524", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154641, "uuid": "1eb73ece-a167-4c34-82f6-ca13bfef787a", "comment": "Malware payload (AsyncRAT)", "value": "db0602d77c4ec0970672162f85e703f8fd0465bceec6edc7fdf23425c322abd777efdb73a790934ab51f25a534d181d2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154641, "uuid": "120c9993-dd06-49b4-9f75-4b3f48d10d31", "value": "T1F6E23A4877944712DAFEAFF12DF3620612709517D823EF6E0CE485EA2B67AC087417E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154641, "uuid": "c2c1d8c0-4db9-4b95-a32a-f67fd71cce3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154641, "uuid": "7f685887-8c96-4ed7-a9c7-c479e40286ef", "value": "384:CEbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFObpzRApkFTBLTsOZwpGd2v99IkuisnT:bVa+vNtg+PB93Tw42pzVFE9j2OjhHb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773154641, "uuid": "657c1ffb-9e88-498c-9b80-6847cebc9dcc", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773154641, "uuid": "7e7b9750-47cd-4ee0-904b-049b18ab5283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154641, "uuid": "0cab51cf-de10-48f9-9d20-6e5c82426608", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bd1d4f-1cc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773176897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176897, "uuid": "eab051e1-23e0-4371-93fa-406173112f74", "comment": "Malware payload (Mirai)", "value": "9ae2c57561e25be0c5b40a71320e8ffe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176897, "uuid": "65213504-219a-482d-ad44-f3f56ad820c6", "comment": "Malware payload (Mirai)", "value": "9022e11457f3c00cea45af9f98fd33f7bad90c708e1d57b2e080a9e3d33f8a96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176897, "uuid": "38df75cd-004b-47c6-a6fd-b9d764b6ca1c", "comment": "Malware payload (Mirai)", "value": "1c2d90615ad41ec2557a5e39d9c2fe712ce2946a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176897, "uuid": "edc2ac4c-f7d8-4282-9356-12893cdff3cc", "comment": "Malware payload (Mirai)", "value": "4cee385da483406777108b4744ab87abedeed84c9dd948dec6eaf907f15b35ef57737978d09369e2a45a3c421eb4ec34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176897, "uuid": "f61fc101-ac74-42a9-abcb-509bdfa4f1d0", "value": "T1CFA33A86BC819A11C6C51377FA2F108D330267ADF2DE7262CD151F647BCA81F0E6B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176897, "uuid": "e41605aa-e176-4a87-b8d9-69c0fd7bda9a", "value": "1536:oNnr0vpp/rFFSHs6h/d43AtnA78bPiqimKF/yqtBiJ70q5du4ndr5nizaIdizmgN:20h9FEHztfNDbPf9waYq5M4nYg1ZmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773176897, "uuid": "9c4e121e-5e07-4d2b-91f3-22b5d831cdaf", "value": 99632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773176897, "uuid": "d1e3fda0-d756-4fcc-8708-1c043c6fca0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176897, "uuid": "93721d1c-9106-452d-a01a-2246cd8365c8", "value": "MMaaRRiiOisecTanee.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3dd4cc-1c68-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773137056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137056, "uuid": "a462cfcc-5828-4774-ae04-a9379a8bfa0f", "comment": "Malware payload (RemcosRAT)", "value": "3765da8b030dce60722ec60388440962", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137056, "uuid": "37897549-9676-49f8-8f2c-9fe0749e210f", "comment": "Malware payload (RemcosRAT)", "value": "9180484968eb47d73853596ec91f4e1d495c0dc7ed1800baa38ce88528b42b5d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137056, "uuid": "41963cf3-880a-42ee-823a-60a12a796537", "comment": "Malware payload (RemcosRAT)", "value": "c0956b165ca794f4044aa0803152e9a2e9d3e2eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137056, "uuid": "be5ed256-4455-4128-8863-5905d8adc6b9", "comment": "Malware payload (RemcosRAT)", "value": "1933b03f3539072e3e7f7b7a2dfb498990e4ee5f599f90f21a6090418bbaadce95d4e2bf677f3f33b82659674e00d24c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137056, "uuid": "8eb8fb88-fe11-4b12-9bd4-460452dc1b97", "value": "T1BDE5C08C27EF36952D6D4C09D66C5B3FF60146379229F4C684B7BE3A2752BC88213D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137056, "uuid": "53227ab3-67f6-4c4e-8471-d5173ce6e049", "value": "24576:2Tz7dmi3ctf4PYl9IT67RyQrL3R0itkrxB9sAtc0hCpCoxyyXftLOQXcPYDqN3WQ:2FcKWg67Ry6uKMT5QHPNidp8tZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773137056, "uuid": "bf2c0dca-3d02-490a-b1b5-46071473b9c0", "value": 3246779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773137056, "uuid": "f5dd7629-043b-4d22-ac4f-dfabcf96717b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137056, "uuid": "5c3591c0-3edf-4a11-922d-50b2495a7afb", "value": "Purchase Inquiry _.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b455941d-1cc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773176229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176229, "uuid": "89baaa0a-6003-4b67-aa19-70baccf57c85", "comment": "Malware payload (Mirai)", "value": "33e7c5ca68382727980e03df066c5ce5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176229, "uuid": "a7c2b4dc-b0db-4665-ae25-0584124303fb", "comment": "Malware payload (Mirai)", "value": "91d5b890b235c66127222835d6da450cbab2566a6c932307457a94964f46e306", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176229, "uuid": "01ba5014-31ce-4eb8-a5a3-d54a5d558a91", "comment": "Malware payload (Mirai)", "value": "71da1acb73c4484a6614908aa649bd3ab85e6ac6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176229, "uuid": "3639f5d6-bf5b-47e9-bcd8-30606eba66a4", "comment": "Malware payload (Mirai)", "value": "04985e15f442b4c3b6a056a77d78d31a4ae353b49192dda71dbd26f4e3a72453c6e1e95c47ec443bb657524285d0a08e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176229, "uuid": "5f706f6e-116c-4160-89ae-8b0a3eda3e2d", "value": "T1C9934A25A87A2E17C8D4A63E11F78752F2F5330E24B0C66E7D760F8EFF15680A546272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176229, "uuid": "f8ddbf91-4194-41ff-87e4-863d93050239", "value": "1536:1KFdSaiZ2vPhnKORFS5P+lSMrhJ3HWwJnV6WONiauvA/8:WNrZKl1NM9J32wJnV6WONCv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773176229, "uuid": "d180e166-8f49-472a-87ce-167435d35133", "value": 92664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773176229, "uuid": "36bb5950-25fe-4490-8118-393d1941f70e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176229, "uuid": "bd670eac-79db-4703-b5f8-a2f3de670f7c", "value": "MMaaRRiiOisecTanee.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a16a9e8-1cc9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773178681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178681, "uuid": "41d89942-6e9f-46a1-97f6-e2eb72d3fe63", "comment": "Malware payload", "value": "87f94baff83795181437980f729aa89c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178681, "uuid": "5ae8ea5d-bef8-40c5-86ab-56a01e7883c0", "comment": "Malware payload", "value": "92a254eff4ae5a3072343f65148d4b864ff60802aca0bee44a59ba0cce3af854", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178681, "uuid": "2da29b3e-b3a4-443c-ae39-73c375b51eb7", "comment": "Malware payload", "value": "56833595fe690aeb4983216f47da8b97a80d6ad8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773178681, "uuid": "5aa70e58-a8ac-43df-b5e3-45a0851f9a3b", "comment": "Malware payload", "value": "e9281fc8779e70ef7630be779474c22b2d538cc035ef7b6647ffc0d585c7a330423824d7c7bec170da96d68d2c41a16c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178681, "uuid": "de4548cb-589a-4fb9-a624-27198088f0d0", "value": "T188925CB512896C79FBD0CE399F3C7F4CADE882C42124A3ACBA4F39215A1166DCB05359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178681, "uuid": "df954d03-5661-4184-b480-197a650271c3", "value": "384:AFcuQpWx+BL0SWL0gtzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:AF8i+BL0SI0izsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773178681, "uuid": "7b70df18-9569-446f-9cdb-17cade8316b0", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773178681, "uuid": "b9da793f-c07e-4ebb-8670-db45cd6a37f6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773178681, "uuid": "9e81a99f-1261-4e75-bd19-4e9c8bafa305", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aff5bac-1cce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773180669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773180669, "uuid": "9ff29240-a86a-48f2-8acb-d1615a9b556e", "comment": "Malware payload", "value": "f35bd10f40a84a87c1a4b377b4979931", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773180669, "uuid": "cc3063ce-c54e-4f69-95a9-5d59f258665d", "comment": "Malware payload", "value": "93912c1c9872c7c6b6e11c706418bb6d87170af6635fa4c60b30672aeb1b359f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773180669, "uuid": "786ea28f-5099-4aa5-97cd-ed0dbb7d74d2", "comment": "Malware payload", "value": "3894061d39a437bc6b973df6b07c2b097c373b61", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773180669, "uuid": "1f6ce8c7-d03f-45d6-b3b6-e6d75b640b9b", "comment": "Malware payload", "value": "7cba6e5307ae0e43f284b95878736e143c9e67668d67068bb31b370f712f31a0c83ed1f5b908da71455ac42baa06441a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773180669, "uuid": "279d7bbf-3dcb-42eb-8dcf-992b45ec78fc", "value": "T1BEB6E57B229481A8CD5D813FC1978B0DF9F361BA3F36CEE3439043688A56DC59E7A560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773180669, "uuid": "20e9d88a-c5a0-4d28-9f94-d005f5cdaa64", "value": "be27ca3e2433d9854a57851ddb822150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773180669, "uuid": "a2252692-0c7d-40ee-b590-f7ea8ab28248", "value": "49152:T24+J84zmrSOJ30Fz5h/cetKxvqS9TWNKDKv+yUMCUYfwieJ7ivXdGOSsUCOYPLy:TgI2AmsvNPSKPrCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773180669, "uuid": "2e9851ef-f5c0-461b-a035-2f3680947325", "value": 10575872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773180669, "uuid": "54b2d472-eeb7-4e82-bf6d-2f405d0cf300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773180669, "uuid": "ca06c7f6-9b44-49cf-b14d-f965b429a33c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461151e2-1ca1-11f1-a769-42010a9c0008", "comment": "Malware payload (PrivateLoader)", "timestamp": 1773161441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161441, "uuid": "643619c1-3cc3-4f23-90bb-763833216a7b", "comment": "Malware payload (PrivateLoader)", "value": "3f7baed0a636ef61cb9d916d497b266a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161441, "uuid": "d1ebedd7-f988-4bd1-9565-a7d4965fe9d3", "comment": "Malware payload (PrivateLoader)", "value": "95e30af4532ebb0ee8062c05414f5827c2c0c0880c9c28612eb03fd268683f42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161441, "uuid": "2a1a7516-e150-4815-8c52-d3f667d6bcfb", "comment": "Malware payload (PrivateLoader)", "value": "e1f4e5028c9692e03dc8e8fac24c9de6d8d82c28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161441, "uuid": "2b5a493b-35c7-4bbc-8766-259b299043c5", "comment": "Malware payload (PrivateLoader)", "value": "9b49348739b514f0909458f5e1fcd2b6035377d3688b7fabf1fc9d2a81ac3b6eeb5fc98760ca9216d0a5ac04be627d50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161441, "uuid": "44f0dc4b-da2b-49bb-9c57-79746250935e", "value": "T149479D4BB2A101E4D476C038CA97C517E7B1781A577197DB22A8A6E91F33BE06E3F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161441, "uuid": "91dd1edf-9706-4f35-9d2d-39b53f1f7cac", "value": "b4bfe7170df820c5e19889fe155c5655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161441, "uuid": "633bfb89-9946-48dc-8c3b-5e5bb8c8a7fa", "value": "393216:VoYDXVCPI/99iY8pckLReKyXGGPopqTdoJsv6tWKFdu9CCADS0H:7Yxcndp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773161441, "uuid": "b4608c0b-f08c-4c4e-bbd5-b2f2cb458760", "value": 25826816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773161441, "uuid": "0a8a4a3f-beb7-4a71-a5aa-22f129e539a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161441, "uuid": "1500f7ac-e03e-465d-b774-d8f65e4879c7", "value": "PoisonX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3feb4089-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146398, "uuid": "e854633b-eac6-4be5-b5c6-a2b97a3c9a48", "comment": "Malware payload (Mirai)", "value": "3042d72c82f482cd3091b569adcfebbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_32", "colour": "#06D60E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146398, "uuid": "157168bf-d895-4cd2-b81e-2f36d15a7fcd", "comment": "Malware payload (Mirai)", "value": "96c3c7f24f4bba95ae2fb48886ea22b5505d9abde8e1f6f6c888ff64088df5c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_32", "colour": "#06D60E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146398, "uuid": "1fd74fdc-33d8-4112-83ae-12b86677b0e0", "comment": "Malware payload (Mirai)", "value": "803d2faaae77355bdb3a2aa2985d6a17e7630886", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_32", "colour": "#06D60E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146398, "uuid": "72f93fb7-6500-41b9-9298-c02e92f32b6c", "comment": "Malware payload (Mirai)", "value": "cc939fafd740e3dafc20b0a159fe89b7736abfffca2475d5182866cd7887778477a465580889b07d648a7e884704ea19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_32", "colour": "#06D60E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146398, "uuid": "b1c875b8-7ba5-4818-bc0d-3cb72bfa9b66", "value": "T196836CC6F743D4F4E8120A71217BE7318A73E53D502AEE83D769A832BD12641E75A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146398, "uuid": "5ca1f332-5841-44d9-bc31-6c982f93a4b0", "value": "1536:4NGfle9cPS4ZS962+XVE143RrFUCeWtsrswWdZa:4cEWSkS962+6143RhUCeAszD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146398, "uuid": "1aaeb369-cc1f-4c85-a9c0-044c143bef77", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146398, "uuid": "74671aad-2832-4df3-8fd9-b53f39aa2c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146398, "uuid": "55adaefc-86bf-4170-9115-7935e571da18", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cd1730-1c41-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773120365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120365, "uuid": "04b225cb-1112-4080-b7a4-2168cfb4520d", "comment": "Malware payload (Mirai)", "value": "e54bc027142634339029130953eb2172", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120365, "uuid": "5c6af128-ca2b-40ce-9dfc-c5d0dd84705b", "comment": "Malware payload (Mirai)", "value": "98a0bbcbe417481e48ddde7653ca2dce48e1ab190e94a893ac1bee08530b49b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120365, "uuid": "ca17db2f-317f-49ee-9cf0-e98a0726b80d", "comment": "Malware payload (Mirai)", "value": "c3a6103369e6d14a142cd3efdc492a690908161e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120365, "uuid": "6999e89b-04fb-4064-8006-adf5a76f64bb", "comment": "Malware payload (Mirai)", "value": "2a939dff67a911e6b4fdd43d6b5b0f3e8dcfa8b8d8f902865dcb363e9c53713aeda6acebd9963f5b5e0d19da4a1867ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120365, "uuid": "f16a4182-55fa-4ef0-974d-21260b841819", "value": "T1CFF3F745BC519B13C6C656BBFB4E42CD772A1798E2EE7203CD156F20339B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120365, "uuid": "39f6acfd-c709-46cf-a96d-0c01048a6516", "value": "3072:N7pP/6jGJJiUW6zdzgvce/tw90AzQ4ut2AD/3rYXX73:NdP/6jGJJiUnzuvce/tw90cQ4u0k/7Yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773120365, "uuid": "82239f2d-68aa-4005-89a2-18aacb2df714", "value": 168216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773120365, "uuid": "5fd50ef8-f603-4dba-9f6c-0b4038e35bca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120365, "uuid": "688d1d33-abd8-4fb6-8205-01af9448a4c2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1175507-1cc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773177136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177136, "uuid": "f03b5236-b3db-42b2-9475-96ab97a68627", "comment": "Malware payload (Mirai)", "value": "e7b151b6494fe33741a4a877a2465cbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177136, "uuid": "318ee68b-24eb-4f1e-83fe-6c0c9dbe1218", "comment": "Malware payload (Mirai)", "value": "98a0e5284dd13e2abe50ed156f756d2edc8d046e0d74673a87033587c19d6dbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177136, "uuid": "e670bac1-4385-4d05-85b2-94fcdfad08d6", "comment": "Malware payload (Mirai)", "value": "523de344bcc2550a01ed30ef82267fdbc08bb2f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177136, "uuid": "ded7a64c-97c0-4631-a9f3-16d30f517677", "comment": "Malware payload (Mirai)", "value": "78f9a29de7588a1ac3bf6982a06ec57727fe7ac01041010348ba558683954448aea6493eee655e69b8eb8a534815289e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177136, "uuid": "602d7cfd-437b-469c-9a86-4ad967015ec3", "value": "T130832A02B9C085ECC189E138077F763AC425F1BD627AB2D73BD5BF1A2C19E501B1EA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177136, "uuid": "28fd9acc-32eb-45bb-8567-872c706dd9df", "value": "1536:ATNuOfMLWePYeNnVTbBub63gbyLa47Yj0ZOYhMsQaT5iqYRKROE+MgU:cHBePDNnlNub63gbyL/Y2hMs3T5iqdRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773177136, "uuid": "ac3d8d7c-75e3-48bf-bf1d-26e6fcc15506", "value": 85248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773177136, "uuid": "c6911a9b-0a29-482a-bc72-92433a516b4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177136, "uuid": "798908ec-8c3e-4f95-a72c-cf1459fc2f51", "value": "MMaaRRiiOisecTanee.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0f141a-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773146420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146420, "uuid": "d9536564-0235-4b5b-9a1c-754016df42dd", "comment": "Malware payload (AsyncRAT)", "value": "6e7e3a2f3f3d1014e45f71201acc79da", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146420, "uuid": "9b8d6906-b930-46bf-9f1e-e3531be191a7", "comment": "Malware payload (AsyncRAT)", "value": "9970a60e3144c2478b2c4f62b38e7cb252374d9f7ef6197b0ea0e2cfbbd580de", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146420, "uuid": "e8a1e62c-99bd-41c0-8103-56589d551a9f", "comment": "Malware payload (AsyncRAT)", "value": "67cfc077af3ba421d1f62a0ef119ee524202600c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146420, "uuid": "08e1e728-5100-40ed-a475-6907c85933cf", "comment": "Malware payload (AsyncRAT)", "value": "9bc3f1a2b27a93f64464680e29235fb40d87148ed606dbdd61c2f8bdaf2d8ccd945edbb842b1f9dffa6ee794f9481ecc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146420, "uuid": "4ff36ede-e829-4bbd-8f8f-ce8150cde5fd", "value": "T145033A08B7F84A65F2FE5B7D8D7182004335FA579D22C79E1EC4508F5A63B88CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146420, "uuid": "9cea0605-2e97-44fe-aa43-84ebafb67e4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146420, "uuid": "f3d13717-c821-40d0-a083-7886f6b9a903", "value": "768:DnCIcEZ7k1Y/bTpwVRbJpB+WWP7Lh1wj+:DCl+7OY/b9wVRbR+dPwj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146420, "uuid": "7d3b0aac-cb06-4bb6-8524-0b32efa52f42", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146420, "uuid": "acafa481-74ee-4718-9c91-1218fc7ddc74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146420, "uuid": "c39a284f-fae1-4c3a-a49c-ffdb63b81217", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117422f1-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126134, "uuid": "f0dc375d-ed52-4e4d-a78b-9ce79267ca72", "comment": "Malware payload", "value": "2c253f69a3a5ad5a76169ce154ec189b", "object_relation": "md5", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126134, "uuid": "00fbf109-0c49-4220-b690-9d234edb3470", "comment": "Malware payload", "value": "997a3a1a8b0f45d2f912e274380fcffffc86b59ba9fa41d4479d7e0002cb7355", "object_relation": "sha256", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126134, "uuid": "261603c5-1fea-4c9a-ac48-6801bc7451cc", "comment": "Malware payload", "value": "7993e10f80de24771cc074bb375f8a568300f0f4", "object_relation": "sha1", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126134, "uuid": "8daca2ab-dcfc-46b6-8239-6094779e0cbd", "comment": "Malware payload", "value": "3c4ee68b826907a3b6d6b51e17b2c42e78a7f904a03b45ff685d734e7f0f4e932e234c5894d4456d90ab2e4d447526f0", "object_relation": "sha3-384", "Tag": [ { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126134, "uuid": "ee389217-27f9-4db6-bf8d-c2a2f1a26003", "value": "T14052D034B6731CD4AA5776B22A1FB1BB45B64E73AF8148035F13DC312877C8E3906880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126134, "uuid": "c87f7f37-bf22-4ebd-9c45-08b5f811e3e3", "value": "384:Gd3vMUz6aLHfbMb0MNUzN9OpV8TUo0WqtThmClsFBBVXIB:GF0Uz6aL/AIm/pKYNpNmPdVXIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126134, "uuid": "bfb38015-bbc6-4d67-ab37-5744311f40c6", "value": 13738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126134, "uuid": "d2b1fc9f-684f-4712-9421-5913034c8717", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126134, "uuid": "545afe3d-9f36-4302-8210-c841b8923776", "value": "21dd863ff9bbd15da01c1218bf92bd65eeae04a41876e10c41733b58035414c4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adea418-1cba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773172160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773172160, "uuid": "05f74f38-4110-406e-8bc3-550826c17279", "comment": "Malware payload", "value": "cce4d9bcf5eae0d70e38f205a107557c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773172160, "uuid": "34f145d0-45c0-4089-8929-715eff91ef33", "comment": "Malware payload", "value": "9a607850b33ca84a9296d280bcf10e02541d269e3723c003baba8d279b0abe15", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773172160, "uuid": "dab53eee-31ed-45e8-aa82-35a8d904d3b8", "comment": "Malware payload", "value": "a3214195e3879d98aaf718d9f0cfbaa56b008384", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773172160, "uuid": "158a547a-2c08-45fe-82b2-c244d2842364", "comment": "Malware payload", "value": "ef1cfdc3f62e5f5b2a416e653832015094e4dc7d9ba275088d67ba204d685b11485419ee7fa891f800be18e01695b667", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773172160, "uuid": "28d67003-d633-4747-a51c-f8b8c381b60a", "value": "T17517DE23F50529AADED6A134F5E3579573311A440793A32A570FE026FDE21CECA37AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773172160, "uuid": "e2fda353-9ef6-41f7-a35d-89f3cf6b8d36", "value": "393216:H8qGq94QbEU823CLvWXawKCGYEBNUQSujGw1ft196XH:c5y4cPVOOXaKEBNUN+ptc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773172160, "uuid": "5c5fa60c-2fe8-4619-b2bd-563aa4259987", "value": 18645522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773172160, "uuid": "c7fcff5b-0bd0-478a-a481-25fa6b584543", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773172160, "uuid": "b9a7384d-3341-4cb1-b99b-564daba205ed", "value": "mParivahan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2fd6a4-1c8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773152217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152217, "uuid": "fc52a76d-d294-445f-8206-ef06b25a3b85", "comment": "Malware payload", "value": "de76427e3f9c0bf016d25b49ca823db7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152217, "uuid": "9f9334b8-0103-4e28-883e-7122b0298319", "comment": "Malware payload", "value": "a0edfa97344c870ee24aa7c008cec40e85e616c21e86522b8f6fce0324b356f7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152217, "uuid": "e8da3ae6-e138-4bad-b0d4-abf6d8776f6a", "comment": "Malware payload", "value": "0731c957c58b201bfdca95c587c888370a28582b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152217, "uuid": "148cea32-7591-4e5e-85db-9cc74f31519d", "comment": "Malware payload", "value": "c1d0e44dae5ab5035e38d970b79f9c2b66aff4d7664f90021662e6311c6ef0e9369e06b18df6a33f0a9ec31180631a9e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152217, "uuid": "7fda226e-f535-4469-bea6-4d4016c57d60", "value": "T156963381F72A583FC4BB05364E6A073966265E2AC9C6D31B20543BAC787F6C90F59FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152217, "uuid": "69a286cc-7901-4046-987e-8bc4ea14d8cb", "value": "196608:YSL1zdUuh/294unRJgcHZXm8pzSMbr8uM4GHRHCxm4GqfUs7/lpgoLyStno:YSRz6uh/2ZDgcHZXLpzpnM4GHFCceM4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773152217, "uuid": "f2ed0f1b-1002-493f-ac9e-c361f72747b5", "value": 9255367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773152217, "uuid": "27b009a3-523d-4f9b-951b-91da5b2063f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152217, "uuid": "596a387c-e789-4dfa-8b91-da9da0d1a45b", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355908e6-1c29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773109873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109873, "uuid": "4fd23b8f-b749-4d54-921d-c2338f5e1b3c", "comment": "Malware payload (Mirai)", "value": "2d79cc87320995f27453eb198cade347", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109873, "uuid": "694228bf-d291-4319-85f9-c0c292ad390b", "comment": "Malware payload (Mirai)", "value": "a241a92140d741c2244e083def41d7d12dfc47b6893dc21c1a3cd99a882035fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109873, "uuid": "69cb29ad-897b-4cda-9656-8e3f55ca84f5", "comment": "Malware payload (Mirai)", "value": "b2c1f05950f75d005fb13694bee83fffa7fb7a95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109873, "uuid": "8d370d7b-4d3b-4522-b84f-7477a306f85f", "comment": "Malware payload (Mirai)", "value": "f35edd5e6c144f3d007a42398f47d6339812f9fe28f3283ae3029c176dcc0d5ca369989917c0bdba8270be6696e5e97f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109873, "uuid": "6ab603a2-5621-4d31-8713-28668e2c285b", "value": "T114F35C0BB4C094FDC8D9C2748FAEB216DA32F45D6138B61F27D46E262E4EE206F5D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109873, "uuid": "960d2ea5-49d3-452c-8582-802cb49d1e64", "value": "3072:dmwL2XBvttiU8oMyM3RoEI3skD1eHQzq9eZQiJ:3y790u/1++5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773109873, "uuid": "1cbf8e3f-0489-4d8e-be4c-2b32c587d74b", "value": 169928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773109873, "uuid": "b5e3b4a4-32eb-408b-9522-c58405b4c670", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109873, "uuid": "3d2f7048-69eb-473e-a5e5-461fa3eaa65b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b52f2a-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126193, "uuid": "73d08f2a-122c-41aa-8ec0-4969e91de9c9", "comment": "Malware payload", "value": "d26f8957554c063082c0ea2375a8acd2", "object_relation": "md5", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126193, "uuid": "92403254-1bd7-4626-a0a0-26065e2b9eb6", "comment": "Malware payload", "value": "a25a3e108f62a10caa2b736123ca7350e9dbc1b888c44e909cbd6866205ca671", "object_relation": "sha256", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126193, "uuid": "c265ad6c-6d35-47fc-a750-6238660b69dd", "comment": "Malware payload", "value": "8dbab715f4c1a4748b4dd1e4f10a996342a229d7", "object_relation": "sha1", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126193, "uuid": "a5ba829e-4bf4-4488-93b2-7be10d92cd2a", "comment": "Malware payload", "value": "b6bf9de32c9102bbcc0d50f9db87d5fb52c1bea03647cea95685d70c62f86fa7f164daf43b31dfe6c50ac746cf8ee9a6", "object_relation": "sha3-384", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126193, "uuid": "d81b897a-6a75-41b6-be3b-2927e8289789", "value": "T10682CF621F5E284BEA8D153E17C9C027E760A2C8E034531F311A6D6B5AD2FBB5E05E29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126193, "uuid": "7662db67-8633-426e-a005-af004fc67cac", "value": "384:DiUNOTVl+7JtX81gTGfe7aGPOd0nG/V8sg1oFWHzJB0BKez:yVl+7JtXevG7bmcW8BgWHdBPez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126193, "uuid": "3d398a66-c1cc-4a16-93de-e3f251984dc8", "value": 18989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126193, "uuid": "3754d577-d9f0-4346-9d21-6a6a7e3b294b", "value": "application/x-chrome-extension", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126193, "uuid": "28b71a44-cc5f-4a18-a928-8b61f2ead5f8", "value": "a25a3e108f62a10caa2b736123ca7350e9dbc1b888c44e909cbd6866205ca671.crx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e141dc-1c5e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773132849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773132849, "uuid": "14db7b9d-bcd8-4bc7-9695-ab2ea61c6557", "comment": "Malware payload", "value": "60827e41c0b2eea1cc9afe4d7415899c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773132849, "uuid": "c8fcc7ab-63ea-493e-8146-577b44d2b247", "comment": "Malware payload", "value": "a27c6b3dcfa251a95ffd8625f179ddcd20d2f9e59fc15686d5b1a43609932484", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773132849, "uuid": "3c16544d-c2a5-4e16-85ef-c232df7e4b99", "comment": "Malware payload", "value": "5934b8fb59d27697a64ca850393365e58bb36bae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773132849, "uuid": "a331b2b4-83e1-49ff-b2b2-2e0b97569227", "comment": "Malware payload", "value": "3ad106491259b11c39ae0eabee6182096885ed0a82ca16c3608760bb943a616dd2a834e03a3f962aeb08e984e43fc649", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773132849, "uuid": "358aaf91-ab55-45e1-bd8c-9372ded12cae", "value": "T184925BA916496C79BBC0DE7D9F3C7F0CADE8C1C02119A39CBA4F39714A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773132849, "uuid": "ad8fece3-55a3-448c-84f9-5ecd3b86b0ab", "value": "384:wL0M3vgRjGlsaq7KzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:w/mjf2zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773132849, "uuid": "3fe5be6e-2a0c-45cb-8d5c-13bad3249f56", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773132849, "uuid": "95b598a2-f7dd-45d9-9317-0524ccf3bbb2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773132849, "uuid": "3a49db54-5f45-4b93-b1ff-88099305d7eb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ce7387-1c4c-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1773125167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125167, "uuid": "33613e2e-48b7-4d2d-a5e2-c97e752aa5be", "comment": "Malware payload (AmateraStealer)", "value": "9141fa2d159cda2ba71eae9bf431505b", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125167, "uuid": "2522451b-b57f-4b19-9219-b9c873589a84", "comment": "Malware payload (AmateraStealer)", "value": "a39eca46f834e874975e46eeda652906ab3576735fe930cec7e284560c6145ca", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125167, "uuid": "6e363e19-f207-4f31-adc1-d896e8a96a47", "comment": "Malware payload (AmateraStealer)", "value": "fa15885d05b2cedf16ed976b75ee9bd31e8e4736", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125167, "uuid": "97f7a7fc-cf4f-4ea7-9d6d-7004d0079d07", "comment": "Malware payload (AmateraStealer)", "value": "94c2a54b79f96f6b8fdcf6d2a47ee78c864573229b7a7de835dd235c8024e70a7c6f611039e5f7c19e738cc61658bf47", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125167, "uuid": "9f9decbb-6ea5-4895-a584-58c5efd6745e", "value": "T105E57C16B288713ED4FB0B33893786605937BA617A73CC5B5BF02A0C8F355902E7E656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125167, "uuid": "7e0fa202-7795-4de6-87c8-9e63195825b6", "value": "16c8c7a62c852018ed02e453e144c998", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125167, "uuid": "5b45f91e-b383-4bb0-a823-6d2fb476de08", "value": "49152:FP/KpmZubPf2S8W2ILeWl+C1p9jWy5Snd0eigXNtNrK1DfQixQfr:9/jtYLP1Sy5E0CYf/afr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773125167, "uuid": "e73bd2af-e1be-41af-9fdb-43227e14c386", "value": 3135944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773125167, "uuid": "089b0d27-1f1c-41f3-8006-c8d334690da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125167, "uuid": "95899d54-84b0-4b62-ad87-6b595d59d5af", "value": "Win_Driver_SSL_support_v43.22.209.44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fe025f-1c8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773153975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773153975, "uuid": "9adabea5-ab72-45dd-9ed9-0e8bff7c31b4", "comment": "Malware payload", "value": "54e54786672d39f92af355de4e40932a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773153975, "uuid": "f793c02b-9221-434e-83ae-dc43a18c9d6c", "comment": "Malware payload", "value": "a3f9447ef25e40daf13235c64d4747b227c7d6dab5236a6174fc2c524bda9c7b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773153975, "uuid": "44f85e27-b067-40fe-96b3-94f71cf7b908", "comment": "Malware payload", "value": "9bacb8051a53c8835f41e2ca5fe314d2a77d3b5a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773153975, "uuid": "a11beef6-7f16-414d-9a1c-5b20013c98d7", "comment": "Malware payload", "value": "52cdf2bdad6743dad4feb64efdc6f98153c4682df08d696fcc87be115de3c46535b53f518a8f47cd2bf03e084eed8951", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773153975, "uuid": "d4e0f164-a898-4a73-bdb2-33c51caf2a1b", "value": "T1DA925DB512896C79FBD1CE39AF3C6F4CADE482C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773153975, "uuid": "ca4f34dc-832a-4fbf-b482-e19fd1901588", "value": "384:xFcuQpWx+BL0SWL0gdzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:xF8i+BL0SI06zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773153975, "uuid": "48031fee-f198-43e2-b329-f933fd5278fe", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773153975, "uuid": "b3ec9f5e-2c5c-48ce-b02d-fc7e7e790613", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773153975, "uuid": "238d7b9d-c143-4d80-9aa2-da1c302c45ad", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282c4797-1c66-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773136051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136051, "uuid": "1cd6f0c1-a1f9-4955-8ebd-236ca3249c7e", "comment": "Malware payload (Formbook)", "value": "66d37e4aacc1c2c3cf934775b856ad97", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136051, "uuid": "20c772c5-0595-4df5-91f9-0e713a77a7b0", "comment": "Malware payload (Formbook)", "value": "a4e9930a173791aa52e40ad423d7888d41112ad28897e51a229bdd9a229f514e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136051, "uuid": "ec27da38-f0d3-491b-9dbb-cc1f43caa4ff", "comment": "Malware payload (Formbook)", "value": "19c284b8fde8e697aefac886296c38d44724fb62", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136051, "uuid": "000ded19-7e51-46f9-b842-ae643ec63c56", "comment": "Malware payload (Formbook)", "value": "09027f0ef4bce5959b3be2d793b9f21cf2e84687bf43a5fd620f012c560c3f605c6ee81bbf22da5390bdb841441bb399", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136051, "uuid": "9b5c68ac-9137-4c77-ade0-aec846f87829", "value": "T1DE3533BD3272690412BD2200976CD62EF8EDFD7259921463D8BB66750EE801D4ECF7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136051, "uuid": "c8be06cb-da3a-4444-bf40-cd10b10e56c6", "value": "24576:ExcM1bDsn/ZYZP3OGWWPVeEpKlmChiABFwP7JMk1bq/rr:ExcMNQ/uZPOGQEpK4CtBFwPmae/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773136051, "uuid": "4294bbed-234a-43a7-ab1e-5eefcd2b088c", "value": 1097385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773136051, "uuid": "3ee07352-38e1-4294-8c9e-2309ba2e725f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136051, "uuid": "ceb70cbe-0158-4d7a-9f3f-4a5af544766b", "value": "AWB_2026031000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2464654-1c6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773140148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140148, "uuid": "3d21b783-45e1-42d7-aa98-dfcdf9d5cb9a", "comment": "Malware payload", "value": "5a6287dc0dfc084e1039e3358212d79f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140148, "uuid": "2815718a-fde8-4022-956c-303493f24433", "comment": "Malware payload", "value": "a68683df0f2f8dd594d5c1554f62a2fd60ac42f130c75c1a12b6c99e445649fa", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140148, "uuid": "ef04b781-0749-4a25-bcd2-b6c35f4ebced", "comment": "Malware payload", "value": "20a799038b9492e036a93933c41680e58a36a962", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140148, "uuid": "d0f1b0cc-9785-4ed6-a6c1-a6e6096f5f7f", "comment": "Malware payload", "value": "ec692606b7d9dfb68d9b14250f691b789283c7a05aacc7780207f2901f3623837fdecde42cc09bfd248a68b5ef085c60", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140148, "uuid": "048e74ed-4da1-4f3b-ab86-ce3835db97ed", "value": "T129E501217387C622C59D01B1259AEB1E1138FEB74B3540E7B7E83E6F98F40C26679B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140148, "uuid": "d649ee42-5747-40e8-9efa-38d3c9de3771", "value": "49152:Z2SX7jizoL5laI3x4Bkpu7dH/B+e/G+4BrfwgWaKx9pVtE9ift7DPlWELHd+dRKH:l0LZ+kIfwBaArtJfdBjd+Jd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773140148, "uuid": "815f3c30-d8aa-4e5c-bd42-031b5b962f75", "value": 3032064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773140148, "uuid": "56d7b6e9-f281-4c4b-95c4-7fcb3d566c3b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140148, "uuid": "55ec32c9-aef6-4c90-9cd5-f90d5559b04d", "value": "Update (3).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb60cab2-1cb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773168510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168510, "uuid": "df040548-d5ec-4456-a073-165ace4879ee", "comment": "Malware payload", "value": "2ea68f6bcacfcaf65914010f08277d0c", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168510, "uuid": "949fd4e9-cf3d-424a-9cf6-60c79a2ef2b9", "comment": "Malware payload", "value": "a6d3152fe570b575337cc35d3c07adea259e41bcfd91cfbe838e55179e766aa5", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168510, "uuid": "46a23b6b-6bc5-4a4c-94b0-c5023b7335c9", "comment": "Malware payload", "value": "b419eae26e85fea038884d877d2bc2307a53b4b4", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773168510, "uuid": "49168a7b-7d60-4d39-900c-03b5fbc97082", "comment": "Malware payload", "value": "b877656e860e897a5f604243e917799e16b6e2da2a782c4f8cebe60a50b5256785db2128b56c111945eb20de2f42f7f3", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168510, "uuid": "ab1ba744-4f50-4bf7-a69d-ac8af980250d", "value": "T19192B7166AB300216957C0BC67A79746333180079645CE2A3FEC5294DF8AEE5ADF37DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168510, "uuid": "2e1cfc71-c507-4f1b-bff7-c1bfa1a5e4cc", "value": "384:OFTAsXe7FUF6/+9MAKksb7Rssa7bWkkg1k4iPiliri/iIk4i7aiyKi8iJiyILne4:g8sXe7FUFw3OsafWkkg1kVKUO6IkV7DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773168510, "uuid": "957a6aa8-c1aa-4801-b0c5-eddbfe922321", "value": 19648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773168510, "uuid": "62a30838-0800-4a6c-abaa-c563c342b3d2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773168510, "uuid": "18346145-2075-415d-b574-feaf3b986019", "value": "fakecaptcha.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a68704-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773127804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127804, "uuid": "ce80dd78-873e-4ca7-955d-7eab6656fa63", "comment": "Malware payload", "value": "ff9fd2a4185987cba83f4f54de0d371c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127804, "uuid": "05e1a7b8-f6e1-4c95-98ab-34fa6c7fd755", "comment": "Malware payload", "value": "a82d031d99b15f8eb5a1d8cc24e55fec6d393d549edde8da9507f3cf17503ce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127804, "uuid": "d9e7d675-2e83-4bab-a07a-742960059c86", "comment": "Malware payload", "value": "b1d6fb3ce6ca24cb873dd2dddb8aa8f79a35a0f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127804, "uuid": "413784ea-c32b-4d39-8a36-d9a58ea1abdc", "comment": "Malware payload", "value": "6b6d62ff4562fcf9d35b059cfe69f66f92f8899da73e0fbdc26b4cd930e346f60fc510f853e0e5f8b2a935a0f434293c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127804, "uuid": "67166f26-7f7a-4489-8e72-57b11b1507e3", "value": "T132348C0676E558F5ED77813D89528A0AEA737C450321EAEF03E003626F536D19F3EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127804, "uuid": "c4421a0e-e1c4-49dd-80f5-7069a267b051", "value": "7c443e2d238a0838878ab4cae0571492", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127804, "uuid": "caeba54d-d999-41bd-adc0-af4e2e8dd347", "value": "3072:qv8T1OaHTjtm2TmDiqn7vGQbCvwyEgjnJpNv/iwmw+OHyKJ27zhG+qjdal:q0TzZ9TUn7vdWTEgjJrv/npX2hqBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127804, "uuid": "28d312fe-7f7e-44a2-9a75-4eb629d8ce47", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127804, "uuid": "b7433633-7843-421b-b473-3bd1371f56b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127804, "uuid": "33497dc5-78f8-4283-a67f-efa3587c5ee9", "value": "a82d031d99b15f8eb5a1d8cc24e55fec6d393d549edde8da9507f3cf17503ce1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb4eba0-1c91-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773154610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154610, "uuid": "5d986b6f-ae70-4672-a720-8dbfc55f2d92", "comment": "Malware payload (CoinMiner)", "value": "94cd8ba7c79fa2962b505fcef5e25601", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154610, "uuid": "5c24f067-f0bd-4714-a659-4983f994cc30", "comment": "Malware payload (CoinMiner)", "value": "aa56f350882ce63429c6626567487b041f06168bb60f4fc371a262eabadfa660", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154610, "uuid": "e3ef053e-24d6-4fea-836c-487f982fdc26", "comment": "Malware payload (CoinMiner)", "value": "ebfade04b81e5ac679ef7e6beff7b850e3ff6ded", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154610, "uuid": "d18de8f1-7b7c-4f49-843d-4312372bf409", "comment": "Malware payload (CoinMiner)", "value": "cda7c971853f179966a71b26481979dc0a503cb52e8d827552747482d5c0fab262e91cde72bd4ecd2c68d1f4e6a9df71", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154610, "uuid": "db383d5a-3f10-431e-9a31-f0730c6fcccf", "value": "T17CF6128BFB88A95BF4F753B245369362C0478C668B4396C76D18323C59B75D02F4ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154610, "uuid": "ef092d07-a001-4dd2-8856-e5a274d523b3", "value": "393216:QQcyma+8+4xxwHtn5Oqiunmy5YS4QaehOtb0atH2Mb:QQcahxmHh5OOT4HecyY2Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773154610, "uuid": "77d20af9-467f-47b4-8886-02b71a5feb14", "value": 15362231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773154610, "uuid": "9f1c04b7-5b5d-41b0-a226-800075437432", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154610, "uuid": "551ce038-112b-40d3-987c-870644d6b784", "value": "Test.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636e6c3a-1c91-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773154618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154618, "uuid": "f11960d8-52d0-43f7-9305-278d093ec835", "comment": "Malware payload (AsyncRAT)", "value": "41de1fa9127c6c85f7e1e2f18f87fb6a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154618, "uuid": "bdd03d5c-cb23-47ac-9cf3-d7108450145e", "comment": "Malware payload (AsyncRAT)", "value": "ab698f4886e3adbe6babe8f2a2cd1324a8c06ef68227408af2ce7b1671cf5178", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154618, "uuid": "d8456897-b8bb-44b6-9b28-cec518406887", "comment": "Malware payload (AsyncRAT)", "value": "7f3fa4e44f3e7cec918a9d37fbe69e32b9bd57ca", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154618, "uuid": "2f25f8d1-95e4-46f7-a887-e6ed1cab2014", "comment": "Malware payload (AsyncRAT)", "value": "5a2b2105d7df0b80e08ee893393ba689361266df5aa18439db3d5fa9a9cc5da7a1a928c4dd6bfc23d1c93bb9bbda5da4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154618, "uuid": "ac217737-b4b1-43ed-ac78-ba416c112f09", "value": "T1FF035C447BD48222C9FE7FFA19B3A10A4B31F5039913D78E4CD4899A1B37BD489413EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154618, "uuid": "ebdb6be5-6fe5-4206-90b9-b84ade05e6eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154618, "uuid": "2192d760-f815-4a04-aca1-d8d3518e9c25", "value": "768:mfP7EV11K5ax5lLJKuuwhS5ypufFWPa9bq6POwhkaubho:sDEV10wHVJKuuwhSQEFv9bq6POwyTdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773154618, "uuid": "3501c6f9-258b-4257-a3a0-5472dc7acb0e", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773154618, "uuid": "afdd004c-8200-4c7f-93ae-b6c18fb00e8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154618, "uuid": "e26b0d21-c1a0-4fd8-8fbe-1e4a40d38d51", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921cc79b-1c2e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773112177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773112177, "uuid": "90a1c6e9-1f1d-4520-afea-7cee9fc3d8dc", "comment": "Malware payload (Mirai)", "value": "6ec7e9e701673e6a316a2874e6c6e11a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773112177, "uuid": "b28e753e-d893-4bfd-8d84-fde6cd8ad34f", "comment": "Malware payload (Mirai)", "value": "ad5255fb2c4b8a29c47b0153d02400c59849b66496d2f5af44bebb9346238423", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773112177, "uuid": "8c12c8dd-74b3-427e-9171-703c0fcb8a50", "comment": "Malware payload (Mirai)", "value": "4a68e97a1a70628326d982de99930fa9b1f42f8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773112177, "uuid": "3be033fe-6cdd-4ef4-9431-57c702e3bc1d", "comment": "Malware payload (Mirai)", "value": "f7538c4e4d774b2d99592fb2aba1c4b063e4df6bba85fcac65ae615f56686eabe5a7a65f3c99898d37b6086c587a8cbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773112177, "uuid": "5a885a8b-2b26-4050-aca8-69e1ea96ebfb", "value": "T1FDF3F745FC518B13C6C616BBFB5E428D772A17A8E2EE3203CD156F24379B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773112177, "uuid": "0c541947-42e6-4418-b304-a0fd27cba852", "value": "3072:mN6PgZu3sReeLaZaMRHP7kNl9Yl/An40SLASFwLqzFu:msPgZssReeLzQHP7kNl9Y1An40EASKLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773112177, "uuid": "ea003677-021b-4a35-84f9-6d5b99bc475e", "value": 168152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773112177, "uuid": "0677636e-34d1-4a1f-9d07-3586b1036a42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773112177, "uuid": "9fb37ff7-df9e-42d1-90ff-2c05d099bd16", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c79eef-1cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773176733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176733, "uuid": "c03536b6-49bf-4f28-9b38-c5a843cfed04", "comment": "Malware payload (Mirai)", "value": "3ed44f92410f56eaea7f5c0cf0768508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176733, "uuid": "fb6ecbc5-69ae-4514-a883-902c59dc971e", "comment": "Malware payload (Mirai)", "value": "b0e72dd0fcbcda0198641b03148952710c8f6796dc1bb6a3b42ae6d46f1c0be1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176733, "uuid": "f8821d2c-9117-4619-be61-b67cb19d6f76", "comment": "Malware payload (Mirai)", "value": "dd992dbeaa2a2548afe460f7a17ef5b13f64bd9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773176733, "uuid": "d23ba675-9f89-4a48-bc9f-80bf0604a3d3", "comment": "Malware payload (Mirai)", "value": "405838f1ceb93afd2fa253620826c648b38af1cd5b28239ee8b504d857063ff0ed23d84a3776a4d3cd71c647a152953a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176733, "uuid": "0610fb20-bfa5-4084-9787-cd01594c013a", "value": "T1EEB3850E6E319F7DFBAC823957B78F119208379626E1D584D09CEE025E7038A741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176733, "uuid": "6275c49a-b424-4179-ba00-57bc1a2e2fe5", "value": "3072:eO0XB+BptAcBe5yXc6QAtT2xk/pxMW9Bo:+B+BpicB+yXP2xk/pxMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773176733, "uuid": "ea0fba9c-df79-4c31-841b-efae9b324055", "value": 112964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773176733, "uuid": "ee03d773-babf-4d51-b8f0-d46f44d8ae76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773176733, "uuid": "ba610cfa-20c2-4d90-afa4-db728e2ba280", "value": "MMaaRRiiOisecTanee.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdefc3b-1c67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773136674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136674, "uuid": "bed1015b-1324-4357-b195-25429b1a0dba", "comment": "Malware payload", "value": "1eb0d015780271181c2e7489e8fbfaf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136674, "uuid": "e0546a81-4341-4fc2-a71c-225b8f50afcc", "comment": "Malware payload", "value": "b128b1142179e95b7e32783c831446d8a26e9ea2de1583fbfba91cfbb63a8acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136674, "uuid": "99b087dc-e854-461f-bf17-83d08281fd56", "comment": "Malware payload", "value": "24d0fdb4954dbb2e73c73e8989a28fb431734704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136674, "uuid": "3962b005-2f2c-4c01-a8e6-8208190e5d6f", "comment": "Malware payload", "value": "b8aa6bdb84404cb81b173b953196beafd082bcad1930922a5156d9459baeb4fbeaee5b4695896b234b218ba5fc8870d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136674, "uuid": "f4ade463-3ac2-4d47-b804-c6d34c233bab", "value": "T11E77BE45A3D439A6C007CA35B614D233FAB27C638A76800E7CDEE7861F779114B6BAD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136674, "uuid": "9c71bc7c-d9fa-47ae-bedd-2b21a411ec19", "value": "57065b33498504297e6a52d3a2626093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136674, "uuid": "b77ff826-b0c4-4506-a882-6d8aa68e6f46", "value": "786432:13wNBI6zGBdZCcNQ59j4Eb4bUzJIO8Ncc6lM9hv1MoefZ:1ANBIPdZvQ7zQIJTxMxefZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773136674, "uuid": "ae7d4b25-1e19-4ed2-a63b-f1a3f64479d1", "value": 35764224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773136674, "uuid": "178dd28d-9267-4568-98c8-b1aa09fefe68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136674, "uuid": "862f2d65-08b0-460f-a0da-5c1079e2d34d", "value": "krita.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba86d66-1c8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773152189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152189, "uuid": "90562616-f990-4e7c-a490-d82a141e8265", "comment": "Malware payload", "value": "56207606f6b2734fa2287580b142f1c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152189, "uuid": "3466fc88-9f3e-460e-bafe-320518d4dfdb", "comment": "Malware payload", "value": "b492f06dbc632afcd8e6e35f55a141bdbd5e2cc07374bb6ab2ac5dd96b491c13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152189, "uuid": "d042c6f2-931d-4d90-bd8e-9115931fa62c", "comment": "Malware payload", "value": "1c84fb788584ca600ea6dd35c3b8ed71d89090af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152189, "uuid": "7014b3ea-3d4a-4c73-9e8c-731a9b5c03cd", "comment": "Malware payload", "value": "a80684a6b69cda7a1bc4287c857d0e3a7739eba9ba0fa0d5c0b35b88e2a9f935d90ce9762d611298e57ba6cb2e87fd36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152189, "uuid": "54db6865-01ca-4391-bb4e-8700c87a35ad", "value": "T170B63347D9778DF0CA330B3890D2196B3205980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152189, "uuid": "b9051f30-f016-48c7-b546-db3c45cccdeb", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152189, "uuid": "b88de43d-e5a4-4b61-88f4-f9977fba6ce9", "value": "196608:raZk+wNP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:rnQmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773152189, "uuid": "8d107c14-5b3b-47a6-9a55-2e9636177419", "value": 11056112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773152189, "uuid": "1d8afbe3-c35a-4cf2-b7bc-9d0fc67333ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152189, "uuid": "2e31d139-c767-4f95-b677-be3c36d76c5e", "value": "SOCIAL-SECURITY_DOCUMENTS_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37b1992-1c28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773109736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109736, "uuid": "3e63a4ca-3a8e-4baa-b8b4-9c6fc0013c87", "comment": "Malware payload", "value": "7862be7de009d287a888685d6d1b32d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109736, "uuid": "108b1111-9963-42f8-8a74-e45fa9fc87c9", "comment": "Malware payload", "value": "b4ba7ebb5dcb741e167d0d04121990e34f8676dae2fff4eb5515ce474dcb4ff5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109736, "uuid": "04cf5158-76ae-4e9a-93b7-3807e6b55f87", "comment": "Malware payload", "value": "bb8f4e6b93e88eb941b301eac559fa8c183121d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109736, "uuid": "f4660b1c-b0a6-475e-910e-9755a4ffd55d", "comment": "Malware payload", "value": "6eed5af506dfb41b6e5c7b7753a74a630c863e6f5cd62254081cb79351866012686e19caedca991504a5bc73e3e5023c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109736, "uuid": "a47be793-1553-4925-b8b0-8baeb98e0323", "value": "T1F724B75E6E228F7EF268C73447F74A249B5D23D627E1D684D1ACC1141F2438E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109736, "uuid": "6751b8f1-e597-4dc6-a060-47cbfd8d31d8", "value": "3072:/1sEUENRXWhERhxB/WYGLdTuzEodV+whPnx/6gX0rD2U7yrju/WeHn:/cYRqE3z/WhdTsF/x/zSD2Bju/jHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773109736, "uuid": "b50d92f9-1227-4d02-ac57-c0464d273e66", "value": 228748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773109736, "uuid": "d9856677-c579-4826-bf10-ab7372ffc058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109736, "uuid": "a824d38b-4e2a-4fdd-9def-4c296d7d7456", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8a9cf9-1c5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773131013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131013, "uuid": "6ece9892-827b-4a99-9fab-3d56e6214d6d", "comment": "Malware payload", "value": "cddfe211902e72c8ea77d3837742c7b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131013, "uuid": "d7757434-2611-44b2-8950-68827f73f124", "comment": "Malware payload", "value": "b4c08722442b890a0219b005c47e7ebd0b45e9b54ff196d8c5e4f50b0f38fa80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131013, "uuid": "94e36bef-ccd2-4c98-918e-a78eeb3cd2f4", "comment": "Malware payload", "value": "dec1b713df76865cd2f1ae0e66c8ea8ddfc90d1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131013, "uuid": "40767299-5a1c-46ee-8ed2-44bdf5ece0ff", "comment": "Malware payload", "value": "58bcd880cf20280f6ed70d51636621b4caca1c35a65085b1e7a3c8f7e706b73dcfe61af791031d8d92ba40b37393aa4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131013, "uuid": "758d615e-75ed-47a1-b8f6-f65a11e7d0a1", "value": "T1AFB72256E2F900E8E5BAC0B8C6575617F7B1345917309BEB52A48A692F33FE06E3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131013, "uuid": "e4a04bdf-3b61-4e09-a84a-b3150461b6c3", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131013, "uuid": "51a6d773-66f4-403d-a810-4451b10fd8cb", "value": "1572864:ds/QVXgGSC5NOJfu4lYt5xg6Jf/r06fWGzBNT:dPVQtlz2DTJ46fP3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773131013, "uuid": "c4a3f86d-b9d7-4ce3-aea0-bb2cc1b839e4", "value": 52287344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773131013, "uuid": "1bc4c61e-f534-41f0-ae2e-7e4fc9295436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131013, "uuid": "5bdeec1f-0271-4019-8d6c-e51714cb6929", "value": "Supernova.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b357108c-1c80-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1773147451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147451, "uuid": "e2915c40-4000-459e-bdf5-1a82407d15fe", "comment": "Malware payload (Stealc)", "value": "7e3872fa6c891833c74d08f65a67a537", "object_relation": "md5", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147451, "uuid": "efe04dec-e041-4bba-a28d-d9c4371ac86f", "comment": "Malware payload (Stealc)", "value": "b51b24c1c572fbfdae34b94d29fc9c7e43b74c2e04ef854ef3a33f07779bfda4", "object_relation": "sha256", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147451, "uuid": "22118382-ba0d-4ae3-9855-ed624b9d9f1c", "comment": "Malware payload (Stealc)", "value": "4ad0d328a1742f5738d73c4bde2fc864df51f6ed", "object_relation": "sha1", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147451, "uuid": "4d709a38-7dd9-43f5-9ca6-4bfe6542aac6", "comment": "Malware payload (Stealc)", "value": "4d6c64dfaaa9eb26301cafc6ce439b06c7f8e3216510afbbac562b5f7fa4e4f45ce0349a2e7e66d2550180fd36e15cfa", "object_relation": "sha3-384", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147451, "uuid": "76504119-1ced-425c-9e73-c407de733315", "value": "T12541180E038A8986FCBD99F8430A4BAA0BD6D1B16C46F31397A8E51984531D19E8C4AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147451, "uuid": "5c8352e5-8b2c-4ff2-a9be-98995b633edd", "value": "48:9hhq1GEKvBzXRlQ1aPW/6ktFhdq/RExhFsVNr33J:tnvBVK1H/6qFhdbxhFEbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773147451, "uuid": "a86acfb4-4ecd-4740-a0c1-51843ec9cdca", "value": 2048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773147451, "uuid": "dc3ec3e4-8aac-49fc-96db-b586c95d4c5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147451, "uuid": "bd8f439d-6606-4aab-9edb-c9249d5e6635", "value": "photo-815747796.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c8e0d4-1c89-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1773151163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151163, "uuid": "d08001be-5dbe-432d-8a6c-6fa4a351c89f", "comment": "Malware payload (ChromElevator)", "value": "105d69f1380c6a089b778b97ef75c4d1", "object_relation": "md5", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151163, "uuid": "710b1905-84ec-4af6-8ef8-8615b4172aae", "comment": "Malware payload (ChromElevator)", "value": "b564a5ca32d0228e3679f198e9f04efcfdbf8071c896623991550dc8b87dc3fd", "object_relation": "sha256", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151163, "uuid": "eddc74b9-a308-4734-b37e-cae721de4c15", "comment": "Malware payload (ChromElevator)", "value": "3006249398a592ad6e5244303d777c4812591c49", "object_relation": "sha1", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773151163, "uuid": "6cd50380-7055-4622-aa3a-c538b5bd982f", "comment": "Malware payload (ChromElevator)", "value": "1400c348bad996af230a7b978781826ac13ed3b40341ddc8c995f926096b288dc204948b76e08c21e6aeef2d578d5325", "object_relation": "sha3-384", "Tag": [ { "name": "45-93-20-61", "colour": "#B04266", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151163, "uuid": "fa077886-1bfc-400e-89ae-c8a94d2a4ab5", "value": "T170C5E11AE36401FCD06BC2B9CA528A13EBB2B845133096DF57E58E963F17B705A3DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151163, "uuid": "66b7fe6f-2259-47d4-8873-7658c722eedf", "value": "37c1fda3eacb25e39fbd1596b6aa2a4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151163, "uuid": "945df610-91a7-4bdc-8416-9e9617b1b0f0", "value": "49152:FrY6VHDXRuYo3r50V0xSJUbaNnqZFjM8R:Fl0YgfSJ/8jMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773151163, "uuid": "3e2c32cb-4e20-42eb-9f62-67fce03e8102", "value": 2541056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773151163, "uuid": "4a19f8f6-c57a-4620-bc16-f91158639993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773151163, "uuid": "180fb7a7-3f42-409c-93ba-856abe8f5404", "value": "b564a5ca32d0228e3679f198e9f04efcfdbf8071c896623991550dc8b87dc3fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45be885-1c6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773140205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140205, "uuid": "348e5c8e-3960-4ab1-8917-3e67d53f9aa7", "comment": "Malware payload", "value": "ae0a92e7ea202399dfb6b6e6c50d79c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140205, "uuid": "2e78f67b-de79-4936-ba14-c080bf4d6efa", "comment": "Malware payload", "value": "b6017c2f4fa83c28bcee7ec80e7c06f67b02835b61fa51a21cc5b6915352830c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140205, "uuid": "feffacf1-6388-4371-a824-9749b3459f2f", "comment": "Malware payload", "value": "e441c9cf5c76539d2f5cb8460932c7122dbd5595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140205, "uuid": "636f68af-445a-4df3-bae8-d3a0726b4046", "comment": "Malware payload", "value": "3adec61573aa00f314369bea0aceee9e58905bf24ac93cf2f3a8fc14011b2d2ac30f43b174961b75883c73784b340fd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140205, "uuid": "e25b41c7-8620-4106-97cf-78977610cda7", "value": "T11F64C207EB992A57E82E4B3480FA0B06F736F424371B878F0114767DBD9B3C56E25299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140205, "uuid": "aeb9f582-1895-40b8-aa61-0aa9dec5eda0", "value": "338888d33faf3d11abed4461126e3456", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140205, "uuid": "e045caf2-b8f6-4096-9c3b-fb980d3f0052", "value": "3072:NxRjmvLD8YxAaTJmyNPEXaohmlRq7Xp1OnHfZzD2ZsymQ7YcYum3TpXP5gE5LgIY:GjxhTIBbhGRq7XpYt2n7JYzyE1WalM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773140205, "uuid": "7c76c22b-4f30-40af-9514-fce548951c61", "value": 314440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773140205, "uuid": "09408a57-8250-4aa8-b65a-257e4b7dc0b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140205, "uuid": "dbc53a00-0cf5-4725-81a3-d80df2845c38", "value": "b6017c2f4fa83c28bcee7ec80e7c06f67b02835b61fa51a21cc5b6915352830c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9603187b-1c68-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773137094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137094, "uuid": "1d9a4865-31d3-401b-a1a3-ce54a5a2ee80", "comment": "Malware payload (Formbook)", "value": "bd0f15e17d87804815e6eb1848bb63a0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137094, "uuid": "2027f934-98bd-40c8-abaf-bb09987101da", "comment": "Malware payload (Formbook)", "value": "bade048fe2950223aa3d8d6ba376433e8e8040384a831c04345e657c70f30190", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137094, "uuid": "5789c389-191f-4c8b-893c-d03dc4426b0c", "comment": "Malware payload (Formbook)", "value": "81a0b550da746aed49d55af40c82df95018239f0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137094, "uuid": "997bc1fb-4b98-46e8-bc67-02544ca650ca", "comment": "Malware payload (Formbook)", "value": "50434f47053d1b78959638365c96d86ba404813006c3baaafe4b5493691df491935740f38c705d2be3f463f2c37981f3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137094, "uuid": "634a7dc2-cd6b-45f2-a698-dfd92f1fa47b", "value": "T16795B0458DC13F8789588809E6FE677F6333B5CB904EE94EAD02B550EB871247A23DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137094, "uuid": "87d3caf2-3e7a-4e8d-be37-58e5f05bf2fe", "value": "24576:aLLuAC/7qkdGYNTMdX7O4tHASPHz9fa+iRHuL3M6puuO92NpcnKLX4h+/k2jA+mR:YLuAkZkOod/zNp1XpkhDZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773137094, "uuid": "221905dc-c2f8-463d-aedb-8e0b485f9163", "value": 2003574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773137094, "uuid": "eccf771e-7c1f-4cfc-bc40-9d5e8baf901a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137094, "uuid": "7efed0ac-08ec-48a6-87ce-42b758e762cb", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125f7307-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773127424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127424, "uuid": "d18580dc-5dcf-4b45-aece-67aff98e32aa", "comment": "Malware payload (Mirai)", "value": "f1b254281bd75db6bc729cb224db01f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127424, "uuid": "84807c29-52cc-45ca-9092-1c23df399bc8", "comment": "Malware payload (Mirai)", "value": "bae44baf1fe537feaf4dd474eff8dc6df8b9fc0ac10ba75ab0ad3a2a822fe25f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127424, "uuid": "178159dc-d532-4d99-a7d8-f1b86fe21e27", "comment": "Malware payload (Mirai)", "value": "d505af5c7645e0370911b2cce798bf96350cca81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127424, "uuid": "c981d8fe-2d49-43f0-8fb8-e7659db75765", "comment": "Malware payload (Mirai)", "value": "f842550bf15eb22b7c6e712256745da375b43859d0cbf5c6ecdd7ea311356a118ec53fb51162c730677a01beaed6f30b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127424, "uuid": "df5f4012-8b2d-4e63-a14e-e1ffefc0bdc0", "value": "T1BEE4AF41330D3EAEE2B2793EC0C10B167E28AF5055832F1751E4B61A69735AB2F7D6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127424, "uuid": "9629c2f3-ebd4-4826-b738-e4dfa53e87a5", "value": "12288:qFwqw3dBSzWA7QtTBXqXaQ9COfiP7BEwxXpsNgoMS4hVdv:Nqw3dQ7QpBXq3NfsIzoV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127424, "uuid": "09618927-063c-46c9-ac39-8f764cfab94f", "value": 657880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127424, "uuid": "3f6f630f-2e89-4763-8625-6b432e0bc98b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127424, "uuid": "919d0ceb-e96b-427a-9c5a-b47c9000c3f2", "value": "yakuza.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43aa70a6-1c99-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773158001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773158001, "uuid": "5afad02d-0c2b-4909-a9aa-d1112b2cf56c", "comment": "Malware payload (Mirai)", "value": "d9fc7a394f5d0723043139b90cc04f04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773158001, "uuid": "5df7f1ed-aa8e-4970-981c-87b55ac1d9e5", "comment": "Malware payload (Mirai)", "value": "bb2f0788e93f795b141cc5701199d865f2c4a39b27b8a3675316df34b4468ff5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773158001, "uuid": "636fb0bb-960e-4d8e-8b4c-f66fcec1c5c0", "comment": "Malware payload (Mirai)", "value": "fe99b66f7424905b9129b244db74388a51467705", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773158001, "uuid": "571cc0ea-01c9-4f10-9b40-4c86b9fa7f2f", "comment": "Malware payload (Mirai)", "value": "7a296caa89e1943aea73081793caf8f1c390484ddc2166ed0af61446da5e98478dd97e33cb7c708080b03cd98daeba3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773158001, "uuid": "328f8919-a4bb-44f2-a861-089fde969e86", "value": "T17D144983EE880EDBC867CDF086BF835B29E3659B48D2F2F4543C8C18795D19A55D3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773158001, "uuid": "a007643e-5c34-44e1-9830-13628ae1c999", "value": "3072:o5n5tDOj6DPGetWgb6HLst58M4u7B9xZoOB5FmwJfqsuwbfq4YC:MFDPGqdUMJB9xZXzFnBuwbfq4YC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773158001, "uuid": "5d5af6cb-681b-4a78-af2e-b3882c101358", "value": 201124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773158001, "uuid": "8a64b754-3a2c-4dd3-99b8-c9a6b27fe614", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773158001, "uuid": "2358c95c-dc2c-4636-9f91-c57485c36721", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693ab24d-1c93-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1773155487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155487, "uuid": "27c7871e-66d3-45a2-97cd-faf880fa1fe5", "comment": "Malware payload (DattoRMM)", "value": "9b8175d9652ed6e3c7d8eadd3542061d", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155487, "uuid": "96afb898-ad2b-4d96-976f-ec421ffc840c", "comment": "Malware payload (DattoRMM)", "value": "bbbde28b8c22dc682f4cc9a21f6d21dc29427bfdbf86a722c7b8a38f2dc86ca0", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155487, "uuid": "fbe974f3-4e2c-47f2-a746-7133b95f1d86", "comment": "Malware payload (DattoRMM)", "value": "36bc382229918a725df323f45a70ae7cfecea84f", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155487, "uuid": "034a916f-1984-46f6-9119-9b8178c29a54", "comment": "Malware payload (DattoRMM)", "value": "6fcdf5a9f8a6104a431776a522ff90b7d2b46dbbb92c8982d0fac5de4270483adf13f5a6d91dd3f7b398a008e1f4b036", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155487, "uuid": "221f84ad-1040-4c16-9606-99ebad0c607f", "value": "T1BAB63347D9778DF0CA330B3890D21A6B3205980E485BF4C9E509277ADEF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155487, "uuid": "803ff479-b065-498a-9f78-753243b6fabd", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155487, "uuid": "c2db0b8f-ce6a-4a21-ba5e-ae6b15523fd1", "value": "196608:SaZk+w9P+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2f:ongmzZFw5S9pE7Asjp29qIT0jarlZr8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155487, "uuid": "47a7f4d2-5c77-42b8-b76a-ec47da56f57e", "value": 11056040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155487, "uuid": "7b5b4158-4d3e-4763-bfa4-7bd3ab2be5c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155487, "uuid": "a63a01e2-82e6-42fb-b489-1421ca8c5006", "value": "constructionpropo026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64bc232e-1cb3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773169223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773169223, "uuid": "1719ad59-b5bb-479e-8e58-11530c158c1d", "comment": "Malware payload", "value": "fb5b87fcc847ea301187e0f9559cf35e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773169223, "uuid": "fc59b1b2-9423-4708-b8d5-55af6f52a8e9", "comment": "Malware payload", "value": "bd6c1844db5e44310542a69aa4ba433430d25a2622c98cf819247330b8826c64", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773169223, "uuid": "6d948b7d-eac5-4964-84d9-8e3b07cde5ca", "comment": "Malware payload", "value": "c3c54647f1a3f486ce5e4721fd5fb07df12d6561", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773169223, "uuid": "d4614663-c748-41b8-9541-47f2bf17d191", "comment": "Malware payload", "value": "1295d544fc9f0e3202354ba862ec8b9a7f1c067ef4674adb98aab98ec47b5d28743211df967c6bc6f0e24ed3cb9a5a83", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773169223, "uuid": "ecfceab6-61c6-4f07-9289-98d45d53987e", "value": "T18C258D9432EB0A76E9EF893B4862A21FC73279551B20CBDF42504E1FAE33BD25631751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773169223, "uuid": "a3cafdc9-e7d4-4543-8d27-955bee35a2d4", "value": "97b58aa5064d53ed27a0a0f8cd166ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773169223, "uuid": "67af1981-fcf2-440c-b2c8-3792a7a584b5", "value": "12288:zE65hCkpcTgEB1kRZQHHZUgEc24NSYLe0aiIcfZencs4dmFtvwRkM6:z7CkpcTK4ZjSY4LchdmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773169223, "uuid": "b4d29771-b33f-478d-935e-635ef4c55088", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773169223, "uuid": "4d306642-ae33-4fe4-8d41-7defe446fd02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773169223, "uuid": "77e635f8-6fc2-45f9-9ce5-7629a5cc2edd", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85779c8a-1cc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773177439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177439, "uuid": "72cc254d-5c77-4a5d-9317-7f04daab7184", "comment": "Malware payload", "value": "2dd0572bb170156d60835bde120f6e1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177439, "uuid": "49dc44bb-975a-4c84-afcf-f39b177e45b4", "comment": "Malware payload", "value": "bdf7079c83108d7c9e39950bd9bab9047c84590b9b6dca1808bde73af63c737d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177439, "uuid": "48ff284e-6734-4c3d-863c-9c922914ed37", "comment": "Malware payload", "value": "362dd757938a417f5404e6128ae11437c250230d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177439, "uuid": "25211141-d7dc-4ccf-8374-f5246ca16377", "comment": "Malware payload", "value": "7172668bcde754e79d6b00abf017ce94816ab261d2845f87b462f8f73e3130a10280b9f02f223925ce98000221d38e14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177439, "uuid": "d5fbeb90-b40d-43c9-8a9b-a89d71ec292a", "value": "T1E4D42B7DAC50F326F70C90BBE286E3535E6178410636A99319BEE72001458B39B5B7FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177439, "uuid": "32a8014f-71e6-4f7b-a347-bb416904872a", "value": "57594b14471500698dd38c5d2e664b86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177439, "uuid": "700dba0e-2e7d-43ce-bdd1-2b0854879a6d", "value": "12288:jU2FJXk2WjWnLFTM5rdwhFmdV8Bew2/1gdu:Q2bXk2WjwBM5+XBew2/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773177439, "uuid": "9ca4c7f1-f8f8-4a4e-9ce3-74d3f34410f9", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773177439, "uuid": "f7e42f0a-9f9e-489e-9680-b3a3c40a726a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177439, "uuid": "2dc43145-f338-4e3a-8861-d337bb3dfff2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c6c0e8-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146348, "uuid": "fe04a299-5853-4e87-9c56-338478271fa5", "comment": "Malware payload (Mirai)", "value": "32754141877dbab37a4cfae919bd54fa", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146348, "uuid": "48648456-16d9-4774-9b37-e8c89c534a1d", "comment": "Malware payload (Mirai)", "value": "bdff2fbb767b40f965fb9e033166bbe0e068648da6930b27edd77bf98f869ea6", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146348, "uuid": "b10b4f34-799c-46fd-9372-92960cfda4df", "comment": "Malware payload (Mirai)", "value": "164dcde8a72052d984ff0e7241002165f6c1528b", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146348, "uuid": "d8e85ca4-3e5b-4a11-8916-42d1904a8b87", "comment": "Malware payload (Mirai)", "value": "e80bb2d9d28f7173e86f82fbd4347c222e0f0d50bf10fbbb08f0e5a1a04a0cc2348e5633bc7fcd7cdc02da67fcb568c7", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146348, "uuid": "8bd1a5fc-d48d-42d6-8599-57e0320d65f9", "value": "T183432C96FC92456AC6D117B6771A978A33A223A9C2CF7313CC0C0B5176C9B4F4E77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146348, "uuid": "81bc3d2e-6726-499d-aca8-9e8bdf94c010", "value": "768:BSDWzjV4U6ctlVE+Id4DxLqGMMrOYZvFErx1Ggu4XLquwJMU2FX0nzz:BSD+jV4U6ME+Gk2GTOItErx1GgBwJTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146348, "uuid": "72db2cad-efd0-4218-996c-3cd95e5cf884", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146348, "uuid": "fa0b6d6e-0cf8-46ad-9ad8-7766144d5196", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146348, "uuid": "11fe7a4c-668e-4ab6-8cbb-acc01e4b4985", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13580e4e-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773127426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127426, "uuid": "7586b8c9-0ed9-4e77-bbdd-633d768d2093", "comment": "Malware payload (Mirai)", "value": "44800ad266834056eedd70cc2478668c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127426, "uuid": "c5a9b62a-39f4-4eec-a9e2-d9ea3540c24c", "comment": "Malware payload (Mirai)", "value": "bfc211c764a4d06556bea0cd81977fbb53cce17ba4a5b87119dc24c3e8ed0b20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127426, "uuid": "281891e9-09a9-48fd-b818-6fb187ba88b5", "comment": "Malware payload (Mirai)", "value": "4eac070dcf8f21d63376822569606d234e764ade", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127426, "uuid": "c0b3f3c7-f3e7-45ef-9d9e-a412e2f36380", "comment": "Malware payload (Mirai)", "value": "c4f93893723377ac434cc23c3bbf3eb535cc8dee751e6ebde684a18c7590895bba0ff6595e831b7c14fe2aa91d3ca598", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127426, "uuid": "01017757-79e8-4fc0-a99e-0d672b649a92", "value": "T17E259D11B7F5026AE28096358AA2D391B947D7A624E4034FCF518EEFEF171B50E84CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127426, "uuid": "b1ea9142-11d9-4cdf-8f71-df23d18ea915", "value": "12288:ILdjCmOuQ6gN08RVVreRJPK0HBLa5D1I9aH:IhjCmkpvezSoBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127426, "uuid": "b7afd588-3504-471c-8ca5-5453da07a793", "value": 1057528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127426, "uuid": "2528763e-b906-4bdf-aff3-6602b9a1731a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127426, "uuid": "44458306-cff4-4b6f-98bc-1f07d07b23cd", "value": "yakuza.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f2e709-1c80-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773147157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147157, "uuid": "30a00970-bae0-4093-a596-4c00de36016f", "comment": "Malware payload (VIPKeylogger)", "value": "84c538108b7729e73793d79dfcc1d75f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147157, "uuid": "6eb73755-4101-452f-911c-1151083ce93b", "comment": "Malware payload (VIPKeylogger)", "value": "c0ecfc9e5dded5f5e3e43db8d4927f0339c684a01605a413ad6e0f0e5fda5d22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147157, "uuid": "b336d608-1295-4342-aea1-79640364f187", "comment": "Malware payload (VIPKeylogger)", "value": "54edc73900ecb0f3b5b11666667163cd360b31c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147157, "uuid": "723474d2-7c24-4dd2-944d-553cbbf102a7", "comment": "Malware payload (VIPKeylogger)", "value": "d0770d5c9ea3ef22272131a217db8a2c40abc425e7d16d3218598e20cb837847c4c1948cb3d49ae8c85120c2f78e61b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147157, "uuid": "06ef4296-17f4-4875-b069-82557c381b4f", "value": "T125C4CF522266DC63E39092B84155F73DCE61EADA2931C33766F1ED9FB618F323C28251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147157, "uuid": "aa0b4f43-204e-40fe-88a0-b180ba9da92f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147157, "uuid": "36ab47a5-0fcc-482f-b6c1-50dce2752711", "value": "12288:02kgkPfeiGOuzVKAc3RcF9ilR9Wa8e6DmA6qDK4:0TleguQj3RcFED9L8e1AG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773147157, "uuid": "2d8e4e57-9e08-4ddb-9dbf-c3a9ccd13a8c", "value": 553544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773147157, "uuid": "25ba048d-db6a-4970-9115-d67045acdd59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147157, "uuid": "0939bba2-d572-48b7-a8a7-f5472ba2e56a", "value": "squattish.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efbbf74-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146316, "uuid": "1e76376f-c637-4582-9850-fb0e38b1ff07", "comment": "Malware payload (Mirai)", "value": "4479fcc257d22114388b0f9cc648164a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146316, "uuid": "464c4200-d82a-4272-a80f-7ac896a53e8b", "comment": "Malware payload (Mirai)", "value": "c166fe3d8f71798dceb7536a53babde14d91ca56b93b344620a2f3ca1bdad8c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146316, "uuid": "ee95e3fc-b868-49d4-a90e-702bcd39eeef", "comment": "Malware payload (Mirai)", "value": "4722d6013e840386ee3ee5387a45d21ad5c44bfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146316, "uuid": "d72d7912-051e-4102-aea4-91e9972e48d6", "comment": "Malware payload (Mirai)", "value": "0c94ae3dc6fe44706a9522904eae340ba422273ebd2e33880ea8c04e26038f6c02bb15e39a26c2028e5dd01d452f6d91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146316, "uuid": "2cf840f5-f55a-44be-a097-078724298573", "value": "T1F7E33A09BD819F11D5D722FAFA6E428933137BF9D3EA3112CD245F60378699B0E76212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146316, "uuid": "454246b2-f08e-4b9d-bcf3-bb78f54c2343", "value": "3072:7w7y3Pg3xX0AapO/ZVI8Dj9hNTKFh+NDI1EabJcaemGEWcGX2Ogmc7GPGP:7+ePg3qAywPDj9hZKH+ND+EabJcaemzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146316, "uuid": "56d4aa03-f085-4131-9e20-131bad74758b", "value": 144840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146316, "uuid": "53622d75-35e0-4c82-b1cc-ad3573ccab5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146316, "uuid": "c66f3644-d9e6-41a2-828e-19b1fab6a3dd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a9ac88-1c68-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1773137192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137192, "uuid": "09226b3c-69d6-4f92-ae8f-558fdf93f1b9", "comment": "Malware payload (GoToResolve)", "value": "cf63b84499450bb2ae2a4595b5cafce6", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137192, "uuid": "103fd46c-913c-42cd-86fa-0fb18b6af7ed", "comment": "Malware payload (GoToResolve)", "value": "c1ee59108378686091c53a1259db7f467e3f3301b73f2f2523f70235ae11f68f", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137192, "uuid": "114484aa-a6ac-4136-8780-da2f5db8a947", "comment": "Malware payload (GoToResolve)", "value": "a562b5f29166c386b97b67ffbdcde281228495f5", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137192, "uuid": "5c9e150b-1dd9-43a3-b614-36d265d51ec9", "comment": "Malware payload (GoToResolve)", "value": "408ba56441ca7371658d7602b1dba2a9be01a632ddef3d8cfd15574d19b988a3b3bf548161c2b8564038897c7c2072ba", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137192, "uuid": "38de7e76-416a-4315-93dc-200044ee6892", "value": "T17F3733207649C171F53E10B289286BBF427D6D320F6580DBB3DCFE9A5B312C16B36A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137192, "uuid": "5de2172b-fb36-470a-a40b-a571ac394e2f", "value": "393216:ru0G/h3+M0v1UuQHRTRGH6JHfTF7UY+/kqFj4eFSmJlVvKneUdPlZQnl2H7gOnhI:S0GF+Mm1UuQ3H/T1uThFJll+eUdEnwHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773137192, "uuid": "91eb9aa4-bddc-4d2d-a234-d878da604936", "value": 24530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773137192, "uuid": "6ef89498-ac04-448c-a69d-fe900010bf90", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137192, "uuid": "7f359865-922a-4854-bf4f-f41d92e65b73", "value": "MeetingApp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e17d806-1c67-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1773136597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136597, "uuid": "17e56ac1-9b24-4d2d-9504-f3515cc7dcee", "comment": "Malware payload (GoToResolve)", "value": "38bb81c81be570d40adefd736dc2512e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136597, "uuid": "6e861de5-8350-474e-8ed9-5105294367a1", "comment": "Malware payload (GoToResolve)", "value": "c22808c338b7dd266338752fd419f82d8761e9920dc99467ca2bf9683948ed96", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136597, "uuid": "eb56f287-0ad5-4dd5-8014-4e31cc696710", "comment": "Malware payload (GoToResolve)", "value": "fcf2397a8f8218eec1721fad0947ca35efdd9b3f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136597, "uuid": "190e315d-af6c-4928-bb6f-8f71d6370b37", "comment": "Malware payload (GoToResolve)", "value": "0668e63a01e6625818e1cbba0c1da9b0fcbbc3728c2ddfce58efdaa3153783fe764b7760eb5ea68b8aac5be7675f05c1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136597, "uuid": "1d0a399f-0f7a-4838-8419-a6feea39ebd1", "value": "T15631E6E9DA70C1B0F66D113CA90389C38DC40745960AD2A2BBB17F97531022ACBBE2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136597, "uuid": "a655bc10-859c-476b-9710-93cda116d76d", "value": "48:9dLMEurU3hGtH+DSsTAjmiDsQtqyg8WQYGvxaQa8bvh5Xkf8pZLMy:xOUOH+uldsQtPgA5aQa8hKyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773136597, "uuid": "3030ca81-a8ec-4d7d-974e-c9d1071bef73", "value": 1809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773136597, "uuid": "63e9d907-6e1a-4ce0-ac64-c19ebe9febfb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136597, "uuid": "41de3fe6-6dc4-4c6e-bcd3-ed674bd6c2b0", "value": "ZoomInstallerUpdate8.3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7403f8c-1cb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773171134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773171134, "uuid": "7f02ab0b-f0e2-4835-b15b-7803f7bfdade", "comment": "Malware payload", "value": "6565cb296db3b718493bbbfce58873c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773171134, "uuid": "41667313-da85-4220-983e-c3aa342f8922", "comment": "Malware payload", "value": "c53bc13170b9ff26b0cca93715e947318e06cafe0d98cf825eabffe3c7f763cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773171134, "uuid": "e0adbc70-8d84-4a6a-8281-4512eacad24f", "comment": "Malware payload", "value": "247f5e4723cf44ad7cb00e8383fb7bd169d39d29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773171134, "uuid": "82487d93-c6b8-4787-93d6-7ea1b5cc10a7", "comment": "Malware payload", "value": "40e7dfd907b4c85edab85f5cd2c0d25112e72f50304aa43cda5890923a30a2694bbf54cfe518479be97641e49e769972", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773171134, "uuid": "6a44adf8-cbb9-41d4-a5e9-1061da2bf24f", "value": "T14F873947B89540E8C5EDD234CA268256BFB07C895B3433D76B20F6B42E72BD45B7A360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773171134, "uuid": "ca8ce4de-c476-499b-8edf-3fdbeca52371", "value": "393216:dBbXQ3YcDQLuGH/uEPH6xxi0iCheKxg714lz2t:dBkjxxi0iPKxg7+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773171134, "uuid": "b2a2a95a-c9dc-450b-907f-cc98c1bbff2f", "value": 36515304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773171134, "uuid": "c1d41646-8435-44e2-9936-8cf43ca172d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773171134, "uuid": "aec631ea-7f87-4a83-a5c8-53b31363e468", "value": "sliver-client_linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9004c9-1c9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773159815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159815, "uuid": "7304e111-ffc8-4f12-aca8-11dc10327e01", "comment": "Malware payload", "value": "d5517131a62e4634875ab8655b2c7593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159815, "uuid": "60258217-d6ec-4a58-9f37-afa503e83eb7", "comment": "Malware payload", "value": "c565bb6e2fe166f24f137d9a15b464ab8425dda447aeeb216aa1b7bbd2cd4f5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159815, "uuid": "ba902d10-75d1-4b87-8d1d-0fd096c6a735", "comment": "Malware payload", "value": "dba0d0977c4eec28844353b78e5550389188c6c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773159815, "uuid": "ac03f4a4-5284-47a2-9e80-e8e886a677d1", "comment": "Malware payload", "value": "f93bfb1993e9d0147081a902baa2d89e4c648d95f006a0dac2ceede4e41de33977bf74d73262c8c2ce1e864be095a6b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773159815, "uuid": "c0f38c10-0c7a-4b81-804d-dcdc9a6d4677", "value": "T12707332AB2000CC9D99F533798DB82236581BC2987A4D14F5AA42F651DEF3D1BD76FB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773159815, "uuid": "5a2eb820-ea83-44ef-8aec-e78f4e1ed9a1", "value": "a6cec5b1a631d592d80900ab7e1de8df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773159815, "uuid": "41fb61bb-ac1a-40d7-94a5-eb3c2d1a9ee6", "value": "393216:MxFt5COnzDdQuslqIwdFqPMfnq3+d9zRX5TW8wI1vo5:MxI4vdQuRxFq0qOd9zbW8wgvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773159815, "uuid": "83ef515a-310d-49ae-a5fa-4e036a7a7a91", "value": 16833909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773159815, "uuid": "d3fbbede-6e70-4173-a34b-5e15df0a8ff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773159815, "uuid": "e1ffc020-5693-41d2-a058-ff69eb12826a", "value": "Reese.s.Hood.Macro.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1b265e-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773127419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127419, "uuid": "c9ae0cfa-5511-4601-bd5b-057e05ddee76", "comment": "Malware payload (Mirai)", "value": "1a93e33f373ec86b202b068fca589837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127419, "uuid": "6aa1702f-83b6-4b20-ab98-a58f2a1ef2aa", "comment": "Malware payload (Mirai)", "value": "c6075676438698d83be4f6a6e29b53ca9ff499e226f7f536ef2484c4d75f0152", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127419, "uuid": "2b07abd8-ffe2-47aa-9eb0-d605141ebdc8", "comment": "Malware payload (Mirai)", "value": "80bc7e143c361fae7cb6bb8eb02755739140784e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127419, "uuid": "cd673533-3f81-4b68-9465-a5746e548799", "comment": "Malware payload (Mirai)", "value": "e71e5b8932ec1d9317d5900a5964243bb1a703747b2106f44245927f2f55a4660deaa4e8b0aaeb65677bf6158b2860fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127419, "uuid": "c8fef967-997d-4cfb-a198-55d00d427d05", "value": "T1E963E882BCD1DE57C6E42776B75F21AD332263F8C3DB3303CC1456247ACA999072AA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127419, "uuid": "05f740ce-c513-43cf-8561-519d364a37b9", "value": "768:3MzVEVApw6KU1gGw+rmst0y21Gd3iNjENffV3nI8fZQ4UQmkEfj/9fSj+lyqOcnI:8zvpw/wQGdBJRUQ1EfjFSj+lyqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127419, "uuid": "8ee42f59-82ff-4dc0-a505-65ff935b8b2f", "value": 67376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127419, "uuid": "3d08643d-026d-44f4-a24e-adc0b079c8af", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127419, "uuid": "36adc0d0-6d3b-4734-a8e4-84668512586b", "value": "yakuza.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de670c67-1cc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773175870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175870, "uuid": "4e707e94-9f58-423b-b5aa-887acf026c68", "comment": "Malware payload (Mirai)", "value": "f3cc5cd9ea72d2a6e2968d9f9c84320c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175870, "uuid": "127fe278-8ed6-45e9-988a-dfb6440d4448", "comment": "Malware payload (Mirai)", "value": "c62d087263f99c28d641e6473f6ea525074ddf3c39c954b0d33be936f311101d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175870, "uuid": "65aa4246-e63f-40cc-838b-75d4b51742b6", "comment": "Malware payload (Mirai)", "value": "ffd682b9279c01b066d75636384bba8369642c1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175870, "uuid": "7771ff3d-8af9-494a-9d62-a6c396573a74", "comment": "Malware payload (Mirai)", "value": "5a507c8afc77af7ae6cfe61af00ecd45a8ab308f61c57be151a0654ee110dc8f0339e97ef7d6d8514c9d7b041e4e417b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773175870, "uuid": "cd572f99-aef1-4855-a350-f5e8cb40305e", "value": "T1F4931981F8C745F6C807493450A7F33FCE32E47A813196ADEF99AF36DA77601911229A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773175870, "uuid": "699c9dc1-4450-498d-9109-2fb2daf4f239", "value": "1536:8qut0gR4/HEI2E1pMphR66rAm1XJmdfptWxix9FMWYyWpYV9QAgeDhn:8quugR4H2E1pMrR66rAmJQ0UxwHpe9QI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773175870, "uuid": "33c4c796-c635-4d33-a6b2-10050eeb466e", "value": 90896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773175870, "uuid": "ac7353d4-eb33-4b75-a341-33e742f0752c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773175870, "uuid": "cd30f7b9-bf78-498b-91a9-0dee2c9941ca", "value": "MMaaRRiiOisecTanee.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f44c83c-1cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773177428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177428, "uuid": "824237e7-77f1-490d-9dd4-2641de972f8b", "comment": "Malware payload (Mirai)", "value": "4a7e23f9d84b023cc021bda6168a8b4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177428, "uuid": "e6c2a486-5f4c-4a45-9db1-3284dea1de1d", "comment": "Malware payload (Mirai)", "value": "c72d37ebb0026a56c683780460f0527c414704e46368e18648e3b27f13f87658", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177428, "uuid": "59fe2f0b-19a8-43b9-b68b-7c6efc81f35d", "comment": "Malware payload (Mirai)", "value": "40f3929cd5b7e4016f521ebf5d021d020e392875", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177428, "uuid": "db36e55f-a067-45a2-8d18-c3101e10bc8f", "comment": "Malware payload (Mirai)", "value": "db123cc0e5ac9d4871ff8cb8ee0cc1e36bb0dcc0ccc42d57d27cfef5181625e4f43b9178858a8b8ba06dbf2de0d11e7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177428, "uuid": "736b25aa-35e4-4f40-9b9f-9896e1933a06", "value": "T15A835B46EAD7F9F0CD4609B4106BFB31D53668323121DFF7EBC8B967A9A1601A05326C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177428, "uuid": "310ee40e-1732-4cd4-a247-12760361450b", "value": "1536:2PfGfiOz1mKjfs2ajfYsyGsxuWIF9sdOWvd7/O0iSb29gIe:We7saL4sxwOnpbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773177428, "uuid": "ca37d976-c1b4-4c68-844f-c91a0c733250", "value": 86616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773177428, "uuid": "a1855437-3f07-4a77-9045-b014809be908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177428, "uuid": "278a60b5-3e10-4aaa-a2ef-d82d88abca38", "value": "MMaaRRiiOisecTanee.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485eeb5b-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146413, "uuid": "7c29d5ee-5494-446f-ae72-0d1ecb7324a9", "comment": "Malware payload (Mirai)", "value": "bc93aab64ca8081aa8f17f5d9a35bfd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146413, "uuid": "c49a3c98-5416-480b-8bd9-616b1929f829", "comment": "Malware payload (Mirai)", "value": "c8856753d5580e98b531f0170295646a269830be25d1abdb00d783364cdb730b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146413, "uuid": "0abee7cd-f187-44bb-ade4-15d5c7064e96", "comment": "Malware payload (Mirai)", "value": "0be2d545fbf47c999f812b821ac8fc7622367b2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146413, "uuid": "5ba3e7d1-a934-408b-beaa-bf347bc577aa", "comment": "Malware payload (Mirai)", "value": "75360c7f15c8b740e36ffb6a9ada5d567017e12f344a86ff43fc9e137f52e324629d65226abbd1c1bc384ff16851d47b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146413, "uuid": "2e2ea56b-73e5-4fd9-a2bc-8e53f2d83644", "value": "T17FB35AC2E687C5F5EA1609702577E33A4636E8361139DF83EBA4DF32A853E4095073AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146413, "uuid": "e890f30a-94e6-4b5e-99bd-1bac5a3651ce", "value": "3072:3Z7+4JoKyynKyzprHn++YQ7PVANm2L9YFtZBo8:J7+OoKyXyzprHoEvDHo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146413, "uuid": "3de24f11-a0c6-406f-a816-aa7d8b2f8428", "value": 107604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146413, "uuid": "1ea8035a-07a4-4246-aae0-f8e1e1f194c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146413, "uuid": "41503e07-d618-4a5c-a2f5-304b10928542", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0084abfc-1c6b-11f1-a769-42010a9c0008", "comment": "Malware payload (MeshAgent)", "timestamp": 1773138132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773138132, "uuid": "3651cabd-5a16-47ba-ad11-00c320d8ecc4", "comment": "Malware payload (MeshAgent)", "value": "fa39ee1b3739d14c844ba1a92fb17e57", "object_relation": "md5", "Tag": [ { "name": "103-65-230-86", "colour": "#5083D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773138132, "uuid": "d14e1deb-d997-4fd6-a3d7-236aa040340c", "comment": "Malware payload (MeshAgent)", "value": "cc5533276e0298b981c7d0ca3a8ee6a502af679ad8ce124044d70b002fb0893c", "object_relation": "sha256", "Tag": [ { "name": "103-65-230-86", "colour": "#5083D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773138132, "uuid": "d7ae6320-7e06-4580-b011-a469280d0d1a", "comment": "Malware payload (MeshAgent)", "value": "4b63dedced43ead47897983525726d2c1017ea16", "object_relation": "sha1", "Tag": [ { "name": "103-65-230-86", "colour": "#5083D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773138132, "uuid": "4ee3bfd7-6327-4b1f-9e33-2d23d126e573", "comment": "Malware payload (MeshAgent)", "value": "8477623cb33f890e0ca7916e592f07a66506dff47bf17c57f70989ba392c9ebabda5d759df27b6318d3ea440aaa67db3", "object_relation": "sha3-384", "Tag": [ { "name": "103-65-230-86", "colour": "#5083D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773138132, "uuid": "4d1d8e3e-820b-4789-80f1-a98d6fbd4324", "value": "T1E5F58DD2A3A600E8E9B7F23C85568517E7F2B81753709BCF15A44A761F236D12B3E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773138132, "uuid": "029e7f02-a7e9-47f3-b1b3-9b6d5e1d4e11", "value": "fb0a8b4a81655f744a37af985e009476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773138132, "uuid": "025690cc-f658-480a-85b4-c6e7c01a7969", "value": "49152:adZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5bB:iHvfGfZvZj1/N/z/owJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773138132, "uuid": "97d7b036-a4d8-40ee-b357-b7e065313828", "value": 3482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773138132, "uuid": "705be81a-0e1c-4b08-ac74-285b3d18e73a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773138132, "uuid": "7524f31a-0f5c-4d3b-a61a-0e97f2022cbd", "value": "MeshAgent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5c6761-1c87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773150585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773150585, "uuid": "b2ee1f31-3672-4d48-8c99-513dfe2d9dd7", "comment": "Malware payload", "value": "3515a9cffb7c3e66fe0d933b77acbf73", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773150585, "uuid": "abd1fc5a-5b1c-4ae8-8eb4-3b490e0e4345", "comment": "Malware payload", "value": "cd27f2bd6d468844926d620ecf71fbe742efc463d0bf2367677720ce5d98ca39", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773150585, "uuid": "7b669d96-b67c-4c5e-8b97-a948ecb0ee22", "comment": "Malware payload", "value": "57f8dfbcdb7df03ffdbbf679a78ace34d6e96dff", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773150585, "uuid": "4b73f696-d0cd-4adc-bc2d-95e4a26de399", "comment": "Malware payload", "value": "f73c4e3f3505d9d2262cbef76fee863daa5d37a9aa2374efeb96848c4aee517d605dd1d2232f03fd021ac59e104178de", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773150585, "uuid": "ec0a14ec-aea5-4e51-a664-f0c1c47097bd", "value": "T12DD6AE16A2E41461D017C6388615C233CE7A7C93C679C00F799CE7C62F7BD526FABA62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773150585, "uuid": "e06ed6ad-bd9a-4504-b344-23e50855d522", "value": "26a7ad76532d6e94d9168b61ad51c2c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773150585, "uuid": "a44700d3-3626-47d3-b5ed-00789c76039b", "value": "393216:gIlXR8ZBip68oewWKW/B3aNeSJ/4HUkMieFd:36SPez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773150585, "uuid": "4e333d30-ff47-4f51-b2e5-a4329c2afbac", "value": 12819968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773150585, "uuid": "c4a1c4be-15f5-4a63-9e48-346fa3b73456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773150585, "uuid": "572be9c6-dd76-4b42-bd8b-ac53708573d0", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2732608a-1c4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126171, "uuid": "f0938dbb-5fef-45f2-a24b-24f48113afb2", "comment": "Malware payload", "value": "cbf73a7bda4d6fb1d0c0bad7c1837306", "object_relation": "md5", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126171, "uuid": "4f3b1018-4979-4aff-b05b-b1633ec414b9", "comment": "Malware payload", "value": "cdae573ab468b24c28a42d6078daf2da1a4b4c5657a4146ad966e2fe8340cb49", "object_relation": "sha256", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126171, "uuid": "3fb79681-44ce-4c30-b289-25e4abc243e0", "comment": "Malware payload", "value": "dc2617960fec911bab16020bfcab7a7abba0aad0", "object_relation": "sha1", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126171, "uuid": "d4103876-ad12-40a7-9af3-4e3b395f88d8", "comment": "Malware payload", "value": "21d079f67b5b17e4763a2eb1c77a2be8b313fae709bcac6b3fbad03c54d388622d4b9bd082a90cda17349a027e6e6ff7", "object_relation": "sha3-384", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "OmniBar-AI-Chat-Search", "colour": "#1C9655", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126171, "uuid": "4d045b67-316e-46ea-a239-2927c749ca03", "value": "T12F42AF9BAAAD6911C252823D00CEC356FD38E35D4CA05B5F16142E6C68E2D17CFA1B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126171, "uuid": "e1e2d331-6fe0-4763-b1fd-7a29cab96baa", "value": "192:/gCcypLjr8We4Yfxz3/Z32NKkytCZF+ko/Zap+6OYMsx9vd508iuAly1fwG6Ik3z:IeLH8B4kdBe+r/ZFoDvxAlwYGb0L0+hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126171, "uuid": "c623619d-9995-4b88-9b5e-63ce3f3a20ad", "value": 12762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126171, "uuid": "88c02cea-4457-4ea9-9313-c54d710d0309", "value": "application/x-chrome-extension", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126171, "uuid": "b05b2ec7-91fc-4db1-904d-4b8f5ecb93c5", "value": "cdae573ab468b24c28a42d6078daf2da1a4b4c5657a4146ad966e2fe8340cb49.crx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293b62bb-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146360, "uuid": "e3d13b3b-569c-4d53-8c4d-c72aaf611d82", "comment": "Malware payload (Mirai)", "value": "ba2a4724cccb6fd5982fae5221597231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146360, "uuid": "6ba32048-9e94-4130-8a6d-0c37de74a261", "comment": "Malware payload (Mirai)", "value": "cee19cc0ec5986bb6e889f5ad21df605ddbc0f8a662229dcbeb3f1b8d68fdc98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146360, "uuid": "ab8ca804-a35f-4744-8cac-3e4f1125b82a", "comment": "Malware payload (Mirai)", "value": "f0a437e1872f5ccfab5debcff8289a786ff836fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146360, "uuid": "7ce20dcc-0cec-4986-a505-d38240ca7503", "comment": "Malware payload (Mirai)", "value": "2a75b15a5f0c27ef8f5b37e2bdbd59e40ff7f308ce87ed7acf07f7c6e6ad2ea9529ec371602127eac658cd26c66b2582", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146360, "uuid": "33920dcd-54d0-4536-a37c-5b53e32f4be5", "value": "T1CF936C85FB83E1F4D94609B011ABF7798A31DD322024DD6BEB98FE72BC31612911A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146360, "uuid": "054098be-1154-4f29-828f-081e188e6b98", "value": "1536:hqj89KwF8ROXbDccj0g/zHj822Rqoi9pUQ31QUHLKVyMyF+r:64F8ROLIcj0g/zHYBIuiE5yM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146360, "uuid": "9f6ff5f0-dae7-43b2-b0ad-fc2bc7ee85cc", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146360, "uuid": "4520c073-3b6f-4a7c-b54b-8248849eb2f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146360, "uuid": "e0ed14fb-b390-43d3-9c3c-25aad904c4c0", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6369a5-1cad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773166743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166743, "uuid": "e13e083a-2f8c-46a5-924e-0c2a2496bae1", "comment": "Malware payload", "value": "72e3468b68cc501121ee6b79e4abd907", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166743, "uuid": "31305107-9c6b-4329-bd92-3d7a09f443bf", "comment": "Malware payload", "value": "cf23954ed0ec31d1e3b0073022bc759bd21a6c1fa2517db6d7dffe0488a4e02d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166743, "uuid": "7192f475-30ed-4639-9471-fc7ba15b6e95", "comment": "Malware payload", "value": "ed63933309a25964a7cc6e9e4275b66b2e2fe1d1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166743, "uuid": "840b0344-2bbe-4d27-ae8e-257d4bf38788", "comment": "Malware payload", "value": "35aa144b58785e3ac9a1609f86c3ca72d483deee0d85a95f8e5643d3ef1e0f7d6507d0c1ecae07e0da6357e3f516aa24", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166743, "uuid": "7d43f5fa-169d-4cb1-8869-131ea7407965", "value": "T12897E0000AB929B6D073877049FECD7199767C9A751CC09F1096FE9F3D72B029E2963A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166743, "uuid": "42cde166-f78a-47cb-89b6-08421f08befb", "value": "14ad8c8a3b974abb2786cc7699d07458", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166743, "uuid": "5bfd671a-e344-4b31-b24d-ede31d1cc085", "value": "786432:ihQZJpuJOUgpC4ImWjEiO99uuhOzA6z9iup:RDpuJNUfNWWlOzpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773166743, "uuid": "418525ac-44b5-49f2-a7f8-684a5c0a9120", "value": 40272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773166743, "uuid": "38e9ca06-1c96-4c36-abfa-c4a77ad8763f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166743, "uuid": "a1822cfd-ce2a-4944-b064-8c60682b4321", "value": "cacservices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e563a827-1ca0-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773161279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161279, "uuid": "e3ffef18-ca4a-482b-ac6c-46a7964b1d8d", "comment": "Malware payload (ValleyRAT)", "value": "eff23e962e556b9b7884b08fdb80df0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ShellcodeRunner", "colour": "#8EDDAB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161279, "uuid": "c7ff0ab1-2afc-44c4-8124-02a8b195c71a", "comment": "Malware payload (ValleyRAT)", "value": "cf4203625b4ac409c4aacd78e0db6db3a8afe67b6f8fd1dcc263ed49d12274f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ShellcodeRunner", "colour": "#8EDDAB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161279, "uuid": "adb64224-87e1-4f38-9b2c-393019ef0c12", "comment": "Malware payload (ValleyRAT)", "value": "e1ecb13fd3a3e7a6721976da6bbf95ac85f702c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ShellcodeRunner", "colour": "#8EDDAB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161279, "uuid": "5b6a2da9-f91a-41d9-b257-f3aa34ece2b9", "comment": "Malware payload (ValleyRAT)", "value": "2b758712bcc399a8b2c1b4af5a1a45cc3bdc599f38b476432f1773ed83324c726d659514739e15ae450c67d67e7420c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ShellcodeRunner", "colour": "#8EDDAB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161279, "uuid": "c16a6b22-d231-48c2-bfcb-7a27d5c5e33e", "value": "T1F7C53360DE70ACAAC37CD33664A79F3D45D26E11981CF5C989B2E0E373ACE44641AE35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161279, "uuid": "c97c2184-1a95-43b2-ba8c-1ee4702f2ae4", "value": "c2b2f2613938ba9838c78cd62e4e8ed2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161279, "uuid": "8b454975-d6e8-4aa9-9445-5f6a0893ba62", "value": "24576:HEZYrG9aZgkMLrUnfLvrz59HlTbHHBQyUFi35ly20ULJrKDdEShwhTp1LNM7xBW0:HYXOjbhz50qKxhwhpsh4zgU5CqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773161279, "uuid": "b8c7091f-660d-4d76-9794-4c0f4b4cb148", "value": 2627584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773161279, "uuid": "4bd1c569-4403-4697-8112-86beb13f589c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161279, "uuid": "97a2a24a-e8e1-433d-9366-678b27a6b0da", "value": "jinyou.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8319e197-1c42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773120741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120741, "uuid": "aff4767a-bf90-467d-a791-7beb39530a69", "comment": "Malware payload (Mirai)", "value": "858d5ab2594ec882c72dbd749c3f3423", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120741, "uuid": "df8818c5-ccab-4127-ba4b-d08e7c8fb19c", "comment": "Malware payload (Mirai)", "value": "d104de180e0bd17c476d237adbb98155c78684ee0a123b356fdf8cdd62b5afde", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120741, "uuid": "73ceb7d6-8981-4c4d-acc4-2c38e0944db8", "comment": "Malware payload (Mirai)", "value": "e3b24bc09c3f3d59c59e6fa10ba8103d9ab5f73c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120741, "uuid": "c10032d8-6583-4b37-ab4d-d2036f9a5b21", "comment": "Malware payload (Mirai)", "value": "6ddf8096ecc74ed4d59f1a19a4c84cff16d1f65ab66405c98330e9438a8737c30b75c53c36ebeb0e3548d04d217ff917", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120741, "uuid": "39b5fe0b-1526-477e-a744-d5a6c77f4fed", "value": "T12021D2CA214116E1DB3E8D2D56D778C63CC400334091B78D7A4EAA8D2F61197735ABCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120741, "uuid": "68222ea6-928d-4330-b337-deff8730fd9a", "value": "24:zbcSbKqWLCYLMKVNhhaILzFFrV+3Kqu+GLyA:v9bKqGLphnHzp+6PRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773120741, "uuid": "c468d92e-6897-438b-aa3f-b9d0a61f1fb9", "value": 1400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773120741, "uuid": "d6954ef9-8062-4f0b-bd92-024b55e7928c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120741, "uuid": "09dfdc3b-11b9-42a0-9c5e-5fa45d40a355", "value": "s.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8addf69-1c8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773152292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152292, "uuid": "3b2e4fbf-1f3d-49bf-9c2a-3481ed3d82e1", "comment": "Malware payload", "value": "3afdd180fef82684358d1ad2ce8f9013", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152292, "uuid": "5de94a59-1b35-49cf-8245-dd9f36fb677a", "comment": "Malware payload", "value": "d44e68bd7c91e0bd1870cfd227f25e0a92a5a85e181c861162c9cc7c0a3af65d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152292, "uuid": "ac54a79d-c9eb-4ad0-923d-021409d5235f", "comment": "Malware payload", "value": "5f6aa8ddd82c3d0724aab325f1ff7196bd529eb5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773152292, "uuid": "e257b4b0-6742-4a82-a0bc-70f584db8fda", "comment": "Malware payload", "value": "a3c986aa9e32551b7849f9339eda144ede7a8ca525c7d1a8751cc859c7b97ae5ac8ea34d0b4d261cc108266694f61fd2", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152292, "uuid": "19de152a-b6b3-4056-ac4f-b865eb4c8d83", "value": "T139C3AC1E08EF30CF45A6AC39855BD483CD479B1F240AC92A726DDB765F5851C02EEBB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152292, "uuid": "bb85b38e-a5bc-46e9-b124-4a121819011a", "value": "3072:9RvvMI+jEKkKyEGbl+bwPYKQsKbBlO5AjCFMP+81yTwpG3EdVczSJQXm9kCjMFWH:9RvvMI+jEKkKyEGbl+bwPYKQsKbBlO5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773152292, "uuid": "d5b2d5ec-5f6c-4f2d-8b86-303d6e361fd6", "value": 125125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773152292, "uuid": "fdaf7ad8-0007-46fe-afb4-20d4230d2131", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773152292, "uuid": "45e3a444-e3b1-42cb-a046-e919606656ce", "value": "Quantum_Project_Canada_9531.json", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc55e536-1c6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773140218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140218, "uuid": "75e0d267-c8af-40c0-9277-73720c93dad7", "comment": "Malware payload", "value": "63a98e211ebbce47f3821d8756979901", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140218, "uuid": "26691381-f976-4d60-8d42-5d837243553d", "comment": "Malware payload", "value": "d618cbee8607403c41f3c5528c4998258d29f5a06461de3e47e09b5e67c16c39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140218, "uuid": "0d4d9ea0-81e6-4850-90a4-e5a2e52fecb3", "comment": "Malware payload", "value": "484003fd2f4e84a0bbe0f7557b47c2dc4fc43a9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773140218, "uuid": "22e26426-bd85-4925-8996-9c6b23fcc723", "comment": "Malware payload", "value": "a6fd4de65a9dbcd8b8a964c85ef058abe0ab4c8890a2e49d7cade186ef218efc7e5743ea23bde267976fa6accbd3fc84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MULTIMEDIOS-CORDILLERANOS-SRL", "colour": "#41E8B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140218, "uuid": "3e5c3229-3d3b-4949-b2e5-4b3cad569f76", "value": "T189A59E02A79761C7C53E8B7884FF0B13F735F02A2306979B5480A9B96F157D9AE38346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140218, "uuid": "652484dc-85d7-4e96-860b-501fecdc4cde", "value": "cb24c83e9e0f68a811d65891b8e7dc53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140218, "uuid": "83845bdd-6edd-4a87-920e-da038f4d1f1d", "value": "49152:L07iy3cUUgezxs+X3CCHYTOsCMpb6lIkvJO9GXRDN/PKpp4ZG:QflpCiCMpO9jXRR/yn44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773140218, "uuid": "0c810ac8-6dae-4388-af35-9588f59b882b", "value": 2129992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773140218, "uuid": "b65cb592-c42c-407b-96e2-ef4784cbbe56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773140218, "uuid": "24799d0d-f35a-48d5-bfc3-dafff3868923", "value": "d618cbee8607403c41f3c5528c4998258d29f5a06461de3e47e09b5e67c16c39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60074070-1c9f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773160626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160626, "uuid": "6b720557-217f-4866-8460-0cd7f762d124", "comment": "Malware payload (Vidar)", "value": "ee55d438708c431cceb3b7a952d1f400", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160626, "uuid": "1140b5cf-7a11-41a6-8519-c1a3c9da24c2", "comment": "Malware payload (Vidar)", "value": "d9cf3642fcbb9de09fce2b08195ea1433d454beda57fbaffefd9fbb07c2f9f90", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160626, "uuid": "ed04662b-8755-495c-9177-28e68d562d88", "comment": "Malware payload (Vidar)", "value": "2dbcee1dda2871725119d1504fdbbf60396808ee", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160626, "uuid": "84887c4c-409c-4e9d-ba70-f98a44d541c8", "comment": "Malware payload (Vidar)", "value": "b5adf2aeb9f190822a6ae94b85af88b808b0dc73acdc51dcb9b189f6228786d9c487de8cfeee4406c7622ce03906fb52", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773160626, "uuid": "c0b5df3c-6aab-4784-9dd4-1b17e702ada8", "value": "T122B6C22B265095ACC1DB813ACD93CB80DDF761B52B26C6E34E9C7F684A46CC74E3E524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773160626, "uuid": "b5978722-bc67-4e40-9c2d-fef7e5e0810a", "value": "be27ca3e2433d9854a57851ddb822150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773160626, "uuid": "06ff90df-2949-4969-a13c-df92891a90d2", "value": "49152:p24+J84zmrSOJ30Fz5h/cetKxvqS9TWNKDKv+yUMCUYfwieJ7ivXPGOSssg1rO5v:pgI2Amsv/PSOy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773160626, "uuid": "5baab531-f68b-4358-aba0-56a1c4735778", "value": 10715136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773160626, "uuid": "e9b070b7-3301-4f5b-a3ff-83dd51672b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773160626, "uuid": "593c1c59-dfe8-4aa9-8c54-5b5a7c1913f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed9cbb3-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773146692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146692, "uuid": "79f1f14c-40c2-4a16-b232-ca556f9dd26a", "comment": "Malware payload", "value": "254c15ce5499d0b9e9b1f38b9e4da470", "object_relation": "md5", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146692, "uuid": "54fb5648-1113-46e6-be39-7525b3e6cad6", "comment": "Malware payload", "value": "da4833a3a1dda44b8100f71f1ae4e6778eabb28bdba56364558c9bcb0fba0ede", "object_relation": "sha256", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146692, "uuid": "c5db9a89-fd49-4ac5-94e5-3540aa077b5f", "comment": "Malware payload", "value": "941b019af0eb6d0eac1557e05babb9dd5a829a27", "object_relation": "sha1", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146692, "uuid": "24e35402-7163-480d-92e7-b0520a4000a2", "comment": "Malware payload", "value": "97e2e9221236a02b564c9a4702a0131f3f852285c3fd480c2930b3a01edc2e2342560d9a7b5836878d90156943b59196", "object_relation": "sha3-384", "Tag": [ { "name": "bluestonerepair-com", "colour": "#30C836", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146692, "uuid": "cdb70c9f-4c7b-4add-8707-c21fcc037d07", "value": "T1D9653367D201F63D8D2BA09597A2ED273E4CD4C6DF3D178841BFD3A85814EC201FAA96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146692, "uuid": "147e6ea7-bc54-4d09-9da6-74da65635fea", "value": "24576:JqHTm9Nxjf79mRD/TATnR+px9UD4dg4ObqBUmKbC8sw3PLjTxRwbBfVemQ:JqHTsnjgDrATCx2sdg4lUmKbC5kTjkBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146692, "uuid": "1dce5cbf-0a51-4ba4-8349-aa31c21b4328", "value": 1422491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146692, "uuid": "94cd8c87-a8d7-449b-ab6f-adfc2ec45774", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146692, "uuid": "fcffbafb-0238-4c9b-9c05-28151fc13075", "value": "BarkBlitz (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2403c034-1cb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773170403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773170403, "uuid": "e2e229ee-bcc1-4075-98e0-385ec9edd759", "comment": "Malware payload", "value": "a5561b8732af3531d24c1294788bfdea", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Uzum Bank", "colour": "#7B6F1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773170403, "uuid": "2b9d242f-4a7e-44f9-8f5e-bb2f64116e21", "comment": "Malware payload", "value": "db11d9b51d90d23e5769d5f6dd738adad56acff41555698446926804d5396962", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Uzum Bank", "colour": "#7B6F1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773170403, "uuid": "7fc56a1b-fb5c-4e9f-90c3-b334efe1ab43", "comment": "Malware payload", "value": "25450cc280842210fd6df2d2da008b02a5239c51", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Uzum Bank", "colour": "#7B6F1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773170403, "uuid": "813194d3-8c53-4b92-abcf-3a070abaa172", "comment": "Malware payload", "value": "cd3e3e141a1401f0e72c3d458b7796a38eff0ce0d9ff071d5a0b354069a0fe2313547b1ddc6712bdf8ef3d159ca9c943", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Uzum Bank", "colour": "#7B6F1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773170403, "uuid": "2566c6f7-b29a-414a-abe0-43be1a43f645", "value": "T1C0D5D011BE92AA03D5BF9338A4F683406637BF809F83D7272148723C65B7BC54E56B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773170403, "uuid": "4156f5ff-2c13-4dd7-91b0-0e2ee523e299", "value": "49152:b8pTQWZrJ2w/HDLIAi661QL2yr6q53gPGl6W7EQke:UQOHjbL2y+6gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773170403, "uuid": "b2942a80-7a25-45dd-832d-3b6378df9e1d", "value": 2824597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773170403, "uuid": "53a32ca5-b400-413d-9e13-88bfbc0dbcff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773170403, "uuid": "62a76ce5-2b92-4632-8200-6d856163ef4d", "value": "Uzum Bank \u043e\u043d\u043b\u0430\u0439\u043d. \u0423\u0437\u0431\u0435\u043a\u0438\u0441\u0442\u0430\u043d.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7bbfe1-1c97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773157350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773157350, "uuid": "6dec884a-f2d5-4531-bf13-6d19e2697357", "comment": "Malware payload", "value": "e29930e6d97fddbed1ff70772f919c3f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773157350, "uuid": "54853b83-8fb2-4319-8e70-479a78aa1b71", "comment": "Malware payload", "value": "db469e31109bd531129316c72680b9c30a6bf429480d2508b4ae416db2fbbca1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773157350, "uuid": "a0a2986e-fb43-441a-9885-0084a59a9e39", "comment": "Malware payload", "value": "62420b145a7cbb66de010fde5cf1ad582a220c7b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773157350, "uuid": "939dbdf8-c1aa-491c-8224-b83f9c510366", "comment": "Malware payload", "value": "de559a6f98b0c5103a5ebdd5e971cbe748a653123459a59061e757cb6bb3bbf8c9508400601f4760a022b2c443a74de1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773157350, "uuid": "045de69c-4ec7-4877-bc44-e9f89442d1a1", "value": "T12AC3E04E0C6F4418999F3C27175BA846DB31A70B2B0ED981F76CE7652F58E6F00AE493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773157350, "uuid": "1f019410-83fa-48d9-a9b0-a42124a9136d", "value": "768:cxKV5pGKB7EvV53qjFL/vQdtLt2aQdm2btS8mjyxHIwmHLnSu57td7XSymOjLUBX:d7EvVGAodbtSKHIwm2uL5hWZhL+ppc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773157350, "uuid": "09925c02-f7de-42df-925e-9f593f5a858f", "value": 123925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773157350, "uuid": "6bb307d7-c7bf-4072-a6fe-99f334c31e5d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773157350, "uuid": "bcc61d7e-4312-4e5f-beae-dc7be2fc4c44", "value": "External_Notes_Monthly_3626.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a567c762-1cac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773166326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166326, "uuid": "dd9ef274-6ab7-4131-8672-904c275bea1e", "comment": "Malware payload", "value": "0d2e19f6aa9df661c7979f570687b8a3", "object_relation": "md5", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Multiverze", "colour": "#2E30B1", "exportable": true, "hide_tag": false }, { "name": "RedTail", "colour": "#84ADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166326, "uuid": "48695cfa-a611-4ab8-82d7-09e2aff7a55b", "comment": "Malware payload", "value": "db7fc2fef4f644d06e378b426e9a5a5c5ac7c29fb0d09ba56903fed1dbe6843b", "object_relation": "sha256", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Multiverze", "colour": "#2E30B1", "exportable": true, "hide_tag": false }, { "name": "RedTail", "colour": "#84ADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166326, "uuid": "bd4759bb-6c1a-43c6-b173-c5ff29edd654", "comment": "Malware payload", "value": "fef8fea12386fbc7277ea38e7963266c0da11dec", "object_relation": "sha1", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Multiverze", "colour": "#2E30B1", "exportable": true, "hide_tag": false }, { "name": "RedTail", "colour": "#84ADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166326, "uuid": "a3830156-048d-425c-b589-29f49cc8c1f2", "comment": "Malware payload", "value": "499bbf2cccbb39533eb5101545c100e6e57a73635027862f11a0d393829ec4966dee9c6c9b6094e6dfc7a939fbffc0fe", "object_relation": "sha3-384", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Multiverze", "colour": "#2E30B1", "exportable": true, "hide_tag": false }, { "name": "RedTail", "colour": "#84ADCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166326, "uuid": "e9ee2104-a7a0-47db-9b1d-d65f182ff363", "value": "T19907AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166326, "uuid": "26b2e67c-8f6d-4b9e-b94e-9ac69a45f422", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQp:cqYUQuVDt0TZEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773166326, "uuid": "26106aa3-e3dd-41a3-87ff-1d8045361969", "value": 17629184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773166326, "uuid": "4a6d1841-288e-4da6-b102-595489b75554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166326, "uuid": "488f03e8-fb56-457e-a51a-58ebb0dfeeb3", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e663e0-1cc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773174789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174789, "uuid": "239d2ed0-cf9f-4e00-b8c7-593734e47662", "comment": "Malware payload (Mirai)", "value": "575b0fc7203718ad492b1d4679f063c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174789, "uuid": "500dbebc-41bf-44ec-95e0-fc6907267858", "comment": "Malware payload (Mirai)", "value": "dd0e62da03a0015aca6da4663f78fcc7a05bfcdf6f2153ca4c6fe71e5ca0dc23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174789, "uuid": "8e9ebfc9-65f8-4c18-8d6b-aca0339ed4b2", "comment": "Malware payload (Mirai)", "value": "279fbc0971802cf030036d29d93ab5c2e2e393e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174789, "uuid": "02cb55a3-ff4e-4864-8372-15eea8063b87", "comment": "Malware payload (Mirai)", "value": "695e8ec58c378b8894176366185c16179a05b49f13b79a31ea619ff20a23e0e998ded7b0a97dc9dfe6f40a273b174f7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174789, "uuid": "2869ec95-a2f5-49b8-8aaa-ea2157a98b0e", "value": "T125834C0173644F0BE8AA0AF5282F17E483FEED9021F4F5856A0FDB5A4235E37155AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174789, "uuid": "b3109160-da77-4d52-9edd-38de708874c6", "value": "1536:7QHQd18Vez/S1f+39FAwFKtKHXwesGXxdu:7TdUXXesx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773174789, "uuid": "756689d6-d530-4199-8712-c61b8c71bb95", "value": 83040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773174789, "uuid": "c2228a9c-b48c-4f2d-9d28-c363c42e7850", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174789, "uuid": "a9b889bb-481d-44e4-94fc-a40688b0e269", "value": "MMaaRRiiOisecTanee.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f6ddde-1c4c-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773125177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125177, "uuid": "47d78465-0a43-412b-a65b-b93fb8a6b552", "comment": "Malware payload (ACRStealer)", "value": "55ba58159c835dabb64ab4016d88dbcc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125177, "uuid": "df19a3a5-b7a9-44bd-aabb-6a27e275733e", "comment": "Malware payload (ACRStealer)", "value": "dd9d5a825771588aa9173933dba188bb40815188774e72381f20c0590fc01d81", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125177, "uuid": "60521927-f0c1-46f0-9b0a-1319801fe5b7", "comment": "Malware payload (ACRStealer)", "value": "27b93e6c2d07a71a524dc1dfd662fdebfc197276", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125177, "uuid": "d438a1d6-ce23-41a8-937c-e10f1032d52a", "comment": "Malware payload (ACRStealer)", "value": "0b93b7c29ae3e34a758746fee075045ba134bdb7f3d5410e71874fbf91ddd896103445968bc9152ca18da4f2fc090fd5", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125177, "uuid": "c2a6f351-394b-4aaa-a0a3-b0afa58c1105", "value": "T1D826F1306ECE5132D9D833BDF5A06105FD587C84D2A806BFACA47D853DBD80B6D7982A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125177, "uuid": "177f127a-0bdd-4ec3-884d-32620143ff5e", "value": "98304:WjnM4ZDg4PnDYTiYk5FRvYdkL/ju57vBobMF8BI3gFSUhD:WTTZDjPDYTI5FRvraVpobCgjhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773125177, "uuid": "01f125bd-6052-4660-9ee4-f862c2b42d4f", "value": 4760816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773125177, "uuid": "823563a1-3910-41cd-812e-a863acbb053e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125177, "uuid": "e0cab41d-9dd6-41cf-9d5b-64a252487911", "value": "acr-karimichikstrelyaet-639081475329349420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e6104c-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773127430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127430, "uuid": "20e30a38-6411-4dc4-9077-755364ddbdcc", "comment": "Malware payload (Mirai)", "value": "6ad2262539462bc1247b6899d3ac33fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127430, "uuid": "1bc9f1f8-447d-4f59-b8e7-b6385a4107b8", "comment": "Malware payload (Mirai)", "value": "dda0734b5bcfdaba9443f389f34ae3a01e1a20d9f29ed941179e35efba317985", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127430, "uuid": "0ef7c6b5-e53c-47dd-b604-4630e71efd54", "comment": "Malware payload (Mirai)", "value": "1afe602c90e7bdedfbc2d2e9347f1c05d2a5bcdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127430, "uuid": "0971b932-925b-4ca0-97b6-f9805c97c20e", "comment": "Malware payload (Mirai)", "value": "e21c1dd64db9ebb04f42329125e7a2c78e9b7fe0ee2b70be4506b2952d2298346f275b9afd2cdae5667bb6d0a873f51b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127430, "uuid": "8904caa2-f358-40d3-ac73-05011237bdbf", "value": "T14F155A98EB82D4E1F66300F00EDFD7E35A3467165063F6F2EB8E269374327516E16229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127430, "uuid": "9468d9b6-79a1-4ae8-b2bd-cb90c11c5d2c", "value": "24576:qI8hMBhITsfj4iOSssiC1mjCkScJ2pl4AI:q7hMBhIswtAlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127430, "uuid": "864f7f93-7110-4ae4-87df-03df63bfc09c", "value": 959624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127430, "uuid": "d532699b-377d-41dc-a136-b09b9019ee8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127430, "uuid": "2b40722c-fa7e-4a94-9cbe-dc491de3d952", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a7a396-1c30-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773113075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773113075, "uuid": "a7bbc51f-5183-47de-8ee5-be22fed58144", "comment": "Malware payload", "value": "7a36bbd883e11e2613e183c0962d35a2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773113075, "uuid": "dbac9221-825d-4020-b5d9-e3208e8c3dae", "comment": "Malware payload", "value": "e1089a05b53ae337e5a2d066890742aceeeed0a52df04feae18a8ffd01579cfd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773113075, "uuid": "a58d339a-a82c-4b01-b065-e1f209ae35db", "comment": "Malware payload", "value": "6e06997592a7c5ff0b4edf647253e739325fccec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773113075, "uuid": "76d49316-f185-4c47-8494-3ddcbbe30989", "comment": "Malware payload", "value": "8a789bd17a458ed80bf69929d3245ed3e164e1f307524b3df36ddb75ecc63e3269132da8c3e56ebb2aaabdd496bf659f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773113075, "uuid": "3a7aedfc-2082-458d-b280-f39d60c5ab26", "value": "T1C3657DD1AB8B80F2E28B1535417E624F573AA9B04B11C1D39295AA7FBD313C2953F287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773113075, "uuid": "36c9e980-04d1-45eb-b34b-3c1498ce395d", "value": "847a45d062eb47396c44bc45e2686a25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773113075, "uuid": "644892d9-3a4c-4cff-82fa-e00dde846959", "value": "24576:H+lJLctaWp+VUtHkNijSkZFdW0EjDm51FOL/PmUTtFVqLxFFRv2Eb:zT+VUtHkMjST5D61FOL/PmUTtFVqLxrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773113075, "uuid": "4d269cc6-cd9f-447d-acd1-74bb91f42ad2", "value": 1433600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773113075, "uuid": "7503a0b3-1cff-43ae-9584-c414e1cdf68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773113075, "uuid": "dba7b3cc-4118-4968-bdc3-53e854229287", "value": "SecuriteInfo.com.Win32.MalwareX-gen.87741952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a6a92d-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146333, "uuid": "6989fb29-38a1-48c9-a594-b1a87cd4aaa9", "comment": "Malware payload (Mirai)", "value": "259928faf739a3f4fbc0b95193239a56", "object_relation": "md5", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146333, "uuid": "0ff788e6-aebf-49ff-825c-cd8bdb94b0db", "comment": "Malware payload (Mirai)", "value": "e25df703aea420b6b60a6c1e6b9901c7a74f79c393a708486a4cd6bba6dcfd20", "object_relation": "sha256", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146333, "uuid": "34c4c059-98d6-4908-8422-5a857c2e90ec", "comment": "Malware payload (Mirai)", "value": "43cfd47dfe01dd611f4cd3c70b428160741582dd", "object_relation": "sha1", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146333, "uuid": "868a559d-9296-46c8-973c-deb2eca61b5f", "comment": "Malware payload (Mirai)", "value": "fb2ba9e9bab21a700e1d90a50dfe569045c392bc6e26d3c942d25acf976c3827df7173f5c07ec8e6c40ae61deaca235f", "object_relation": "sha3-384", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146333, "uuid": "b14d6d0a-dd95-4532-ba9e-b52b00e9f29c", "value": "T107C3AEC3FA8714A1C46206F003C71BAD6F93A121CE5FE4E7AC1DB63B5A7A4DB1916781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146333, "uuid": "37af95de-dceb-4685-b493-c4292e165977", "value": "1536:DcjBfdqDkFJ9MStjbEI5WOoP/9U/D9Qzld8a2lcqxs5Rlg9iEQ/LWJ:D6fwDu1bEOn+/9Ub9Qzwa2lcHgOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146333, "uuid": "f7bd0312-4750-4048-af3b-f8ad459e8434", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146333, "uuid": "5d0c2517-be37-4bf0-bd94-e2f398d983bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146333, "uuid": "bed7dfd3-b9db-436d-bbf3-da7cb3e47d65", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955f7769-1c92-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773155132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155132, "uuid": "9fae5dd0-3da5-4185-ad3f-be1e4aafca0e", "comment": "Malware payload (AgentTesla)", "value": "1d7b1c9416183e47d55d6485c8275220", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155132, "uuid": "91659efe-36f9-4432-93bb-3822b0fcf3d5", "comment": "Malware payload (AgentTesla)", "value": "e2f688b63574e73861df42ff4f7802da67f97c2f2d1f6436ab3212287e0762ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155132, "uuid": "a102b856-1dba-41c9-92dc-c0eeef9cc3ae", "comment": "Malware payload (AgentTesla)", "value": "61064e4ef8cc90c1cf5f1772558170c8b978e799", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155132, "uuid": "cc239417-eb1a-4432-83a2-27023b5a89d4", "comment": "Malware payload (AgentTesla)", "value": "f2691561593d27947f0e425d1a6aacfc2906fd297ef27d8dbbf43b97c76804fdaeab7039f58097bb73776d8edd2243f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155132, "uuid": "579f4bec-389e-4fb8-afe1-09c3e3d30fe8", "value": "T15F45C00273D1C062FF9B92334F5AF6515ABC69260123E61F13A81D79BE701B2563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155132, "uuid": "f324ed2d-047d-43d9-8df5-f2158e073e5e", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155132, "uuid": "306c37f0-6d20-43ac-8723-fa61c1b82d74", "value": "24576:qqDEvCTbMWu7rQYlBQcBiT6rprG8am78bDP3/hUcB7l:qTvC/MTQYxsWR7am78/PhUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155132, "uuid": "ebf04ae2-7fbd-4355-8abd-2d9240641d1c", "value": 1206784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155132, "uuid": "e1f6ad6f-d557-4c70-bc7f-09e11d4e9ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155132, "uuid": "9c824314-7a6d-4ef3-ab5f-a54762d250a9", "value": "Ramona_Vessel_Particulars_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a587e21-1cc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773177850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177850, "uuid": "769c459e-84dc-451e-b2d6-455bb427cefa", "comment": "Malware payload (Mirai)", "value": "7249db7c8c315312c6af2f11e5e03af5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177850, "uuid": "f98e7b6e-e3b2-4992-9cbc-8c13052da5c9", "comment": "Malware payload (Mirai)", "value": "e4cba3e8f78121f6fa1b5b4bcfd22e1197a82190af5faa46355cacbb9fb8f79d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177850, "uuid": "176ea970-1f84-4af5-9532-c039a05a242a", "comment": "Malware payload (Mirai)", "value": "eff4e2c6f22f4ff5825d8bf1f125a22f0d2e1fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177850, "uuid": "409164b5-ccc0-4b86-9895-5f934088e25a", "comment": "Malware payload (Mirai)", "value": "62b2e80140d65b6a86b74190014b0f85e4498500c8b84cf824085961163cbaaef6022b30831cd10e58e632132ec3a8b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177850, "uuid": "aec5ff53-9d54-43a5-9c64-74f4b577f913", "value": "T120F35D86EA408A13C4C61777FAAF014D3322E759E3DB73068D185FB43F86A5E4E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177850, "uuid": "13830cef-5257-4269-8f56-1952e779c03b", "value": "3072:rPFsu+bVZFpfnHpKhjiYq5Yw6j+rwGy/h9FxE4fX6OxM/9eckdAr:z2u+bVZ/nHwMs+rwGy/3FvfKQM/9e1dQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773177850, "uuid": "b7d8f2ec-8800-4a46-a9c4-229079411a33", "value": 163542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773177850, "uuid": "31aea97d-f087-4a7f-ad0b-d1c64e0a1c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177850, "uuid": "048381d0-ad54-45df-b371-35c31d5173d1", "value": "MMaaRRiiOisecTanee.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ff68e1-1c4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773125333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125333, "uuid": "482a7527-3ace-4b2a-971c-87a394c075d1", "comment": "Malware payload", "value": "7dc5f190b90205fd7c5d166ad0ca3179", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125333, "uuid": "4c7776a1-abaa-4863-bcd8-033ffce8c518", "comment": "Malware payload", "value": "e67f0ecc3a2685a80d135066c7f49ed81839aa04c6e8e693ab624a1f4b9ced56", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125333, "uuid": "9eaa5bb8-2946-4cd8-94b6-952a21f96886", "comment": "Malware payload", "value": "72eda24b07673c9aaebb161c2dd5b7ece23e9ef3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125333, "uuid": "a4f52299-3409-4d37-b478-14d42e8cec98", "comment": "Malware payload", "value": "3fc14a89bc096ea6f0e7b997616a0dbe31c5e77fc25ccd57e0852f24187b9f304756883398f3daa3cbceb9d9a7975d66", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125333, "uuid": "0a032a06-6701-4b82-8686-002de43c96d9", "value": "T12C925DB512896C79FBD0CE39AF3C7F4CADE8C2C42124A3ADBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125333, "uuid": "54de11b0-0d9a-4c58-8a5a-3124b318dd3d", "value": "384:yFcuQpWx+BL0SWL0gxzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:yF8i+BL0SI0GzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773125333, "uuid": "b2546fdb-ff66-4776-bb93-eba8a69bcfc2", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773125333, "uuid": "a0e3724c-f6d2-4817-9b90-25846ac2e740", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125333, "uuid": "100daa78-a57b-4788-a211-bc60d0de7e9f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a230329f-1c7f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773146993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146993, "uuid": "96357323-db54-4754-baf2-86e1f6e5d010", "comment": "Malware payload (AgentTesla)", "value": "ac0502103294b4ec884ec6e3673d0807", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146993, "uuid": "324e66a1-4562-4866-b724-e47a8f98cfc6", "comment": "Malware payload (AgentTesla)", "value": "e813c38d77394e96cbe31d088798a866b6eadcf22342a5149a46844dc84e16f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146993, "uuid": "48233ae8-dbb1-42fe-9896-fcd429af436b", "comment": "Malware payload (AgentTesla)", "value": "a17f915437167987ec83c108a73427ff7ab0c0f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146993, "uuid": "e5a8e056-2b18-4679-8777-d0b9cd46693f", "comment": "Malware payload (AgentTesla)", "value": "8769fe7e5a264d77764d46f1050797d35bca3b31e0c079e64e87f92c6a671a11de265b1cbf5bb2648956a27814c210be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146993, "uuid": "d6095809-4101-4431-a6f0-8a803b20dee2", "value": "T19F36B6449369F835BB2F0EACD03F6A901C28625316847F9D37B53726B2E6B83526D1F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146993, "uuid": "6bc583b5-c468-4af3-9d81-95d4d5b5c53a", "value": "98304:AFxcB4dQhPaFR052IAOrdzP0zikcfLMJd4:AP+LPaF8BzcFcfL6d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146993, "uuid": "96043fe9-99b7-4018-b446-c3dc0d3e3582", "value": 5003939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146993, "uuid": "f30d2a26-035f-4e9f-92e5-d65e4dd6bf9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146993, "uuid": "1d9507f4-6721-463d-b3a8-3513caddce65", "value": "792725328.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6635f24d-1ca0-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1773161066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161066, "uuid": "1eb234ac-a4a7-405e-8e9d-edfd8cc45fbd", "comment": "Malware payload (SliverFox)", "value": "422b6b2e16809f8ad2261e1fce2646e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161066, "uuid": "748eb990-77de-4538-808e-817a2bf009d1", "comment": "Malware payload (SliverFox)", "value": "e9d138b69cba67e599a084189889089f752a955cfa77741fd93be188220752b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161066, "uuid": "6137eae5-a1ef-4efb-823a-9a7eb42ae39d", "comment": "Malware payload (SliverFox)", "value": "f66989ca401fe7283a310952ec1d1469aa9de84a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773161066, "uuid": "d56b82ca-a9ab-4e91-917f-d881ea3d9b4d", "comment": "Malware payload (SliverFox)", "value": "eda6af55e77e80b0a977cc2d77df6ce66d70459aee9253bdc774823e9882c2777840b779bd5dbebe843199f7c1b5d32b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161066, "uuid": "f33284c8-24ea-4987-b40d-b7e40069fd86", "value": "T11C752347DA83CDC3C169A138847B17523EA27A2D5D105B1F1592BBCB1D73AC6CDB8EA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161066, "uuid": "5bfcd9d4-8d73-4689-b2e0-4a14f549aeed", "value": "0ddb4c08073295d50c871b00d3ab92f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161066, "uuid": "fc0bd02a-7121-4861-8132-10778ede35bf", "value": "49152:y6uXxjOF63vNjBL0DYwatQPKK2DdVFJftmTkOUG4:y6uBVfNjpXwKzKk/uG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773161066, "uuid": "bf5cdc1b-e648-499c-be6d-5f6c454dacea", "value": 1667072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773161066, "uuid": "a3a67cd5-bd00-4a76-949c-fb2e4869d398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773161066, "uuid": "312b5626-bf61-40dd-aa88-e6a5d86d687e", "value": "2026\u7b2c\u4e00\u5b63\u5ea6\u5185\u90e8\u8fdd\u89c4\u4eba\u5458\u540d\u5355\u901a\u62a5\u4fe1\u606fPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15524216-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146327, "uuid": "939f7af0-ea34-43f5-ac9b-1fdb781b51ad", "comment": "Malware payload (Mirai)", "value": "a53485b5394ccb5197543e018eda64c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146327, "uuid": "93ec0cd9-5c2e-4007-a288-73240e474d52", "comment": "Malware payload (Mirai)", "value": "ea950f9383469f40c447646e104b453d3d4f7b06f08536878de7293424ddec75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146327, "uuid": "1af5d631-99b8-426a-91d4-627e3b2d15a5", "comment": "Malware payload (Mirai)", "value": "10785f337d6b20dd93045e153a8f2e1b307ac689", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146327, "uuid": "f71e4b6a-c2e6-4ebf-b15c-d109cd87679f", "comment": "Malware payload (Mirai)", "value": "f2e24fc0678160cd9f1c25fe7f04e192528ced790c29ba4ea14acfad7f8e163eff68d7ca94fe1ebe3b417b73958d412e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146327, "uuid": "1300b502-0c56-4d6d-b415-ba07de4eeb15", "value": "T122259D2AB2B3B2BDD007C03447CBCAB15531F0355A312DBB26C4DB343E9ADA91759B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146327, "uuid": "8c947c9b-ea35-49dc-b80a-d720a6b2bcd2", "value": "24576:jtLpZqBxS/3Xc+NgM0oO++FQaOJkvlr0FdkY:9M+NgMX5aQfkNwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146327, "uuid": "aade1af7-e3b3-4293-a6a6-ee7398be2846", "value": 976088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146327, "uuid": "ba9d108c-079f-4d43-95dc-a81bbc6ae85a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146327, "uuid": "3247aaad-c30d-4df3-bf15-0cfdf61a2154", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9603c6-1c68-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773137189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137189, "uuid": "90905589-d5a0-4020-b6ec-2a7b1b47d8c7", "comment": "Malware payload (RemcosRAT)", "value": "faeeeb063ff4d8bbfff9a1fae1b71ca8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137189, "uuid": "8f090594-d00f-4d2b-85ec-c549a516e942", "comment": "Malware payload (RemcosRAT)", "value": "ed925501e749cdc073143ed948ec8a93c6b6a4b76304d9c6a76c6faabc8d048e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137189, "uuid": "1cc6cc73-5aa5-478f-8ab9-dc58b036e851", "comment": "Malware payload (RemcosRAT)", "value": "7c66dcd951d4795fc8aae773f55aec385cfd1c7e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773137189, "uuid": "18ae8481-ce91-49b4-ab9e-d85f5a61dcd0", "comment": "Malware payload (RemcosRAT)", "value": "62ff266896e8f3c8b71d6e9fbebc05fe88e86936f2b636f08d98404ac9123c8d89f46bea28c90689dbba106d837d58fc", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137189, "uuid": "759ef8e7-ad85-4ad0-a3a9-a0b3456a3cd7", "value": "T180231A9A1ACCE7F5C09145F05DE5A90E0C080F2FBEAC5A39F91C56C6832226B17B5A1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137189, "uuid": "b2329e52-af00-4e22-944e-95187db60d5d", "value": "192:EuQrPCqIAuA7dRT0BYA34Pukzpxu58TdD4ubux:EVrPCqIA9df5Td4Wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773137189, "uuid": "26441dd2-a443-41a7-8fc7-a63aa626b0c5", "value": 46681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773137189, "uuid": "a0b09147-6b46-4cdf-afef-064beff6f344", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773137189, "uuid": "acb19faf-f5cb-4191-81d7-b37d485ce2da", "value": "goodwill.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4901253-1c7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773147050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147050, "uuid": "7aeeb235-7c81-4161-8652-3736fdd75d33", "comment": "Malware payload", "value": "96d065e26e73a0cd346056b7a378e658", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147050, "uuid": "d8215453-3b8d-4252-b34a-4c5a42180a5d", "comment": "Malware payload", "value": "edc242b4a81011d254cbad1b448cab9883d9253e9d9a354804cd6d6067f7cb7f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147050, "uuid": "413090ed-7b60-49d5-8591-0809a7727acf", "comment": "Malware payload", "value": "b6285575df1c54b5801e150ae6d8ec239ede3869", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773147050, "uuid": "f1faeaff-7bb7-457a-b29a-b89a07710e66", "comment": "Malware payload", "value": "965f6f9c1ca62af6bd4efbc3501fb77951c81c42f4f040a676aadd6e7ce0a13cef3f4282dc8fec23f62e06eb29b63c4e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147050, "uuid": "43d4c32e-010b-4484-b09d-2a1e2b9f383a", "value": "T13273AE07675E87872603842EB38025562018E5DF7DFB3721346EF93362E178DBB968CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147050, "uuid": "98afde73-119c-4435-a94c-740b9424a81f", "value": "1536:IKsZjdofwNOlaQkbCdCd7wwwNTielAVVVVVV+qqqqqEfffffF:IPl5mrAwwwxiel9qqqqqEfffffF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773147050, "uuid": "01607003-88ee-4c70-88a1-fba8d3d82cd7", "value": 78193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773147050, "uuid": "4c3b018b-9c4d-4e0e-848b-80dd9bbf4fb0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773147050, "uuid": "b9494320-a8ec-4478-9500-94796cb73d21", "value": "8921c6d8-9318-413b-9060-d92caca9ced1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0340fb3-1cbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773174531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174531, "uuid": "f151cdd2-11e1-4b5e-a806-7e20162faad3", "comment": "Malware payload (Mirai)", "value": "98201bd1e5402304e58fb238b9472dc7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174531, "uuid": "eeb39a5f-eb9e-42d4-99ec-489dbce8a831", "comment": "Malware payload (Mirai)", "value": "ee049e30cb33ab713c24efa7dc1032f2de4d5e3b2855574c25aab0ca728ea0df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174531, "uuid": "8eb3d84c-64fc-44f3-8462-84bb4317f193", "comment": "Malware payload (Mirai)", "value": "9a909857161a1fe769bc2d453e4f724d0e2590d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174531, "uuid": "f2b9affa-00ec-4f55-aad9-cad0540f2f93", "comment": "Malware payload (Mirai)", "value": "83e2fd852ae1b4d412d0b361945f6c023a8dc14a0e0407666a8a8a80ae3bb90920e9693cf20e34b502ce5c69001d88c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174531, "uuid": "fb74e464-8353-4222-998f-71b3ec214f00", "value": "T1685197DB62A1093559627617FFB9CE3CB6C8409738EAAF04A4FC34B5568CDC87848A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174531, "uuid": "8826fda1-4d26-4f65-ab2c-19c45d21ce0d", "value": "48:io7hmVoNnE7oQCX0oMePgoaZazvZSoafaFvjko9N39z4geDopjczoASvaLojZjzl:iKmV+E7EX0QPg1gzvZS1yFvjkWzz4ZDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773174531, "uuid": "5448e382-b171-4113-9803-9349780490ce", "value": 3035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773174531, "uuid": "940426d6-2736-4665-8e41-959108fc96b7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174531, "uuid": "68daeda2-0c70-4085-9009-2388333ad405", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61ae490-1c4c-11f1-a769-42010a9c0008", "comment": "Malware payload (DeerStealer)", "timestamp": 1773125095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125095, "uuid": "ed74b4bd-31a0-4ba7-ad89-7990d950351f", "comment": "Malware payload (DeerStealer)", "value": "2e778fac021722f40ec5664aafcb1fc5", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125095, "uuid": "41fa86fe-78a2-40df-890d-1d71fa504646", "comment": "Malware payload (DeerStealer)", "value": "ee5e941218bcf1285b2640c4b2f8baf3ffa44a73b6894ce871a22cbc24b80600", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125095, "uuid": "927cfc1e-6e92-467c-84bc-500d5125b3df", "comment": "Malware payload (DeerStealer)", "value": "84573542d266c0f7632e86ca065e35a93e623ea0", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773125095, "uuid": "16f04932-3cc1-477c-8c2c-4ccd6e52f1bc", "comment": "Malware payload (DeerStealer)", "value": "347beb6205cf0f8aed0ac9666918e03c56559deca4c05db8f2c3e09a89eb50bc716c9a3df2791c2ddf22a646efaf22cf", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125095, "uuid": "36a2ce4d-54d8-4ba4-9a42-51e1fc27b7a2", "value": "T168D6331F35674B16FCE3A374271981624FA52C33A311F6FE682BFA542DB17ECA961201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125095, "uuid": "8d8f295c-2dc8-4c5e-9cbb-ae37d6c2bfe6", "value": "196608:tQwzHhZC475iPHQXCeXIld3Ph/0UU8I0k9JCoE2UUyhOYfvwT0xvSc2e28zBf9Z:GShCHmx83PZ0X0k9g2UUyXvwTb1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773125095, "uuid": "f8bd10d8-503b-4785-8432-6470a88a38e4", "value": 12632064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773125095, "uuid": "faa9124d-95d6-41d0-8ae3-5d0334da9b2a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773125095, "uuid": "fea412a8-c4a3-4e59-85ee-4aab9ff5592f", "value": "RVJVAUQL.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e228ff-1cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773186615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773186615, "uuid": "36e58a7c-5c8c-417b-ae90-51ca5c2d04be", "comment": "Malware payload (njrat)", "value": "085ee6025cf34362132c770009831c6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773186615, "uuid": "75bcacee-1594-413e-a86a-766d1b29bb02", "comment": "Malware payload (njrat)", "value": "eff8a9f48e98e52609f75d9ab7baed6f695c2557b29a52f6df48a5f6232f0674", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773186615, "uuid": "f630be94-2bbd-4522-b549-31d51521b727", "comment": "Malware payload (njrat)", "value": "fe9da07158274e8b89a582a3e9c91176c46b45c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773186615, "uuid": "83767276-8bd5-4090-9092-bacf8b5d68de", "comment": "Malware payload (njrat)", "value": "6bbe54457573ee737ea439a7f7e165eb7610113d68de88784827755455c919833e62682434772347859cb83abf0fc854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773186615, "uuid": "89298835-c2a5-42ce-abac-42c22dcb1aff", "value": "T16713D74CB694E174D5FF8BF1B4A2B2890B71A01BA902D30F99F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773186615, "uuid": "848342d7-43d8-49a4-bd7f-7d7eb844cb65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773186615, "uuid": "70d0a6df-2cb5-4e10-ae62-e1f527f9e17a", "value": "384:sZycwwdsbhKIyKjnN9HnO8qEK7rez8Iij+ZsNO3PlpJKkkjh/TzF7pWnFEgreT0I:KrZiwFKjnNRnfY8uXQ/oIw+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773186615, "uuid": "37054a52-c868-4be9-a3f7-fb335da7890a", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773186615, "uuid": "34d51edd-df65-452c-a3cf-c35cd36ca111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773186615, "uuid": "1826de90-4c86-4b0d-b034-963706e03a15", "value": "085ee6025cf34362132c770009831c6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe189f1-1c50-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773126615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126615, "uuid": "91c773f3-c1a2-48e2-870e-4b4d1c783466", "comment": "Malware payload", "value": "aae3ff3d8aab0182bc0dcc51ea68a2d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126615, "uuid": "d8541fff-79d2-45ab-ad79-47411e4f7799", "comment": "Malware payload", "value": "f04636f6eb57e3dc28dc42e426325592311e9a3ccc76cd6c05e15f376e64f914", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126615, "uuid": "6a0da67f-f3f2-4e38-8157-fd770446bb20", "comment": "Malware payload", "value": "7766d420536940b68ff7b1fd47e0cc66e784ee1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773126615, "uuid": "3f470016-ac3c-4146-98c8-f93e1b72c0aa", "comment": "Malware payload", "value": "7916646e6c9f54d87db61451c9659cd4576efe7b30c7010880e7c5c35298eb74fad38a7a9e193ba69ed25d9a2df0d67a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126615, "uuid": "8d1d35e3-c865-447c-b511-9f4520c8a002", "value": "T1B0658D5DA2FB00F6E69F85398556920FE73178280711C9EB9390CF7FAB23AD12539B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126615, "uuid": "4a809138-4af7-49a7-a743-a85847eefb60", "value": "37ebe875dd3f1616494e9801de382f68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126615, "uuid": "0f9cd3f5-0f08-4a79-9075-7d44a147a6d1", "value": "24576:cN55Inj8xmpk081E75m2iRcr8gX6OB8GrmCLBDKjHZhFBFsD3++sLV:rh781E75m2iR+L6OB8GrmFjFsz++sLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773126615, "uuid": "4eebf781-2f3a-4736-b130-9ea2fce16828", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773126615, "uuid": "0c1bd3aa-bd69-433d-83a1-61ab9fc06ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773126615, "uuid": "0b960848-95bd-4197-9289-19417561c906", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cb8396-1cab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773166004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166004, "uuid": "bd59eb41-2363-49c3-b90c-f01e69f4136d", "comment": "Malware payload", "value": "d37284d8f67092a46281d6c63ed692f9", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166004, "uuid": "a9998831-f037-44a2-b15d-5b0db2b1c08e", "comment": "Malware payload", "value": "f05fb1209588a8b4ca7812823924b9add97cdc5c9b64daa8164ff5f8799b5a05", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166004, "uuid": "2c96baff-6d86-4674-8115-928bf5a3afaf", "comment": "Malware payload", "value": "8ebfd65fd168eff2a8f8680d8b0f529501a75674", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773166004, "uuid": "ef001457-00d5-4ecb-a5ad-dfe15d3eaa7b", "comment": "Malware payload", "value": "b824caa1b1f400aabfb596db4b06e00d124b0b2da48c8823b29fdbda2da6a4188eebb7a12373156ca80e25099bc96a5a", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166004, "uuid": "c0d94ad6-6832-4571-aab8-d49974db251e", "value": "T18066BF8DF296AAF06458A7EE9307708C2711217B67F7244E92E4908D3E0DB53B678D7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166004, "uuid": "8cfab920-10d8-4efb-9456-a5607dd69587", "value": "24576:0ZMAeGZMAegZMAefZMAemZMAeTZMAedZMAeMZMAeqZMAeQZMAe5ZMAeiZMAeQZMA:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773166004, "uuid": "7dcf62ec-1648-4b24-8ecd-1da1240d7b64", "value": 6629424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773166004, "uuid": "10d878f7-0e52-4d88-bf62-855db38f2cd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773166004, "uuid": "70ed2d0f-cfd0-4fae-9ba7-a5edd761e258", "value": "owner", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8013da48-1c93-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1773155525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155525, "uuid": "819a59db-90db-4314-8278-d85e38b08a06", "comment": "Malware payload (MassLogger)", "value": "e11dacd53c1828c493e71d531bf713d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155525, "uuid": "46c8ffa6-4331-4399-b6d1-9aa2a7a70b4c", "comment": "Malware payload (MassLogger)", "value": "f0cad84b1a0304c28e8816c4b7002659db92238b028a9f0a86008a56de57a45f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155525, "uuid": "3bb99880-8298-41b8-aa63-70454561b2f9", "comment": "Malware payload (MassLogger)", "value": "23bfb1c1e9ef886964e8b11eb927419101b284ce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773155525, "uuid": "56992b23-1f3d-4c3e-a6b4-53d3c5a0da97", "comment": "Malware payload (MassLogger)", "value": "e4e19e265950293b69c70ff05c052c3abf4fd88b438a9add931ccacc49e12f6dbf09c7ff3b6587df5df3c4c6d393255e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155525, "uuid": "85d7844c-0bf3-46ef-b52d-27e6930c8ae3", "value": "T1BA65A0B5E6BD6BAE0B48011F6073637FE0B289F522A5289E7B73D9107F920CDD15129C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155525, "uuid": "c50d4a10-d2ad-4ed2-875c-335909449172", "value": "12288:AYyhlTA/dcx/6GZTQS83LgO2XumEu1onDA2g2M2qOLAcg6nojIAeghHhfVc5pCjc:sTGvgwVEIBghBNSJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773155525, "uuid": "778dc99a-997c-4cb0-9f8e-22588a4c9b03", "value": 1537919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773155525, "uuid": "6510292e-49d9-4f96-bf93-61a2c7fac212", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773155525, "uuid": "26797813-a9e1-435d-9742-ca43d7cd4379", "value": "Rail Extension (Nakhon Ratchasima\u2013Nong Khai)_RFQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d622b9a-1c66-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773136033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136033, "uuid": "9fb96650-38b5-495c-8fbd-32eaec61fa92", "comment": "Malware payload (RemcosRAT)", "value": "dc7e263db476338048458409bc7abb2c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136033, "uuid": "1f3e1bee-f31b-4b6d-97aa-94c8ff5c309e", "comment": "Malware payload (RemcosRAT)", "value": "f114b58d5a66ad7aa123f5acbfb76d46d7d476c4b5b244a663a2f2cdd1c95a64", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136033, "uuid": "5e0d6641-59cf-464d-bfe8-8e66674ccdc6", "comment": "Malware payload (RemcosRAT)", "value": "81f5f50e61886bacc617926413254cb8f7f94b2a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136033, "uuid": "51802b94-e0f7-4967-aedb-89a02af43075", "comment": "Malware payload (RemcosRAT)", "value": "89e2794216ecc03e12c657167b2eeeb0b881a7f43ea09fa5e091d3e57f00675f348e99e7711a86b5ff7a4aee4f348a8f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136033, "uuid": "9cb7ff34-6e21-4b8f-9dda-a2dff97acbf2", "value": "T118352318BEA1B9A1C37B583FCAD3D68A2664FC587710D60B160A3B5D34793F34AD214E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136033, "uuid": "8d4e9e44-6bca-4abb-b1ff-d6c5399656b5", "value": "24576:ary0qVQyp7ouQQV7MtaCA2LavQhcchDFDG8+4AbpS9E:6yTpp788Mta52LaohFLsI9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773136033, "uuid": "ee8cde14-5195-4367-aa7d-e14d57b120e2", "value": 1135104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773136033, "uuid": "1fa48c44-a861-416d-9777-b5cd8699be97", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136033, "uuid": "15b7474c-2173-478c-9250-495ea6090614", "value": "New Inquiry List.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611695bb-1cc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773177378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177378, "uuid": "9f9a8817-fdd6-4091-966d-8ba99f6527da", "comment": "Malware payload", "value": "f5a9693663b7f95bc6ab4a2099633a6a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177378, "uuid": "0324b7d0-efbf-4641-bb05-a0a5853b40a2", "comment": "Malware payload", "value": "f15f8e4701e071aced59c00803f3ca5abf30dd63fad6095aa2fd4d1d2043c909", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177378, "uuid": "e5419238-c7e3-499d-9716-c6dbc2ca3c72", "comment": "Malware payload", "value": "7933df524a20968c3389c696de5c7144610673d0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773177378, "uuid": "a8b571b7-de60-411f-9b3c-0c42d6555ab4", "comment": "Malware payload", "value": "938cf2b9ed3a486c82a12de2bf3a896ca081e44c6c6bd2d39620b48730fa5a886fd5bf751332e7b7353dca5aab8fc963", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177378, "uuid": "e5a1c9eb-67a5-4adf-b3cf-1609f87fa31c", "value": "T1132413A52758E46EE05D95B072D08491E66E1E7AFF35C73774D3A1AE0EB3DA3420A8C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177378, "uuid": "f4c525e7-0765-42c5-aab7-437a5a044aa4", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177378, "uuid": "e5f627b6-1957-4d9d-baa0-ccdf8e57604d", "value": "6144:0fSlre6VrpAkoBEkxfFYnwufD7JIdTCOump8QQ:+SlrLloBXi1D7JIl5n8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773177378, "uuid": "930cea7a-ee1b-4f19-9580-e5015a7aec07", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773177378, "uuid": "254f5577-cbb9-45e5-b8a6-fa98f9eab33b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773177378, "uuid": "d862d03e-b332-4439-a634-7f98acce8599", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc07b36-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773127416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127416, "uuid": "2e23d5e1-8b41-4069-9751-25382a3d4fd3", "comment": "Malware payload (Mirai)", "value": "4ba3fa2b0953ab899389ca5fcb86a970", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127416, "uuid": "58ad330f-93a0-4262-9d97-e819873ff6ec", "comment": "Malware payload (Mirai)", "value": "f292b1731c52802fcc4e5355b244ea7e37a0e9fba766b26b89ea76112c4e0b56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127416, "uuid": "a18fd42b-473d-4e4a-843d-8f8209d01c57", "comment": "Malware payload (Mirai)", "value": "7bf9710e604f4bf5f1eed8e70cfe87637366a66c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127416, "uuid": "cf5e2d4a-3cc8-4825-84f2-58799cdadd18", "comment": "Malware payload (Mirai)", "value": "fc594a69d1138fddc4e448120d3e752036b7433601de7f684a88d6a7978ea7ad9b391ffad28a3247e2c2378a3fb72b4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127416, "uuid": "55db2f16-2642-41c8-b92e-8c1885904e78", "value": "T108056D233B21CF65E365D67009F3CA555AD520A21AF280D6B2BCC7187E2162E3D5FEE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127416, "uuid": "d219a9c2-ef2e-44e0-ab1f-f3726dbf6f5f", "value": "12288:sXFNjZqHaHmdKnuT3k0S4otieUzqhJRremXaPziB3gp0JduEkasl:sLjZq6GdH7ZS4otiWRreqaPziB/uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127416, "uuid": "3c23e401-6ae2-4ba0-b379-c65a0bb498b4", "value": 860904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127416, "uuid": "d27ef1f1-2cea-4abb-badc-094cdb5dc6b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127416, "uuid": "51b9ed9f-c318-4eb7-b093-7fa2abbf26f1", "value": "yakuza.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5c8861-1c91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773154633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154633, "uuid": "d031a11f-2bb7-4788-82df-0c6ec998de2c", "comment": "Malware payload", "value": "9c96a4011b799b61bc95faeed113e139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154633, "uuid": "360c62dc-76ae-4933-ad1b-6bddb9a8d714", "comment": "Malware payload", "value": "f2ffb420a9c80c6f634453f0daf3891235e68b6849e6519a0b4036cdd85b5cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154633, "uuid": "49b05249-95fb-44f9-84b1-9022d797b810", "comment": "Malware payload", "value": "4070716af11efaf0b881230e159485534c8f2bc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773154633, "uuid": "8fede875-f505-4e89-8308-805c4e193064", "comment": "Malware payload", "value": "470a23a5c62468b3435a7d0be7f44cfde59dffa1af3a991fa214bce9af34db2be922fd934ea939b4f43bcb6f0dfbffee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154633, "uuid": "fda2a730-3c52-4e28-bcfc-3726a0bdbcca", "value": "T15295D02B779218F8D2ABC175C9969771E632B8150324EF9F0794CB732E22D504A7EF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154633, "uuid": "072e4572-bf8b-468e-9958-2ebfbc7bf1e1", "value": "49152:nx0rOzD9cRs3QXkf8Kiqfr1nDz4sQAQQqzrOzD:W7ed8qfrVzHEQq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773154633, "uuid": "d7ebf054-f3b4-4c3a-afdb-6461ec230070", "value": 1985536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773154633, "uuid": "7e12ad00-2bd7-4220-a199-7baac681a987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773154633, "uuid": "cb528db5-4954-4b53-92da-f193cd59054d", "value": "f6l62sJS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c07fed-1cc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773175800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175800, "uuid": "542ac651-2c63-4278-bd64-40f77b7ac03f", "comment": "Malware payload (Mirai)", "value": "5665aab90ffe971883f9743df6cb4647", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175800, "uuid": "f61cc466-9c00-4d0e-a6c4-d396c1c0764f", "comment": "Malware payload (Mirai)", "value": "f3a69f4e3698d502c517689116d8be4c0c08b7508d566488e17aa78dae8d0d09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175800, "uuid": "1ffab8c8-5fb2-49a4-811b-b519ef259377", "comment": "Malware payload (Mirai)", "value": "1c61ba9847de051046e52e867f9ac3c734bdee40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773175800, "uuid": "ece23732-3d47-4e4a-8a30-f3255f53d04c", "comment": "Malware payload (Mirai)", "value": "b267bc386409bfefc13ffec85b45bab6dd37463a2879928590e09e9444dbb4dd6ff9dec1e8448857f2f5f4174274d85f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773175800, "uuid": "85c61540-d764-4838-9dc6-73adf286b3c4", "value": "T11D733AC9B5C3F8F4EC040A392176EF319E77E13BA129DD8BE7D96623A941342901229D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773175800, "uuid": "6db8a5de-83f3-4a27-a6a9-baf412c6af09", "value": "1536:9QC/3umbutmUl9i1WIo27ozS9Lo/b2+gJymeMlitPWmM18HR5D4WVWGZbq+qVr5S:9Qu3umbutmUl9lIlkeJoT2hJymeMlitk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773175800, "uuid": "e8d0928c-682f-4d5f-af77-f7a7e41fa654", "value": 79600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773175800, "uuid": "0815e6fa-f130-4af3-b108-76cc8a9cf068", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773175800, "uuid": "32e535d2-3e35-4818-b00e-54ce41a2c5f9", "value": "MMaaRRiiOisecTanee.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e72b5e4-1c5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773131444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131444, "uuid": "83758fac-d627-4a88-8bbf-6a8c9b87468a", "comment": "Malware payload", "value": "d0550fe9f16a3b3227ad48cde0afb4c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131444, "uuid": "f21cdfff-8622-4c99-a3d8-e2df71d1adb9", "comment": "Malware payload", "value": "f49a18cbdc206e3d73e7ce0cf33c5f0d5b91855ec979ce27c91fff3b6e4d129c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131444, "uuid": "bebdc209-ef14-4246-a181-e941b6e05516", "comment": "Malware payload", "value": "a96ecc8f6f26ed0b8dc4664f14b907c89d14288f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131444, "uuid": "e327bb06-568e-4a28-aab0-52177a9adfd5", "comment": "Malware payload", "value": "8277dcfdec2770094c3a846a9f5850256563e6a4b27f05e718732bec3d6ead3347d798f068497c68f4eb7b8d03033a1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magnivicent-LTD", "colour": "#DED3F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131444, "uuid": "cce10788-76e6-4f9b-b556-02037a9a33af", "value": "T101B72256E2F900E8E97AC0B8C6575517F7B1345917309BEB62A48A692F33FE06E3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131444, "uuid": "7d8ea643-1eef-4b02-b08e-67d6e622be3e", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131444, "uuid": "d8c903c7-dc79-43ea-ac54-3f6fd5b9d8c6", "value": "1572864:RQ/QVXgGSC5NOJfu4lYt5xg6Jf/r0HfWGzBNc:RjVQtlz2DTJ4HfP3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773131444, "uuid": "e8bc2fb6-712d-458f-82a9-9907cce675b2", "value": 52150376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773131444, "uuid": "8db723d2-3ca5-46f2-8834-396d2e93a602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131444, "uuid": "22553b3c-8c12-4030-97c0-5db031e55354", "value": "f49a18cbdc206e3d73e7ce0cf33c5f0d5b91855ec979ce27c91fff3b6e4d129c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8e90a1-1c28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773109537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109537, "uuid": "902636cf-26cb-4d88-a8b2-e7a4c29552f7", "comment": "Malware payload", "value": "f713a4ac34ce77c91631d84c87c902bb", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109537, "uuid": "4d98117d-b5a6-4c41-807e-aa408ee25e83", "comment": "Malware payload", "value": "f51ed9d762f0d202c4d1007770758d0a25fe0a7d7568b06e7f4c77ac26317bd7", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109537, "uuid": "825ee529-5ef6-4e0e-a465-1be941d90406", "comment": "Malware payload", "value": "bc85bdad57dc59930a7a030daeae1f736d85cfcf", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773109537, "uuid": "304b05a5-2621-446b-b908-0e84ddd9e057", "comment": "Malware payload", "value": "c3be3462d66b932af9fe513f784ee8d2718ece4456bf6e6bca77fb4be21e628d02c43ad2c305d199bd7cd78bd2154843", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109537, "uuid": "d4efd688-6cf8-4b60-ab06-0b47b4c8bb7d", "value": "T13AB533C1DB003071E85298FC3CA7BA447D479F68516C9F6A0D0E7E9DA5B0B863B42E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109537, "uuid": "54890e44-274c-4df0-b83b-93a9a97fa7d1", "value": "49152:CHLbqdvk4rVqm/e5eW2L9T0R6xAHpg4p7/tuKnUvirSc8sY:IbqdHVqke83Z0wypx7NUviXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773109537, "uuid": "69e8c70e-017f-4443-aeef-f361d9772c73", "value": 2350790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773109537, "uuid": "e5028f56-f88e-49fb-bdb2-c2f1cfe8bb0a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773109537, "uuid": "bdeef8dd-3099-4a14-8f52-2526ab5ab8d7", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8962b99-1c42-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773120804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120804, "uuid": "71f1c0b0-78bb-4819-8fa4-e4d09c5e154a", "comment": "Malware payload (a310Logger)", "value": "599c4aab4286f918b6fc0110648a77c6", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120804, "uuid": "a2d8d15d-e5ea-468b-95c0-e098d0ee37c1", "comment": "Malware payload (a310Logger)", "value": "f583ffd3f8a32243ed872e8a123f8ac6aa84d506d34a8792edd5e9ee41ba6c7c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120804, "uuid": "ed3208bf-baff-4e88-b11e-b07ab7d3940b", "comment": "Malware payload (a310Logger)", "value": "1ff71a23583aa99f1dd0bbbfb0de6d97a1779cfc", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773120804, "uuid": "3d69f21e-eb0a-4f76-91a4-a5b88148d5b8", "comment": "Malware payload (a310Logger)", "value": "89521e0f53548692bc6ba20fe274d8af568c0e3de11094f9d66dabbf494dfcc2af30c96222111157838d64336644fb7f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120804, "uuid": "5563be13-7459-4bd7-9131-8465f880b367", "value": "T18455CF027391C062FFAB92734F5AF6115BBC79260123A61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120804, "uuid": "ef55e76a-cdbd-44f0-beda-9ec9094db62c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120804, "uuid": "7e0fb19f-f5ca-45ee-b3af-1550152105bc", "value": "24576:K5EmXFtKaL4/oFe5T9yyXYfP1ijXdaWdJw3566v7pJh8tA60wr:KPVt/LZeJbInQRaWduLv7Lh8tQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773120804, "uuid": "88eb8147-0968-4ea0-a9f0-b7937839b686", "value": 1340928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773120804, "uuid": "0e615458-a875-4fc1-82b5-917014aeb577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773120804, "uuid": "e7de7eef-2556-42ea-85d9-e002361bb04e", "value": "Bank slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb134e7-1c52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773127413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127413, "uuid": "ac6923cb-e795-4ece-affe-4cdf74f616a1", "comment": "Malware payload (Mirai)", "value": "21ae7e21802e017f922d7fb54ff565a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127413, "uuid": "0508dced-623e-43bf-8af3-1e114c6172db", "comment": "Malware payload (Mirai)", "value": "f70e0aa91ff300206afaa9cfea926d5dd8773b9d478cad0a07fc44c1b6f445c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127413, "uuid": "d67aba85-c6ac-4c43-99ef-5c8911d33548", "comment": "Malware payload (Mirai)", "value": "c3fa406942711596f9681ec9d27f6c4d06ea5372", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773127413, "uuid": "6ccd2ee5-0a24-4f08-b0ca-4face4f1cf32", "comment": "Malware payload (Mirai)", "value": "f49c69ae89056b39f2fbf082fe3a66f346bdea322bfdd7a91c9260b41970822bf975d3f3ba8527b9170c1cf19990b88a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127413, "uuid": "3e4b7921-a56f-4f6d-9976-b865733d31a1", "value": "T107255B46FB1D4563D9430DF06A3F43D9F7247A4340F8962A270EAB572621E3AE9C3399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127413, "uuid": "9bed012b-0af5-4261-af10-eb85b8009704", "value": "24576:xJLcz1Iu4CVjJyAsLiTtUYWeSXOcUBIljP4W:nLE1I7CVjAAsL4UYWlXOcUBSP4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773127413, "uuid": "087c0c91-8f93-4e24-b883-b917ce1ffb14", "value": 988272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773127413, "uuid": "eece5e8e-4dc2-4d21-a3a2-f7e740c41d3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773127413, "uuid": "0ad7a0b4-8e74-4894-b8be-d45f48fdaaa7", "value": "yakuza.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6a8792-1cbe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773173825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173825, "uuid": "23fc2052-0e40-47de-a5bf-1e25bc0dfb84", "comment": "Malware payload (Mirai)", "value": "394c3df5ff9b807bbee7ec32cbd06a0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173825, "uuid": "4fda714a-9746-4fc3-9e7e-a4b41d802fc0", "comment": "Malware payload (Mirai)", "value": "f95849221fd7eac9ec99afabc3e902d8a36f886a5d7a186cbc249a3f11be3bb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173825, "uuid": "94fe87ca-d0a0-4ffc-8216-13131be727fc", "comment": "Malware payload (Mirai)", "value": "ce1751a6e1d9e0cc658c16bd7e0502f26610f9ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773173825, "uuid": "3f831fa4-a657-4d34-a619-999704db4992", "comment": "Malware payload (Mirai)", "value": "88136f8adcd4ac513f8673541e8cf0a541c469187750ea23d1d5fd9e6b3fa57727d77682a994cfd20fce622b838d7f36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773173825, "uuid": "d363d0c0-74d2-4eba-8bbb-0688fa65dc07", "value": "T1CC833B9AB4019E6CF98BDAF940224E0DF93163415B530F26A76BFDE32D620A5DE07C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773173825, "uuid": "88344076-a923-4c7c-9b27-85796734e75a", "value": "1536:EgYFj6jeSzhScH6cfOwMXXgkWkTOmYGOtWn0MtnhbBJ8RGz:mIScacfvKgeT+FYtnhdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773173825, "uuid": "ceb62143-3571-41e1-a0ab-d627d1531295", "value": 83860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773173825, "uuid": "17dd02f0-d76f-4293-bc1a-8ec29c01b5eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773173825, "uuid": "ffeb067e-3c93-441b-b71b-435f5e087cde", "value": "MMaaRRiiOisecTanee.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d089644-1cbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773174257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174257, "uuid": "6d801333-a617-4632-9b9a-5609f7896ddb", "comment": "Malware payload (Mirai)", "value": "072e7298b3fc27baa424129e1c2b3ee6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174257, "uuid": "abbfa778-7dab-4b34-b1a3-18753aca9780", "comment": "Malware payload (Mirai)", "value": "f99b73f2a0b2c92a645ca35f86f5c47abe394a55c5bc76078771394df47caedb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174257, "uuid": "a4197e7c-3c62-4b4a-8bc1-824138244f1c", "comment": "Malware payload (Mirai)", "value": "4922a7b022cdb215905616ba4530046e0d2b9eba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773174257, "uuid": "d8bc8337-6ade-4a96-92ae-2ecda76c798a", "comment": "Malware payload (Mirai)", "value": "1cf94603bc6b41bd96d7d65259c826fdcf83699ab838e35dd10541a07815918b613aa348640b139af990532143beeac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174257, "uuid": "d64c936d-6dab-4774-9f1b-d3f4bc607a87", "value": "T1CA932A781985F22CEAE65079F44329E5291206083FCDD2E369C354BAFF74B88B52DD1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174257, "uuid": "aa17ce47-48ab-4d04-afa7-d736c15d4a92", "value": "1536:X/bRXUWheYdS3OQ8QsFE3SlbBFtUBs2FCDcVBIVCCfy0K9Ksws:K2eYdasFHBFosSCWu5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773174257, "uuid": "f3379b8c-67b2-4ef1-ba8e-fd50faaa480f", "value": 91524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773174257, "uuid": "85fcab50-08d2-46bf-a017-0d3b20844584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773174257, "uuid": "4db936f5-ebe8-4cb1-8e92-b76e119646fc", "value": "MMaaRRiiOisecTanee.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256c8362-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146354, "uuid": "9e1b6b1b-6172-4400-905d-e231be8e7474", "comment": "Malware payload (Mirai)", "value": "212681bcacc65ec340932a596504a4ea", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146354, "uuid": "911df455-dd1d-4ade-83da-bbea15edca4e", "comment": "Malware payload (Mirai)", "value": "f9cf25c7db646f1d09d5c0752a61475ec63b7e45a7b225c90fed95fed9fd2ea1", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146354, "uuid": "ab6ac93b-eb0a-41af-a617-2c2ab617120b", "comment": "Malware payload (Mirai)", "value": "edf43f840f6205076ee5abdf1b75842ae35fba32", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146354, "uuid": "e2df27af-8609-4339-b0b9-2905c3d9c4f1", "comment": "Malware payload (Mirai)", "value": "49aeb910dad0e31b2383c41ca3883d67217c9a53a424354abdad8cc46be7573c630cc9c20a9da17223c7d9bae9eaf009", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146354, "uuid": "266d4b01-3fd1-4ecf-b81b-296c77a67eea", "value": "T191433C96FC924569C6D117B6771A978A33A323A9C2CF7313CC080B517AC9A4F4E67B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146354, "uuid": "6d4a22c8-180d-40e9-b242-b432f80b642a", "value": "1536:UISD+jV4U6ME+Gk2GTOItErR1GgBwJTO:UIS24U6MERGxEpwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146354, "uuid": "0d9a2b46-1ae0-47ae-9e6f-7a47c32f05e8", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146354, "uuid": "52007987-2b68-4eb8-a782-644236f5aefc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146354, "uuid": "f2bb9d56-3fc8-462c-9724-442c5bc52a97", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec42319-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146370, "uuid": "e93e9ac6-9e9e-4dc1-84fa-caa512934938", "comment": "Malware payload (Mirai)", "value": "a8328eb87ef60cb3bbe9eb3a5942e6b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146370, "uuid": "60f7852c-7b01-447a-9d62-0d01239e9ad4", "comment": "Malware payload (Mirai)", "value": "fa8de4cbd561d1f5fd4d4dd2c31f9edbf2a96f57743047c9572434f1e01b42e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146370, "uuid": "efd9f458-f36b-4802-be38-b66a19fb2719", "comment": "Malware payload (Mirai)", "value": "70b28d8fd9960d90e00a256c22fb8abd3007f7e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146370, "uuid": "6124dcba-8c5d-48cc-bdea-157324eefc64", "comment": "Malware payload (Mirai)", "value": "6074bf0913ecfa74caa6fc947c4257763c420cd3a4df8acab1fe03932426882a629e570c065db3faa06be0f7a2fa1330", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146370, "uuid": "15cc08b9-cf24-46ab-bbc4-d6b3dd3e09a2", "value": "T10AA338D7B401CDBDF84ADB7B4453590AB130E3620A831F36639BB967EC761981923F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146370, "uuid": "6420d9c2-19c5-4676-a512-85e3eae6d9e7", "value": "1536:MhzQ1QMfF4B+IOpnhNWBMvrT4ncBDx6q8n36HrQzCJ3GONN6KXL2NQkru/pe+q3:M+4UIenhNAMH+cBDx6CR3GQNZwru/8N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146370, "uuid": "5739857f-948f-4db3-8279-a5d963434e36", "value": 99848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146370, "uuid": "0e117d31-984e-4d20-8225-790def920ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146370, "uuid": "7aac07d3-c738-4054-aa83-17cb49517fc8", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af333a4-1c9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1773160241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160241, "uuid": "61297c87-86db-4599-97f7-4aaea013a925", "comment": "Malware payload (Vjw0rm)", "value": "60142da49070d9d428c55f4004f2683b", "object_relation": "md5", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160241, "uuid": "0697db52-307b-48ce-acc3-72605d4bf272", "comment": "Malware payload (Vjw0rm)", "value": "fb2f882561d88269982f312c54cb6f599247500d75e90c0af5c4c9e75b5378a4", "object_relation": "sha256", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160241, "uuid": "211a38b5-cdee-4ca8-82e0-3616fbce1753", "comment": "Malware payload (Vjw0rm)", "value": "199e573234082b6e803e3f77b70768babbb8f41e", "object_relation": "sha1", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773160241, "uuid": "5d2289fb-8fe3-4171-92bb-25f286c23662", "comment": "Malware payload (Vjw0rm)", "value": "519b064c3fc33c7a4f4a52c301d2cb72fc68dd61b8355563f95244133e0566c3184735720ef2e772d943db52acad6692", "object_relation": "sha3-384", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773160241, "uuid": "93ca3049-c150-47cb-8868-3ebe4fa34965", "value": "T172F2DBAB96126C28BCF263C9494D9C74BC1A8F8546B318DAFC5E876F07134E3A15BF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773160241, "uuid": "dca2190f-9631-463c-a822-7f4f77fb62e6", "value": "384:Yf0d08v9UtQW7KuXtXH5yLVf3YfrI4fDEVVC9ilWo9l:40d01tHK8tXHA914fDEK9o9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773160241, "uuid": "e43362b2-ae56-4f8b-82c7-aa96990b22b6", "value": 34990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773160241, "uuid": "a73e5737-14fa-4e3d-b151-077d8a2e7e1c", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773160241, "uuid": "86ed439e-6800-4fe1-ba6f-5a9ed1627d79", "value": "Procesofiscal.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374020c2-1c7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773146384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146384, "uuid": "ec1f2cb1-1cbe-49c2-83dd-15aedbc12ee2", "comment": "Malware payload (Mirai)", "value": "94443c6b1d0697d713cfb569442932e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146384, "uuid": "fbae6f89-0991-4710-a3c1-1e62e6360264", "comment": "Malware payload (Mirai)", "value": "fc2b56d93865940eead92e1a6a4ffa2d01222aa9ef638ffc6104552045f49760", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146384, "uuid": "b051d973-9fa8-44ee-86df-bbd60cef40ab", "comment": "Malware payload (Mirai)", "value": "d6fb16fd7d0b1bdad1f913ad1b5bf04119b640c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773146384, "uuid": "aea92b10-6986-463c-bcb5-f135f0611178", "comment": "Malware payload (Mirai)", "value": "1d4a01cdfc7ca4dfa66ddbd6dcb3fe84cd20300349539248ab060e52cf2849e27d99768b1d0e4deec50dbad3c2878015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146384, "uuid": "c3db9820-ea37-4d6e-abc7-4877d584d532", "value": "T10C935D02B70C0E43D1675DF02A3F27D1D3EFA6E121F4FA88691E9A8591B2D321586FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146384, "uuid": "411b81e1-e08f-4365-9edf-e5310326cf2e", "value": "1536:gwiReU18TQLro6XLio5o8lVBbbH7h590UvGW4BAfKMcBRWFMOXyC/D0QLl/HOo:oMa8TF2jb+jAfGSM1CNko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773146384, "uuid": "9adaca3f-b72c-4770-b4fd-de9667b44018", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773146384, "uuid": "dad08e38-e8bd-4d36-a142-067555c21810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773146384, "uuid": "4dbe5e61-d4cd-4a17-aa22-63e9581c6606", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331ca293-1c58-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773130056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773130056, "uuid": "30706889-b6c5-42d1-aae6-5ea1114100f0", "comment": "Malware payload (Formbook)", "value": "15b6e635b7a9477b764507a6f8abe29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773130056, "uuid": "5e6e3f08-fc00-45c6-b5ae-e6b2a689da6a", "comment": "Malware payload (Formbook)", "value": "fdb5302d39e0cb68ec1c9f883f6155dfa7e0b4dac120e3796eff1e50b9af418e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773130056, "uuid": "800b49e2-5372-4ecc-b769-a3e5625dfbb2", "comment": "Malware payload (Formbook)", "value": "7b275666a4de622e9c0cb0964d8fb4404a7e2208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773130056, "uuid": "b72eabe9-1bf1-444a-af15-b87bf168082f", "comment": "Malware payload (Formbook)", "value": "016398a4c05bb90c82f14d0707e2538b0ef0e2b062b4aa7f5ec8c0bcaddaa33340ee7e7434d70b26f60f66c1ac4b10f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773130056, "uuid": "2d5d9cdd-5439-45a3-bb7d-5482c730ae15", "value": "T19065366533A4E7E6C41CD1B3B228A1705B391FAE5432818DB9CD69DBFFE7B51080660E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773130056, "uuid": "383d756b-7a89-4887-8a24-3926477ebf2a", "value": "24576:S0Vi0VPLrgMsLnUfY153OIGWPVcop2l/p3xdFB/QP7oy3XMmDOoO4:dVtVPozLUg1JOISop2VnB/QPMuMmDOo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773130056, "uuid": "760fae94-8ba1-4466-b330-78d1874b241f", "value": 1429504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773130056, "uuid": "bae028fd-2806-4c8a-8797-b4ff2b7b5206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773130056, "uuid": "196e9fd5-bf4c-4934-95c0-23816b295725", "value": "AWB_2026031000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cb5e82-1c57-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773129658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773129658, "uuid": "4d1502df-01f2-416e-86fc-3ef76fb3235f", "comment": "Malware payload (Formbook)", "value": "94c4654065f3878fd4b14ef7ca8bb510", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773129658, "uuid": "67078402-2687-4ab7-8233-ef0696577dfa", "comment": "Malware payload (Formbook)", "value": "fdfac85d4b1e626b1ef7645afd5ddc84ed619d705a9b87b6d8e3560fa295a57e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773129658, "uuid": "66731641-0e8f-419b-992a-86f149c3bd93", "comment": "Malware payload (Formbook)", "value": "80894ac945204dee7e9e65919af32f55267e29ff", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773129658, "uuid": "70c8c61a-f02c-4008-a444-55a1d787c549", "comment": "Malware payload (Formbook)", "value": "e6597818507546f498e0a2c1653b8b3a4e38ea473ab158e7cec841e67fc196378fdc85ba12923300410ffe723d4e0d51", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773129658, "uuid": "a8e7c7bb-f77e-495b-a3ce-fef6411cea5f", "value": "T1BF51A68F358CD34DF803023117778B12CEE6D69F00341FA4D08A70939BE7A569A8E588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773129658, "uuid": "96394e03-a918-4679-ad9a-9e4e5d82915a", "value": "48:wR8vOhOklAnFpDZLXUrG8CPb7IK+H+YKH6GG9oaRq3weMErOKKQSuBLf:wR8fXFp1LXUrGJIKWKaGGG7ME68Supf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773129658, "uuid": "e413ba45-96f3-48df-a9b1-8b3d1db174ba", "value": 2808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773129658, "uuid": "a0388639-4934-420d-a346-c8e498ede623", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773129658, "uuid": "2f252486-a969-40c1-8443-ca4f33c623d6", "value": "2026-os \u00e1raj\u00e1nlatk\u00e9r\u00e9s.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c1b4b8-1c5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773131421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131421, "uuid": "79cc1042-d2e8-4720-97d0-48b4b8ee3983", "comment": "Malware payload", "value": "89a21f06f2c5651edf40c86b1e9d078c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131421, "uuid": "8f7857d9-6dd3-486d-b4c8-4cb690fa27ae", "comment": "Malware payload", "value": "ff372850545c7ce1939b874338f368871c72c45a37d3ef0385c1b2b76622cde5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131421, "uuid": "9e7fcc25-f59d-49a5-ac9d-867dc393d9ce", "comment": "Malware payload", "value": "0a2f0b1168b360e35c42143fe3afaaf5c620c29e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773131421, "uuid": "65b7675b-3234-4c79-bd3b-fa4cbbcda064", "comment": "Malware payload", "value": "1d100138fac324cca8601de19b3ffb520090be5f8d257bb19426563d2028653283189f7abe2003c5cdfb8d9665afa350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131421, "uuid": "436b6d12-f530-4ad0-bad5-a0a10b3134be", "value": "T17C7501A031E8C857C01946F81670E1B25F752DAB9451D1C6BEDE2EEBBFD6F401A06B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131421, "uuid": "08639292-7b52-4615-b299-1071d983195a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131421, "uuid": "4e47823c-904b-4293-8f06-9700a70aea3c", "value": "24576:OL0Vi0VtLkdyag9PRf2lw6oK7kzVSAoXDI6mMii9fIR1GYztIfsDMMPwkOoOp0V:OoVtVtAoRK7kztczmSf0TzDxwkOoOeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773131421, "uuid": "d7a65470-c706-44f6-b1c0-a4e252c51373", "value": 1679360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773131421, "uuid": "0421b97f-f56f-4179-a4b7-545739e59849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773131421, "uuid": "15e7ecfe-bd7e-443b-8e30-4f65e3decc49", "value": "SecuriteInfo.com.Trojan.PWS.Siggen5.32333.21217.11757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7887301-1c66-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773136291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136291, "uuid": "beb396d2-9f66-42d0-8648-53a2a2d14c28", "comment": "Malware payload (PhantomStealer)", "value": "0f2e608555b7294202ec0b67e2791b2e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136291, "uuid": "e4e1948d-63d3-4f3b-8b02-ee2a49c58708", "comment": "Malware payload (PhantomStealer)", "value": "ffc7a50822a48a329b1f588d7d3c187ec280e9f5bba155a99f04116b4c7560d0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136291, "uuid": "13b1a955-a07c-479f-a621-f0db9411b80a", "comment": "Malware payload (PhantomStealer)", "value": "6b3ffcce52cef8c942713de40dbc6c7a4b24982d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773136291, "uuid": "74e83d9d-c818-461e-8c82-400fab5f87c9", "comment": "Malware payload (PhantomStealer)", "value": "33f73d745ad48da28ed6356e272e73c1b801107fb08519cbb78d0db0fd03362e11177e020cc37aff06cfabcb2e3b9d57", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136291, "uuid": "1b69a296-7fe5-451b-9571-da49abcce3de", "value": "T16C26BF381491F36948051F3F49DE554E0D908ECAFDAB98CC542AFF8FBA3A254D1B99C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136291, "uuid": "ed1a2875-8f37-4c91-b29d-8d889e03025d", "value": "49152:ajpmkCBmw5c8LjDmtk8frlxGY3mifYHy7HZ5rxK8LNJ+9VbfIajmNBeDF2WHFUfr:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773136291, "uuid": "382b80a1-8547-49da-9818-149ef29b4c85", "value": 4640410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773136291, "uuid": "c17fa486-a77d-4121-a004-6d2d096c5ce9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773136291, "uuid": "ab01873d-abf3-485f-956e-be5ab6d75062", "value": "RF-PUB802 Spare Parts Requisition.xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }