{ "Event": { "published": true, "date": "2026-03-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-05", "timestamp": 1772755382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c568d6f8-f7e0-4167-87f8-af154ef4a6f2", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3623a4-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703232, "uuid": "41f714d7-6786-4d13-8f05-d25c367fd851", "comment": "Malware payload", "value": "90a3d059fc206c2997168fe53290802f", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703232, "uuid": "cd29069b-6311-46cd-b7a0-29079fa778d3", "comment": "Malware payload", "value": "01f9346d01c6cb37b90fce97515a711837f3f1fc599159a0833a2369a46517bd", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703232, "uuid": "5fd40324-77dd-46f6-9aff-7ed37b07e156", "comment": "Malware payload", "value": "620f92aa0872d889443d3ae6f16b85098a3550b5", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703232, "uuid": "45ec29c5-f119-406d-bdfb-5f34bc1bf088", "comment": "Malware payload", "value": "a8c5838cd96d64d272460a5e37c9a55d58a2a418dc8e916dc4aeb598209413c5644d5c7376b2d6e7a8cc1b44010bc332", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703232, "uuid": "15a77a8c-0d0e-4306-8f6c-0dee7527c6f5", "value": "T19AB67C09B3C88A95C226E438CB27D333C771BD955623824F65EEE70E5E777418B3AA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703232, "uuid": "e3ae457c-ee76-48e8-9b6d-c4d9aace7dfb", "value": "196608:Ln81nOArzaa/RS7n/rS5oH7Q7wewIzeWWrhRfoeL6Vfc:aOArzD/qnTyoY9evPLIfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703232, "uuid": "9a679fcb-a583-4d69-aa64-633688293051", "value": 10459136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703232, "uuid": "e53370e8-9c65-4bef-9525-b783fb432692", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703232, "uuid": "ee37c4e1-a01d-439a-a7eb-ea686d98073f", "value": "Szkennelt_fot\u00f3_2026011223.jpeg.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb260dd-18c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772734907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734907, "uuid": "1457eabf-bbe1-496e-b7a3-6ea85ddf6f34", "comment": "Malware payload", "value": "116021666b8298e77e1e827e5e51f754", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734907, "uuid": "02d775a1-c175-40be-88bc-06f23e92d407", "comment": "Malware payload", "value": "0203d3b80409b74c74b0144c394eea39fd55381f9cc3893478906ae105c0174d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734907, "uuid": "e4f2a674-51d7-406d-806f-0e32d8aac809", "comment": "Malware payload", "value": "d7f1fb2dde42b54150c880fd0a9e3c07f13e4032", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734907, "uuid": "6c20e2db-ac92-427f-8e93-098ca0201752", "comment": "Malware payload", "value": "199d4d6b94f413a52e21bb4ad9e1c325712573f4ee1d523dbe7d03f9874e877afe34adaacd9177023f4e0f5be422002d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734907, "uuid": "b6a74f93-f541-4e82-91ff-84c8d20b7acb", "value": "T122232841B30E0A43E1A76FB46A3F17D6A399F95031E4A584264DEB4ED631C334ACEEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734907, "uuid": "02de606e-f96d-46d3-94a0-1f30b38b6676", "value": "768:8TsGnbO7kw1oylDhW9FxzZYjKfoPe13BFqKtaMmIv:6bO7kw1plaFpZoKAPel2KQMmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772734907, "uuid": "65690b3b-dd23-45fa-853c-b078b00c9bcd", "value": 46516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772734907, "uuid": "249132be-2565-47e5-90c7-dff7b2a84cf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734907, "uuid": "008bf9f3-e8d1-45e6-8090-2702fe0ea171", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5998d3-18b8-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772731477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772731477, "uuid": "e2abe679-bf6b-471a-8b2a-a06397b59b06", "comment": "Malware payload (LummaStealer)", "value": "2cf964844a29df5ac9e708858f534e4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772731477, "uuid": "02ed2abb-9aa6-4f16-bc62-9d12fb16f044", "comment": "Malware payload (LummaStealer)", "value": "02045e58aba74d3619e3bb428f033ca51fb21735d36cf8f62cb7e08a21c7e4bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772731477, "uuid": "1aa95d39-6f6e-499c-9d14-5419a7b3d838", "comment": "Malware payload (LummaStealer)", "value": "594b4ace64f5470d9aea8ddbc2d92c0abbf7f707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772731477, "uuid": "94f4a9ab-51e8-4b88-b339-9098a4162d62", "comment": "Malware payload (LummaStealer)", "value": "ce634a2d4501455537324189f00f548c6429e16fd1ce8ecd556029c1d9578ba9cf1af1eac792abc5691bfc901d96274a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772731477, "uuid": "17738ae1-8147-4585-8a7c-f454819570a6", "value": "T16DC4AE21A9D180F2D867173001B5DB7B9E78BA3089718DCBFBD45979AA3E2C0932D74D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772731477, "uuid": "91a2ebd4-067d-4b43-bb25-b308040aad2e", "value": "df12a5da5b59ce775e079444f97cb3c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772731477, "uuid": "de758e7a-c4b6-4321-b33a-6b1ebc6231fa", "value": "12288:fLRF20TzS4KVHar4XE6g/Rnn1Zm3hKjyp9s+K:fL20TJKVHaUXE6eZ1Z2J9jK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772731477, "uuid": "db817a1f-b81a-4f17-847d-99b71cf5b7ae", "value": 550672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772731477, "uuid": "e4f9e031-3310-43f6-961d-fc9bef205640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772731477, "uuid": "387c19b5-47f0-4e58-9cb4-ac19919902a3", "value": "02045e58aba74d3619e3bb428f033ca51fb21735d36cf8f62cb7e08a21c7e4bc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cbe5a7-18aa-11f1-a769-42010a9c0008", "comment": "Malware payload (MythStealer)", "timestamp": 1772725391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725391, "uuid": "4dff6aab-0d52-447b-a22b-652f9a036ed0", "comment": "Malware payload (MythStealer)", "value": "2c5c6efe198473409c8abf3ba6723a81", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725391, "uuid": "a8a7f5f3-12f0-4081-8c7a-67d959e1eb16", "comment": "Malware payload (MythStealer)", "value": "028bc6de3033f51fe9602e5e3036abdef26e49b581a332f3a67ee5dd981b7f30", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725391, "uuid": "737f7e65-99cf-4ee6-9a7c-d809852f6d85", "comment": "Malware payload (MythStealer)", "value": "013522bb2ce4c3e4e4739d7553caf816078e21b1", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725391, "uuid": "8db5d0f1-b291-4f96-acaa-b5a0863341ca", "comment": "Malware payload (MythStealer)", "value": "72ef317f6940eb8420d31c40c53d5f2fdc1f302fa86bc7d5c89239cdf65d3675bf593117f163473bc01b71c0976de3c3", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772725391, "uuid": "b1c91fa3-4acf-4b18-bac5-cd6306d43648", "value": "T1E1F733E9DD2CBD75D3247271C0F19277DC6DA2EC4526D6E7BEDA001F84A086D20CBA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772725391, "uuid": "33225556-9f85-4da1-80da-2c73204b8b7b", "value": "1572864:FP7dicTwX+9zpLMN0rKozsmqVoL7ePpxqfjjObqDjwbBrg2TE:FhicMX+Hw02ojooLCh4rqbqXE9TE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772725391, "uuid": "949cd638-b0a8-43ea-9216-4bfa4b906fbf", "value": 76898236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772725391, "uuid": "91d2b61f-ac0a-40b2-84db-f392e674127d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772725391, "uuid": "ce8856fb-50ff-42c5-accf-52d2ea2732d9", "value": "loader.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3169efd7-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697979, "uuid": "e406c214-b310-4707-9192-0edb0fb8e5bd", "comment": "Malware payload (PhantomStealer)", "value": "08601ea10aef52d9dba9e64b9fba1b83", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697979, "uuid": "5fd4ffb1-794f-47ee-9fbd-b360e7c9c044", "comment": "Malware payload (PhantomStealer)", "value": "038a5fdfaf087671d1ab8c223ba5f1e84285575535cf0c6f350d1c944e9db1ab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697979, "uuid": "e935313d-7f8d-42fa-bcbf-bb0970647938", "comment": "Malware payload (PhantomStealer)", "value": "c864c7d9ffcb124ad25ae5b20f28bca2fd855506", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697979, "uuid": "7173ef1e-3a9c-4a4b-9671-34d609466152", "comment": "Malware payload (PhantomStealer)", "value": "47e5fd737bddbd771a0abf89b09ec0c82e354bd2c611120927d2a469db24664cf7a11010cee7afa2356ba61ec623ad28", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697979, "uuid": "5d6366fe-e350-46da-b47c-ddcb5e9f882c", "value": "T13C623B194E0B9DF88A6A32405CDF0BB18CC54258C116D56879AEE7EA7700B58F3F81EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697979, "uuid": "35ebfb48-f763-4da4-ae14-9fc307078c36", "value": "384:3SsgYWVXouFvK8cbvQKsnEm9sduVpRtv4rdsY5bdRG:3SswmaPQsr4rdsYp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697979, "uuid": "5666f27a-9d78-4665-9679-c7971217668b", "value": 14604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697979, "uuid": "e8833029-ca6c-4e82-97cb-03bfacf3a535", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697979, "uuid": "664b4cf6-f636-42c9-ae46-4c419836ac3f", "value": "08601ea10aef52d9dba9e64b9fba1b83.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d0eb16-187c-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772705686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705686, "uuid": "e4471fc6-5220-4602-a05e-bff0c15a943c", "comment": "Malware payload (Stealc)", "value": "f2097fd4f908605c349b979cc9ab8271", "object_relation": "md5", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705686, "uuid": "93b3f7dc-9b57-4524-817b-45fde38e96ef", "comment": "Malware payload (Stealc)", "value": "040ede59ed3e058e0a0db55ec86850f98048e35b2e9a1fe00911253e4c3a3fcb", "object_relation": "sha256", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705686, "uuid": "1d5389a2-e05b-4560-a1e3-0e8afecdffe5", "comment": "Malware payload (Stealc)", "value": "6599a2a312cda61a83994efd3fe2e97803ecc7af", "object_relation": "sha1", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705686, "uuid": "3f96a73e-87c5-4d4d-8264-08d078586c4f", "comment": "Malware payload (Stealc)", "value": "8e55ed380e18d1acb08bce4de1fc7a014c1011393be3016b5142b74ab75da7ff3fa1d57ce743c8e7f9ec7e206508cb2e", "object_relation": "sha3-384", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705686, "uuid": "e8ffc7cf-2796-4d37-ad90-34a76f073eb8", "value": "T1D2E35D347A566DFF5BB8208248C6811C5A383174CA382CF67ACB5C923E0D77627B79B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705686, "uuid": "82456a7a-707a-41a9-a9f3-8f80d64e356f", "value": "3072:mO2TAqYp4DyfCriOSTpAyMq6Sw2t9cn56HbCP:wTA34ufEUpXZczP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705686, "uuid": "e21632ba-ac9c-4c43-9d13-05abd4355030", "value": 148481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705686, "uuid": "f8dcf33e-dc9b-41c5-b982-a647bcf7b204", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705686, "uuid": "d3e7b964-1439-4850-b314-029035b937b6", "value": "payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaafaa7-187c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772705971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705971, "uuid": "bf3a7c05-31c7-418a-9065-dfcd7020c3cd", "comment": "Malware payload (Vidar)", "value": "386990a94abaa62c3dee929e88866b85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705971, "uuid": "347c2548-5dc1-46bf-a8ef-43a312e51e72", "comment": "Malware payload (Vidar)", "value": "0459fe6bec71733994af1971a6b0aa021efe7c90674d19203e353918bdfff77d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705971, "uuid": "65818e94-23da-4664-a543-e694badd3348", "comment": "Malware payload (Vidar)", "value": "021b630198aebb924e694afba2b9ef11fbd8bcad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705971, "uuid": "1b3e94fe-5a68-447e-895b-e773113d25ef", "comment": "Malware payload (Vidar)", "value": "5b429efeee9c1cde680f656f768fab2fa33c5d53a9ed09603cee757c684484f80450b0b6477fad4a11c1efd46f88e843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705971, "uuid": "3d64059e-51c9-431c-bf81-08d14faddf53", "value": "T154D42BBDAC60E376F60CD0BAE286D3538F2139011236AAA319BD97241245473DB577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705971, "uuid": "752d0e72-0b40-4d8c-bae4-5724cbf5a35d", "value": "e6a9ea00f059c8f148d2aaa9d51e3613", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705971, "uuid": "9919adf1-783c-45f7-bc06-d4eb13cc83b2", "value": "12288:iEyurkSSu5EkPm8b7k4ao/CXjp4JgtU8F6CmSYw2g:iETrk5u5EkPb7jgjp4JS36UYw2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705971, "uuid": "5fc8bb18-38ac-4d64-954b-42b1a6340c1d", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705971, "uuid": "d4e4190b-47a0-4a61-a4c9-c271bb9a69ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705971, "uuid": "cfbba603-411a-412e-af93-616ef308c0c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b46bce-18c3-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772736373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736373, "uuid": "69381fd6-4499-4775-b656-21e1405c80f0", "comment": "Malware payload (AmateraStealer)", "value": "9922ecba48c0eb234cf9d0816a2db29f", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736373, "uuid": "a948085c-fcad-4973-9479-d6725109a3c9", "comment": "Malware payload (AmateraStealer)", "value": "048cb24a6ac4cbc00361a9fd4dffff7cf299d7d12f0053aac558acc2d7b82c2f", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736373, "uuid": "8640b052-9267-4cb7-b00a-32e9243d2cc6", "comment": "Malware payload (AmateraStealer)", "value": "5c084e3191bd78b3d9e3bf6c180f9426ab4e41da", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736373, "uuid": "7abba6c3-37b3-499c-8122-97d808c21a27", "comment": "Malware payload (AmateraStealer)", "value": "9f64012cda6c1aff4f4db5ea0eaa486cdf5aa7366282d7ad031cc97564b753f697ffd28c85614d03a67a949622bfa28f", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736373, "uuid": "c3a95120-ed78-4b8f-a13a-8ecd0ab2d8a4", "value": "T195B65B213761C52AE1E2DFB3193D956E1C297DE20774E0C792885A5E9CB7AC20E35F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736373, "uuid": "d82b47b4-268f-4db0-8dec-3602914b2ec7", "value": "c1508fea733fa48505bdb2ca1c300984", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736373, "uuid": "75a469f3-156e-4956-bab8-291260c6b8d8", "value": "98304:o3PnnehNU76F5Rd0QMp4Jyj/rLWlICoC7O:4nnM59d0QMVjDL0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736373, "uuid": "2c51928a-c260-4705-b643-e6004fb8b722", "value": 10755274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736373, "uuid": "ac04cece-d2ba-455e-b915-70c9de171934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736373, "uuid": "24cfe459-f29c-4155-b729-453292b7da98", "value": "ProtonVPN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac8135a-18c3-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772736381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736381, "uuid": "cdb377ba-228a-45bb-bc42-d0af1e3111a2", "comment": "Malware payload (PureLogsStealer)", "value": "255cad3a7af318b81a3328aadfe8afd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736381, "uuid": "d7196114-819c-4350-b5c6-bd7e20850743", "comment": "Malware payload (PureLogsStealer)", "value": "050efd4f9771706e3bbd36a4f5665ceebb98505ece9358d041d42e2052b3d6dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736381, "uuid": "b619c35f-9060-4129-82ea-d5cfaec1c5ed", "comment": "Malware payload (PureLogsStealer)", "value": "d9b36565db428df99d27aac9994355abad2dc3c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736381, "uuid": "6ea276a1-e118-42f6-9937-d6d5273fe3db", "comment": "Malware payload (PureLogsStealer)", "value": "55d9818540ec3a6723c4c54c5c2a95359f30a3cbbc04aab2430fb47e3d32da8e6379af692a1f207fc1527272a84d8a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736381, "uuid": "8cf69fd7-aabc-4a01-ab8d-0abdc8be64ee", "value": "T179D4AEA7B2664E21D2481333C0DB8E9093E5578AB5A3F34F718523D625463EFCE0B697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736381, "uuid": "b678bbe1-6c68-45ed-be82-5d87c5b347b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736381, "uuid": "cfb028f9-b802-4702-a037-4d011ba0d633", "value": "12288:JPDrIc31qsEvCQqHwI1+qvwmveEuP1hhgVf48YuUA0p5:J7rIc31qpaQqH9ImWEu9Dgf9pq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736381, "uuid": "76cba9b4-b7c3-4311-a7a4-e30bb4f99f38", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736381, "uuid": "ef73e1b0-66ee-4b37-9e47-38373e4bc243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736381, "uuid": "b96cb5c7-e7dc-4c56-bfdf-60c3658e3ee5", "value": "255cad3a7af318b81a3328aadfe8afd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebb31a7-183a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772677520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677520, "uuid": "11439d1b-7f31-473d-b022-c96a42e4ac99", "comment": "Malware payload (Mirai)", "value": "df4cb71273aa9f8faf9100e58956b70f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677520, "uuid": "1b296251-89c2-469d-ab68-7d78b92e162c", "comment": "Malware payload (Mirai)", "value": "054f7b04586e3592ea337cef89cca56b9fe8b1cc0735d6f68483245505b3abbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677520, "uuid": "22370e1a-d461-4a96-bd2c-81262bb37188", "comment": "Malware payload (Mirai)", "value": "a916b6bdac64fff7e6b1c9bde3287d294b36711b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677520, "uuid": "3147a47b-329d-4260-bdb0-abae15347b82", "comment": "Malware payload (Mirai)", "value": "d0770b3f4274a6a0d8c090db52e79a25b09bddb367169febe59ee992f9fcbfad00782097087a88da880cc1e0c91bdf5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677520, "uuid": "5568d02d-43ec-49f9-a8b2-a9072f29cfe8", "value": "T12124A74E6F318F7DF7A886344BB74A20975D23D622E1D585D1ACD2115F2028E682FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677520, "uuid": "f8eb0c19-3739-4757-83ea-73655c68def1", "value": "6144:3m5065ttFLreRtpl8w0TwTisO6URUSn1H5oT:25ZeRtttXU+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772677520, "uuid": "de94adfa-f96c-45a7-b7da-c624f6fff092", "value": 229384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772677520, "uuid": "56d856ff-4e9d-4c8d-bbf5-cdfa33d3c6f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677520, "uuid": "d1b24843-ca94-4c5a-b431-23d80135bb62", "value": "Polar.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ed5947-1842-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772681049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681049, "uuid": "5024aa1a-7a82-4afc-9f42-3c382592da35", "comment": "Malware payload (Joker)", "value": "572bc285cce18f99573c036b5658ce6d", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681049, "uuid": "cce97ed2-bb71-40b3-8f9a-3a10defd6e42", "comment": "Malware payload (Joker)", "value": "05ed9796df7f6d4cf01f563d32bf0a052e5bf894bdd97947c8a4fba8a6faf4bf", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681049, "uuid": "4a50b285-0216-4e0c-a7ee-467f9b4a846e", "comment": "Malware payload (Joker)", "value": "7b7d26e3e09f49c161399d4ad7ed41472ca7a956", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681049, "uuid": "55f650ad-e52c-4509-89f1-085062924992", "comment": "Malware payload (Joker)", "value": "f59b20c46007c0e711f566cfb635c3dc04b07a80a872667a9c971ae66f88d653d9acc52f5cabfb66f315b964d37122e8", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681049, "uuid": "794f59af-f8c0-4e30-8185-a70a3165799b", "value": "T1FF971249FA1CD42BDDDAF0BC8D9B03E3B52679551610C28B2822820DFDA37D49F56BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681049, "uuid": "e82b9cbe-5444-4dc6-a06d-6ca5484de6ac", "value": "786432:ELZAo0ytLQHbtQcA8PgEYvXizq7J9uUdwYmEt4JscFv4u:EGWtLQH5QCLYfisJ9uUdrtOWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681049, "uuid": "af2980a4-d078-4acb-8419-4e392f318315", "value": 42460124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681049, "uuid": "e617b955-40f4-47ad-81c1-57282edfb339", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681049, "uuid": "d3c45847-a032-45c3-90a6-92bee37b03c3", "value": "com.texting.emergent.plumb.messenger_1.1.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f883bf05-18dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772747706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772747706, "uuid": "966d58e7-a869-4b1f-b48f-705c6c25b628", "comment": "Malware payload", "value": "ef7a205733a229e18098dd8fb01b7872", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772747706, "uuid": "5d131643-c4a6-4921-9e4b-212d126e3803", "comment": "Malware payload", "value": "062881cabcd9eb2a9163601cf207a9573bd07d56d64f2a508b917bd74b5a1f46", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772747706, "uuid": "97825b28-eceb-47da-bdc2-dc02e17a576f", "comment": "Malware payload", "value": "5e324340881b4de02e201e4c26dfda355dabd253", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772747706, "uuid": "7afe324d-e821-410d-9747-1ae0e0926228", "comment": "Malware payload", "value": "cc6c04b84f74a1ad63373c48fa49c239f25b0835fffa4487e6fee36f94ff44b29657e8798807340600daab54468ad451", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772747706, "uuid": "380af601-c118-4cd2-a236-70c107081f17", "value": "T136D1CC94A2F44B08E0B24F39E8763B918825BE34DF31C78C231894491CB1391E8A1F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772747706, "uuid": "06bb88fd-40ab-4454-884c-17833d0253ca", "value": "24:2vEO63/MxxLPfOAPfq1tii7vHe6rUgsnPE/0zyEO6iN:2wPMxxjVfkfe6AzPE/0J+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772747706, "uuid": "4ed9488c-e9a1-49a3-968b-9a0c52a57993", "value": 6250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772747706, "uuid": "9e75567b-5a4c-41b4-8529-2ceb7e2504fc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772747706, "uuid": "5462c5ea-fbc1-4506-a946-f7f6b2b267e7", "value": "Gorschenuk_Odinokie_Zvezdy..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5e1822-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707640, "uuid": "484d3a73-f768-4cc6-8b78-8223c30d46f3", "comment": "Malware payload (Mirai)", "value": "fc01e610381a2432273756fcd0e72d84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707640, "uuid": "34e0ea91-579b-4fb5-9026-fdd68fc70a76", "comment": "Malware payload (Mirai)", "value": "0836185eb002597b7d304aaa1f150f6ff38589b79def78730e314226f2dc1b77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707640, "uuid": "0f0a2f1d-299f-4780-a511-d3f5fc7988f9", "comment": "Malware payload (Mirai)", "value": "e4e40a65b2be5430ac307129558c40b1ab7a5dcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707640, "uuid": "e32492fc-9faa-417f-8ecb-d95513f83412", "comment": "Malware payload (Mirai)", "value": "c11ddf76c4fc675c8bc023738228cdd694fcf703a11ebe45d6372de0454483490ec0dbbde6f2e111de29953a1e347012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707640, "uuid": "a1f9f6d8-1ef0-4d3f-924b-db6979a2b576", "value": "T1F613F13C335314A3E8AFA9FB46EA03A1B2384EE7D1D2BC4B6D117E16EE114757852D14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707640, "uuid": "30763588-5276-41f7-85c4-091584753370", "value": "768:pA640eY3gtKHN3KbrdQe7orOs1UqhlN9EQbsTud7x5nvW8eINKR04I1FKgJgGlzX:pA6hx8re8b7qZ9EQcuhvvW5kKRU1VqYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707640, "uuid": "aef5c550-3289-4c54-80a0-3ecef337fc47", "value": 44236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707640, "uuid": "8a42aad6-25d4-4930-a453-0189924a7638", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707640, "uuid": "ce67d92c-f1e6-4e81-aa72-c660cddf3fa9", "value": "5r3fqt67ew531has4231.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35af51d4-1878-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772704000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772704000, "uuid": "2b13f0ff-40e3-4455-a504-5eb030170667", "comment": "Malware payload", "value": "4ae40cd26c4a186165e9bf92bb260510", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772704000, "uuid": "d651eb0a-6ce9-44d0-af8f-c65e91b1476d", "comment": "Malware payload", "value": "08b9f192b947e055f1716615f065d15022625c2144be45794247f521ed78a5fe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772704000, "uuid": "4da03e33-bddc-4357-b23e-34d06a90912c", "comment": "Malware payload", "value": "a2e19aa221ae459ff3f8d2b89350e3de65f711e4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772704000, "uuid": "b3ffef2b-eb91-4d5a-9118-626d52d470f7", "comment": "Malware payload", "value": "ba53b84cc508d4f426952ee2b98571ea6c1a42499cb8f82ae5d8ca1a318941f17079051510e8a4cef99715ea53ddc9ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772704000, "uuid": "175e0598-4b2b-4f18-8a54-14566743b4d3", "value": "T165924CB512896D79FBD0CE399F3C6F4CADE882C42124A3ACBA4F39215A1166DC60535E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772704000, "uuid": "818fd2b5-4488-46c2-85bb-8befe2a1f9ca", "value": "384:b3ccuQpWx+BL0SWL0gJzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:b3c8i+BL0SI0izsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772704000, "uuid": "93f09c76-9ee4-4610-b382-4a786950fcc3", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772704000, "uuid": "a411be23-f2b9-4c3b-b3f5-29d72528911f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772704000, "uuid": "2d813db3-969c-456c-ba78-c13218ee88c7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8f6d22-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681515, "uuid": "925d528c-72bc-484f-9f9e-f6e88f2cec24", "comment": "Malware payload (Mirai)", "value": "da8f37cc491daf96ff07c761dac9c804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681515, "uuid": "92cd96ae-6b6b-4089-9c58-3d80ca6c6c91", "comment": "Malware payload (Mirai)", "value": "09470d26acac5f78d155b4f371c0c7c428d2e9dd8a86e99ae52f6d2a24f31982", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681515, "uuid": "3252e386-2626-41a2-a04a-1a0512ccc946", "comment": "Malware payload (Mirai)", "value": "9ef96c9241094dcfa4f2a84e43e6a623576627a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681515, "uuid": "1fc2d3e6-665a-4746-86a9-c7add3125e00", "comment": "Malware payload (Mirai)", "value": "75a33d4d1a5184dc06df053f665a05a160aa5a0249472474949274d446b35ab0f0127d9a9e068ca75483d49b5e85eba0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681515, "uuid": "d0b1a3b0-8bbe-4f6a-bb3a-1dd3e30b9fe6", "value": "T190730218978165B6D132493380E84650FC691A7BF292DD162B64FA0BFD340F678C3BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681515, "uuid": "a7cd45cb-681a-458e-969a-b3a91343bf9b", "value": "1536:N2c+QpUR2mRpNRW7w7RpB74M5DQ/ibie5HhSu1Vtuj1gdeMoq6KCFVJud:MEpUomD3TpBUM5zbiOHVVU1g0MozKCFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681515, "uuid": "e3d7e3f2-7858-4164-b09d-d2fbffc0dbb9", "value": 73944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681515, "uuid": "c998b6a1-692c-46fd-a59f-26d1515a98ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681515, "uuid": "68ca251b-566c-4926-aa4c-6c190b435377", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c92e5f-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772697725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697725, "uuid": "b592ad99-7aa9-451d-af3d-740bde5a7395", "comment": "Malware payload (AgentTesla)", "value": "bdafb04b3c982d3d3a8944454f94ac1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697725, "uuid": "ab1eb38e-4c1e-4b91-b2f4-306a4cdc7d6a", "comment": "Malware payload (AgentTesla)", "value": "09fe0615fe46cf89dbf2de5af080abe6c58242567e2e7086ab8c4b4c5f645e16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697725, "uuid": "23c92284-974d-421d-8251-b9b33b6edaf0", "comment": "Malware payload (AgentTesla)", "value": "eaa528e46630940e5138457541cdb67597e69dcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697725, "uuid": "17704976-da74-4518-8036-81d32b733c63", "comment": "Malware payload (AgentTesla)", "value": "b567eb902bd7367e1723fb97e7225451a9c954ea0d8d5c4bcef7ad5a6a31de0d3a447a7b41fb3df77a2e50f4dd5a7982", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697725, "uuid": "6b580120-4b2b-4350-8383-1276d3d4bd97", "value": "T1C2351511083688D34F58D58BB5E3D68CAC352D513ABF1EFD962BAAC4BC25FD94472A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697725, "uuid": "57a37784-fd71-40f1-b8ef-5666aaa5e9b7", "value": "96:nekz7nkoo7oooqooknFzo7zmwmooFn7+mwkzrFF6kzoqnoqwO6oqwS+oqnhnmnrI:Vq2kXGMm+xkz3jko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697725, "uuid": "742d74dc-4541-4cc7-90ad-9234e102a218", "value": 1161263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697725, "uuid": "9bc7fab1-02e9-4ca7-b38b-25ad9aec637e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697725, "uuid": "89295d89-c347-47a5-8902-aaa53364b48b", "value": "PDT5737083-HTCOSF0736.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb177dea-1870-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772700868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700868, "uuid": "a74ff43a-748d-4236-b17a-ad64c58298d0", "comment": "Malware payload", "value": "82acac78e35228b6f4902c847e914a26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700868, "uuid": "0e3cd9f1-716f-40b0-add7-7884a62d6903", "comment": "Malware payload", "value": "0a04853e7a66c2546272a477bdd0bb60f509cd40f36191cf663b204eab59dd8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700868, "uuid": "305c9928-397b-473a-88fd-d77a550c1bc7", "comment": "Malware payload", "value": "43450654ff3057e62d15532da9794f9efb84d542", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700868, "uuid": "b200f88e-b007-43db-aa97-5fc741426e06", "comment": "Malware payload", "value": "f1e20a9450a1dafdbcbd241cc77ba836a4269b7b6792892bed0dbc0eb37eabcb31dd2d9396015057a929fc5bbc7080e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700868, "uuid": "20e6d499-754c-4ecc-aad3-81abf12e0c83", "value": "T178A328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700868, "uuid": "82e4e58b-e3d4-48ea-9be2-d772a3b1cef5", "value": "1536:7LufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAQ:GbU2RC4kPCtSzWu3/3L1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772700868, "uuid": "8872b2b9-7c1b-4e00-a733-277cda970457", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772700868, "uuid": "4c6347a7-8b7c-4bad-b1e7-ad40342d015f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700868, "uuid": "4314fc4a-94aa-4445-93bf-08a655b3ef93", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22fdd33-18d5-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772744205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744205, "uuid": "a6ad2e93-ffac-442a-891e-5cee3a59d3b6", "comment": "Malware payload (SalatStealer)", "value": "90a532cba80bda66de99130f6b8edf39", "object_relation": "md5", "Tag": [ { "name": "ESPOL", "colour": "#9EFAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744205, "uuid": "14e97eff-c888-4703-a995-e2d5bca51816", "comment": "Malware payload (SalatStealer)", "value": "0a1ec11b4df7dfc1622e30f46eacc92b021a329b984923f14612b8b4704e6266", "object_relation": "sha256", "Tag": [ { "name": "ESPOL", "colour": "#9EFAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744205, "uuid": "fabed64e-075e-4e9c-8103-eb382e44ee83", "comment": "Malware payload (SalatStealer)", "value": "86e11cdb602fb1910b5b76934267cdf3c18a166e", "object_relation": "sha1", "Tag": [ { "name": "ESPOL", "colour": "#9EFAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744205, "uuid": "beee50ef-e222-42df-a7a4-005bfbfb6d0e", "comment": "Malware payload (SalatStealer)", "value": "2e7473ba43e0a52fd03f754c0be61f4645dc1e24e2cd623b42f4ec242eaa1d2a78f7acd52843a393e52c7dcaef407dc6", "object_relation": "sha3-384", "Tag": [ { "name": "ESPOL", "colour": "#9EFAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744205, "uuid": "5a0bc6a7-e58a-4ee2-9ce1-9710a05097a3", "value": "T194E63368BF818ED3E99405F59EDEB2544A348780061B9D8E9E9E7F036019F12CC9DF4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744205, "uuid": "fcd0a8ed-0942-483d-ab53-7d618de4afed", "value": "d8825d8e5bfdbb80bc14fc1af244d8f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744205, "uuid": "6adffae8-3303-4a8d-ae2c-78ea1019fc64", "value": "393216:asTGENWadAYC4QMOYC4QMOYC4QMOYC4QMOYC4QMOYC4QMOYC4QMOYC4QMOYC4QML:zTGdbV4sV4sV4sV4sV4sV4sV4sV4sV49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772744205, "uuid": "53befb14-5085-421c-a319-1f33ddb91998", "value": 14199296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772744205, "uuid": "45d09c18-f051-4e43-9447-d4371f475cb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744205, "uuid": "a8adfd06-ffff-4a22-b27f-6519c1068c35", "value": "b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adeef714-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707637, "uuid": "15fdbdcb-91ee-4906-aa40-8d8da802a98a", "comment": "Malware payload (Mirai)", "value": "55032ad330d7ba0ae1bf44462ad8ff98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707637, "uuid": "b95f547d-a31a-44b1-98d1-139413591ad3", "comment": "Malware payload (Mirai)", "value": "0aadd6772b65a84b0e583ebe675ae440520e24e1c2b4aec561fd1d230d34ec91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707637, "uuid": "809a936b-71f7-400f-bc04-e11353f2f04a", "comment": "Malware payload (Mirai)", "value": "d4acb39140ef115b0d5008384b6552128f12a28b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707637, "uuid": "9a0500e1-0396-4be4-af3e-c9e3e5b6285d", "comment": "Malware payload (Mirai)", "value": "6597e7ca0aad3fdbf3dfa88dda4541efc4a6f1d1ea8a87cdfe5496b53c0399e10a6c1795a09c495b1405c96cb70bfc8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707637, "uuid": "d4c00516-ad91-498c-9529-ef7117b794d3", "value": "T1DEA34A92F4019D7DF94B967A80270E09B53153D10FA20B37A7A3BDA7FC761A86827DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707637, "uuid": "75c54980-be62-4064-8217-5181260956a1", "value": "3072:FbbBjQpfp1cJRpTA4hUR56R96UXU3E1ieTBnqK:n0pfpgpTAs10UXkEweJqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707637, "uuid": "315d20fc-84a0-4f54-ac75-2950860bf558", "value": 107156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707637, "uuid": "2c051d3e-4e17-4c98-bf04-f4562cd38016", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707637, "uuid": "dc41224c-d02a-4dd5-8c33-3630687303cb", "value": "5r3fqt67ew531has4231.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fda304-18cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772740044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740044, "uuid": "f28cdde3-2170-4b00-b0ec-42f9a6d202a7", "comment": "Malware payload (Mirai)", "value": "b00ce29f4cc1707f26d4c382a7dd2ff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740044, "uuid": "88c5cdd7-7182-4a5d-a58b-7cbe3092e239", "comment": "Malware payload (Mirai)", "value": "0ac65d687f4c12121891c615d2adaa41f9ab8a285ed964c6bc4fcda43c0162de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740044, "uuid": "9d05dedf-8e74-4dc3-83ce-7099364b776f", "comment": "Malware payload (Mirai)", "value": "1bffe24c15fcddfef3d9a91f6a7087b27494377e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740044, "uuid": "297e3561-0860-4530-9841-09d2ac462a4a", "comment": "Malware payload (Mirai)", "value": "44df76340990fdeffa3912931d76edd2e2ac56c8118065e34291659d44ab54c9aede16e9ab4f2eb344a897402ff91427", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772740044, "uuid": "6533166a-36ef-46f6-97d7-eab8659288f9", "value": "T150D32A45F9404F27C6D612BBFB5D428D372A17A8D2EF72039C256F25378686B0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772740044, "uuid": "921012db-444e-4b90-acf3-1dfa12d469a3", "value": "1536:K1qNEWQs5jPvlxHBha8OAJuu4VqZh1TmjUThScVnO7DIjdxKwWuAcl3/wyw8YBFu:K1qzNPo8Ou4GvCUThlykY2nYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772740044, "uuid": "736ca66f-c917-44e9-a36a-95d6ebcfd4a7", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772740044, "uuid": "1232366d-9091-4bed-a6ea-9fe37b4f0f67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772740044, "uuid": "64bc6a4e-06a9-4c7b-8898-b324079c89f1", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470de901-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772695009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695009, "uuid": "e8715ab7-51b8-48b6-b587-ac94b523bc9a", "comment": "Malware payload (SantaStealer)", "value": "c4e77dd1a99fc97cb3918505f99e9c86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695009, "uuid": "1f150c56-5358-4da6-b2b1-f50389498369", "comment": "Malware payload (SantaStealer)", "value": "0b3e5a36c9f106556222fd7dde64c8bf1ecfb3ae83918479dcc1b7cfa3a8bae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695009, "uuid": "bda633b3-f5d2-41bf-8f1d-a912fa840c7d", "comment": "Malware payload (SantaStealer)", "value": "3c8cb68c14697729fdb6201d25cbb25f31ae9f2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695009, "uuid": "425e3e9a-710f-4ec2-8eaf-a8a47fe15c58", "comment": "Malware payload (SantaStealer)", "value": "b0d6cd07104520e52bc9002dac56ad79efafd93d951b78034cf30b8b6eca0f6c866e135b7ab8cf94ee66424f39a1c5d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695009, "uuid": "ab8a84fc-d864-475e-a033-c56f1ce99bd8", "value": "T173647D15E75506FDC13BC2F4CA824902EB72BC86437458AB23D619A21F276E19F3EB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695009, "uuid": "5e31696c-0346-4ce6-bd1e-530daffaa3c4", "value": "d62fec6a59576f4c829b4d911213a091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695009, "uuid": "d526607c-c3bc-4e4d-9297-ef11c6bb407c", "value": "6144:L8OWQMk5jp2SwXBuIS5vYpiA+cNdQh4Ys9FFOpfLZKdV70HqnkEWs:42MSd2ZBuZQpiPWU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695009, "uuid": "0fe3caa9-6a75-4355-ad32-6ed4688278cc", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695009, "uuid": "5fc4173b-47e4-4d64-9307-71054a280af4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695009, "uuid": "a84ca567-8801-4f61-9595-f1f5196b8649", "value": "c4e77dd1a99fc97cb3918505f99e9c86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a480807a-187c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772705904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705904, "uuid": "9f21f740-b2fa-462a-85bc-c45828132c5e", "comment": "Malware payload (Vidar)", "value": "706caa75b592935c6a9daca877b7b1ee", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705904, "uuid": "9462c59e-8b58-4b0e-8913-4915bc14a7c9", "comment": "Malware payload (Vidar)", "value": "0b672807d7526c571d3809112ca0d04e3df926b5414d00cb8a6d73f59a172e9b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705904, "uuid": "6dba8b68-03b6-4f58-ab86-2be0846b5479", "comment": "Malware payload (Vidar)", "value": "dad55c14942171708b8b101d40349df7ea4df19b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705904, "uuid": "544b34cd-1f3c-44f5-a580-4306e1b98e12", "comment": "Malware payload (Vidar)", "value": "0174509eea9af5ef25e2a609d63eaf589b609510f39297a63fc00194a2084dc86ca2fcecf886543534c47af0f079d0ba", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705904, "uuid": "c55eb652-4aea-41c9-9724-2c013b03e3ff", "value": "T1DE2423F201455A5BE71288B01DA9D70C74A3EA3F92B12001C66777551E0F3E9FF7A19D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705904, "uuid": "1332e2be-e7ad-4c90-b827-498945064725", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705904, "uuid": "ce9ec405-3364-4c81-b373-4c8efdd3c2d3", "value": "6144:nMUNt7a3yqgdX/w7drhQZXveORMOqHa02FDz4+7cj:nMUNAgdPw7drSF3tq63G+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705904, "uuid": "7636308b-84f5-44d7-b362-996b48cd93f0", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705904, "uuid": "8e61e4d7-bddf-4b9f-98ab-9c5f73c690e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705904, "uuid": "1a00619a-2ba1-4135-9e04-d4b386b8eec6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2593e03c-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726736, "uuid": "c67897e7-c9ff-47a3-a7b9-ce50a64253a7", "comment": "Malware payload (Mirai)", "value": "b8f1dc1e86c062cb13bbead9d8f6711e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726736, "uuid": "57d8d67c-1285-44fc-b580-6af6582e6906", "comment": "Malware payload (Mirai)", "value": "0d6dfd32e94e1e3044e41d85d470a9702efdd784610b7a8dd84e66f627411c84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726736, "uuid": "c1509025-3cc0-4dc8-b74d-9b85e40af818", "comment": "Malware payload (Mirai)", "value": "813e01f08f5d77283674aa0dc3d2967fd18ddd1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726736, "uuid": "807f170e-22b2-45bc-8bfc-714101a2fc5a", "comment": "Malware payload (Mirai)", "value": "a8f541605a4f428672bc9b55aaa7c53da9b8f2d1f11c3c5f2d454771bf0374c168000e715c7664806c950edb68d68805", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726736, "uuid": "cd0a2197-480a-45da-b053-9ddae77e1bf1", "value": "T1739308C1F58B44F6C80B8D3050A7F73FDA31D8BA51305BADEF99AF36DA67601911224A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726736, "uuid": "13e04213-4318-4bfa-b65a-48f2def8ffdc", "value": "1536:TzQQXrtUOIFwKd3uthF5BXbkSkC1lqJ/mHGvgGMWWe3Xc2EkY7rIaSg2VX9:Tv0FwKd3u9bXbkSkCXquHGv1MWvXclkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726736, "uuid": "d6b1cadd-b459-40fd-82e3-c255646026d0", "value": 91984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726736, "uuid": "b8c52db1-e22a-4522-b458-e0ded3b410d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726736, "uuid": "699c60ba-e098-48d0-b650-20b9fb83b4e6", "value": "MMaaRRiiOisecTanee.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c63d45-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772698040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698040, "uuid": "3cba03ff-e44a-45c6-badf-2b8f4fb309e6", "comment": "Malware payload (AsyncRAT)", "value": "d7321b51a80fdf2420069b0cadb13959", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698040, "uuid": "d2c727c6-62c9-4dd5-a33b-a457ad1b2840", "comment": "Malware payload (AsyncRAT)", "value": "0db2435d22b78e37869eb31a75a93a3c1804047d09fb79b09cd06560695ad2e4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698040, "uuid": "90861a43-d063-4218-8845-cb85a58185b9", "comment": "Malware payload (AsyncRAT)", "value": "97d96f42088e1975e321fa305edef0f4da2c5728", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698040, "uuid": "792b4fc7-0e15-4ff4-99d7-4434d2270a09", "comment": "Malware payload (AsyncRAT)", "value": "3b2aa5d862614d06e63c789d1a76026681a647040a876e6a0d7b96c4a14732c747449ae609f614eb9d567174b6c44bc7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698040, "uuid": "21f2e8a7-e49f-48bf-bc64-3e138c4fee97", "value": "T13C84BF847FC46F60739C691773BFA952D2E5CF8A5A02778ED3996C42792FB04031B889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698040, "uuid": "8808cea6-fc8f-447e-b9b3-db9ac58c7d9c", "value": "6144:eFRWI4rouoFepFqk4aDW0EGMpGBuhFu1QgwrZ7Ye31UeJO:eFRWIPuokr+L9gmRYe1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698040, "uuid": "4ace3b48-05be-4bce-83be-2761518667c3", "value": 396479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698040, "uuid": "ea9ebb9c-90ce-4a7b-82e2-6faf848c761a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698040, "uuid": "9830c409-2b27-4897-826a-9ec44271ccb7", "value": "d7321b51a80fdf2420069b0cadb13959.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7d4fdf-1892-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772715154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715154, "uuid": "16b86e58-3d12-46a1-a666-59d1200e269a", "comment": "Malware payload", "value": "851b0dd5e35495fa5cf122a6df17dd09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715154, "uuid": "9d1e2bf3-10da-494e-8c4b-57e98f41bf6e", "comment": "Malware payload", "value": "0e397bd7935c280c172bc5c95a57c9a652da50e2d770040432b245aa2d836ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715154, "uuid": "9cf417b4-af53-49d3-95dd-492c81595f8b", "comment": "Malware payload", "value": "88e0f774d6cfef84e2b9e12f426eb08b7f649806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715154, "uuid": "53659955-830c-45da-917c-8b8885ae7de9", "comment": "Malware payload", "value": "a6e89445b6d033f6a7c671a734e620c1bbe887fcee90089eb42238207c6d5476880eb3ccf5a3c162506f7262ee36c60d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715154, "uuid": "f6072df5-47f1-4952-a750-04dfd38c8840", "value": "T19AA512371FDE944DE45BCEBC4975607F93F1B69A26FA628379108420CD239D2387B642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715154, "uuid": "02f57c00-8f50-4952-b51a-caa2f67d4d79", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715154, "uuid": "d7153eca-ed4f-4d92-8815-7cb402bf11f9", "value": "49152:2vKAc3EGwTrKvnzGV+YCBdYGglHXivsQVazJOBxe:2T/WqYYeYRZmsQsz0Bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772715154, "uuid": "64abab81-95af-4037-b084-de29a9254c43", "value": 2100224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772715154, "uuid": "0bf5899b-42af-4545-b288-4ab65b86c8da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715154, "uuid": "5a10c3a4-f2d7-4967-966b-1f589eb192cb", "value": "0e397bd7935c280c172bc5c95a57c9a652da50e2d770040432b245aa2d836ca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f94890-18c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772736905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736905, "uuid": "1df78546-54d6-4729-8521-56798f3bda61", "comment": "Malware payload", "value": "cc98825c63f045101b15650e8c4b2277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736905, "uuid": "d7477a47-dfe3-41c2-9a36-b0a8a3eae0b5", "comment": "Malware payload", "value": "0ef331e50ed00e5d54dd318e15c4e31ccb770b7a6ba066afdcae2f5e24dad832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736905, "uuid": "15ac35a3-b2a5-4628-9b3d-1e011fc17203", "comment": "Malware payload", "value": "2efed9c8a505dd3d872df686300a55f6637a39d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736905, "uuid": "480ee77b-65c8-4250-acb9-5d40c47112ba", "comment": "Malware payload", "value": "8c2169268e2fd21fa19af51e853c6ba444b33a088b435a3091e733432437e7f80c39db8f0b09945ed784426f94ace177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736905, "uuid": "f073296b-d157-4b8c-a8a6-a1b64f17bb62", "value": "T18385AFE83B0CF38DE53887789005249FE6F76DD10566F1C1E921A232A90BF19667FA71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736905, "uuid": "c3fe50cf-2d4c-4345-bc17-7eec4446f10d", "value": "4a66de3e8d132708eb41ffa0ee63c649", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736905, "uuid": "e728b25d-4c5a-4425-b89b-02be5bb8b35d", "value": "24576:Z6SxgEiH0cMZLC0JaGmrQbqMe7zqQ9J1u/TNqAtn4x1aS6RIBstt64Ko9Eops99E:iPz9sIQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736905, "uuid": "9c19d7d7-f348-4dac-acc1-c5f005da7de6", "value": 1827704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736905, "uuid": "4b792564-228f-467b-8d9b-0570ddfbf4c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736905, "uuid": "8d1f05ff-f3ba-482e-a8e6-e85b7c632752", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43abd34-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703353, "uuid": "d841b731-c772-420b-8c75-48490e9bdbef", "comment": "Malware payload", "value": "c14675d5e2f9502f69bb4f6359f5ebf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703353, "uuid": "451a5517-d75f-4120-9649-6d0f5fb8ff58", "comment": "Malware payload", "value": "0f829c27b12416507d82d430160f354d13dd6946129edb49292e604d5f5f29f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703353, "uuid": "8921d1ac-2b64-4c2b-9ce2-91c904672120", "comment": "Malware payload", "value": "939caf7b6025a1b517f83664e1589b14d52dd9f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703353, "uuid": "4196501b-1ca7-4791-84f8-2edc4f26b337", "comment": "Malware payload", "value": "12bd5dbcc3335482433e967fe364b183208121f64bf7523b85eb45279344feb8176a88a55acd3d2a59a373da3dd1935c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703353, "uuid": "85d266b3-fcd7-4573-aeb7-c4369a77eb64", "value": "T17047DF77914238E9E5B98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703353, "uuid": "0582204c-f779-4c81-8746-97ef68683a0b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQK:cqYUQuVDt0TZEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703353, "uuid": "4a8a55b5-55d0-4830-9664-ce79c4a4e6f1", "value": 25690112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703353, "uuid": "cf376a7a-13e9-470c-bd4e-d79d91de48d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703353, "uuid": "1383a39b-b7e9-4b9b-8ef9-5c5e76ac644d", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65071703-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698066, "uuid": "c501e163-f89d-46cf-83d6-a4637d559024", "comment": "Malware payload", "value": "f7b12d3504666540310ef2b6047dff21", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698066, "uuid": "0e7ccd51-18d3-4cc9-a5d5-da71f60ff37d", "comment": "Malware payload", "value": "0fc9aa1b94eb116d1dce61b28eacf537131c45b47d24dad021b8c81e3055d4a7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698066, "uuid": "8ba591f4-c93c-4512-b6c4-f3527f470d59", "comment": "Malware payload", "value": "642c50e68255cbdd1c6bc8c4f793cca8c5a91001", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698066, "uuid": "ca0c69e3-963b-4d1a-87bd-525a19215141", "comment": "Malware payload", "value": "5418ce75436c49638820794a606ee53d196ee28bdc0aeef427d74d40a9edb83243f671b878ca7e38e86e411570cd38d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698066, "uuid": "2ef876d9-6365-4403-899e-adfa0058325d", "value": "T1F7F2F8A0B727400B2EDB1D0A491A5583DFC84A858438257FAB5FAE9ED019F34E2F75DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698066, "uuid": "5a13e9aa-330b-4f6c-91e6-415d8cd9ded8", "value": "768:sV2YeGSz/XDxqGit64D68tcQfUwmrwpFwwJB87j7R2zTIGTi0clMch3GhjHX4f65:qt136Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698066, "uuid": "94c59f63-aff8-4af2-be72-23befff1c459", "value": 36345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698066, "uuid": "0c198440-4057-44ee-a393-bcd9f32734de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698066, "uuid": "13cbc02b-0edb-49c5-a0c3-b71fac000f52", "value": "f7b12d3504666540310ef2b6047dff21.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7ded72-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772697810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697810, "uuid": "70781fe0-8dda-4b91-b8e3-f4853b029a8d", "comment": "Malware payload (AgentTesla)", "value": "171ca1fe17cbefb800609cbfcc306beb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697810, "uuid": "d90d8090-cb81-411e-a1ce-f236d51f5a92", "comment": "Malware payload (AgentTesla)", "value": "1092d2366503e129af43f056aeb668955a0ff7989fe95b1223df8fadf1800cfc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697810, "uuid": "8e30797b-8218-410d-a445-80af22bb9750", "comment": "Malware payload (AgentTesla)", "value": "218e6dc7e6711abda1589144820de540052240c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697810, "uuid": "079a95d7-dde3-4aab-8fc8-1b80aa6ade53", "comment": "Malware payload (AgentTesla)", "value": "6591c08cbf9fc88595b5cfb24f37572ee10eecb1a0698adc32e12488974dae17fa7092053797c1a4e14aec70ae0e129b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697810, "uuid": "30a7ad35-19d6-439f-8656-9924c035a7c4", "value": "T14B559E65CFADAEE1E68C4B2D2DBA71CF3FA255CB8A10B518D4748862E6F3C440613C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697810, "uuid": "0274a44d-7114-4746-bfb3-9eaef5a7b665", "value": "12288:lTT+ySENnfH6XnZTx3qmzlz9Ci0S1z0qVEPeAJff8R4KBzyo6dyoR1+iqCCJkZLA:xK6NnPcbwiDcZ1eRkSVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697810, "uuid": "024656a0-d76a-4af9-b34d-c08c06cabdab", "value": 1372317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697810, "uuid": "d55766d9-55fd-4b11-9bfd-28b4a38676fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697810, "uuid": "1f058f43-8d2b-4632-92b7-60320c408ec9", "value": "171ca1fe17cbefb800609cbfcc306beb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29e1cdd-187f-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772707269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707269, "uuid": "4f0c8d72-e2b9-4829-b812-d100a4172bbc", "comment": "Malware payload (SantaStealer)", "value": "2e9f7cd3392ff50b39d508b9e3ef5095", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707269, "uuid": "34183fb6-68bd-4312-9218-a649e8fb864d", "comment": "Malware payload (SantaStealer)", "value": "125f08d47950d9c21999b30c43d753a6cc362bb3482fed32d1a246b8c36b061e", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707269, "uuid": "fe9c3953-4b3b-462c-929e-61e91d353c44", "comment": "Malware payload (SantaStealer)", "value": "e023d389d3fca671ec24072abe76611fc9365a17", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707269, "uuid": "302ca87a-a4f3-4445-801c-dbae79472607", "comment": "Malware payload (SantaStealer)", "value": "d0269738eb1481bd81a80c06c88bbff9c63c4d3a425a4d98c1895163563ba0cc9b8ad55ddd81071e7291d297b873463b", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707269, "uuid": "bd72eec9-132b-43e7-a716-04403e2f2331", "value": "T1C88733FF2EBB656422386141413226F5FEC01A1A39127F1FA85A7A96F273D71750F08B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707269, "uuid": "921fbe8c-b191-48e3-9723-e382cb082e13", "value": "786432:eenk8DVoDnSlYPoXEhrIkf4YdDnPSkPPHolGkW2JqAdQcvmIt7qP+4D6T:evSl+hrJSkHHAqbAuceIt7qP+lT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707269, "uuid": "e4df5af0-6bdd-41a1-a8ea-606ef914a56a", "value": 39036567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707269, "uuid": "f6c313b0-4d2e-490d-a32f-dc5a64c3fc48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707269, "uuid": "68207bb8-3026-405e-a706-9ba7e4d9d040", "value": "KMS_Activator_App(March_Updated).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b689ee29-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707652, "uuid": "bbfda749-db1b-4453-8855-67fef1020896", "comment": "Malware payload (Mirai)", "value": "1ab6d8345ada12e2d1bc8edd96e03a8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707652, "uuid": "b30ae270-3a57-4613-8020-a69f0e350b00", "comment": "Malware payload (Mirai)", "value": "130439a85b4478d1f6d4802f0272213e848033e069ba2309c81bad120e0e41c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707652, "uuid": "4c9d8cd2-b4e1-42ee-b2b0-4dc3d04ab447", "comment": "Malware payload (Mirai)", "value": "0334f10a8efbdc0aa7b369f3a153822422021326", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707652, "uuid": "e2fabf7c-0516-4cfe-ac61-555830f38a1e", "comment": "Malware payload (Mirai)", "value": "232ba1fc5278b24696f4fccb43335b5cf84ed9348a5215f384c347e24cbce44081b1d7275ad3f06222c5b2eb972cbc7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707652, "uuid": "4f86326b-3efb-4e23-9542-07ca16c493ea", "value": "T1F013E1A6936E59BBC42AAA314D914585FB58B85491034AAF0CE825FFCCC390CEC94B98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707652, "uuid": "2f677774-20d0-440b-bb27-7796be411a9b", "value": "768:cqUjao9QwZmy9aEtpcKYtFy4TDEH+qn6x/gRcUZP2oa+fhSoiOCx1Rv9sPwx:cvjaoiAm7EENLT6MezPrMooxXFuwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707652, "uuid": "85440510-850a-40ae-980f-5dd0f79cff34", "value": 43688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707652, "uuid": "ea4d995f-83cb-4847-86a6-ba433f9b3c67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707652, "uuid": "7f42bce1-0484-4d6d-87b8-f7a21d3a7bbc", "value": "5r3fqt67ew531has4231.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4e5fec-188f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772713968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713968, "uuid": "5a2eec0c-47dd-42eb-be78-ba16be389bb7", "comment": "Malware payload", "value": "f8560b9a893eeb2130fc7159e9c1b851", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Darkcomp", "colour": "#38D619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713968, "uuid": "148d3c53-127e-42ab-a7f7-72d7da2c21b3", "comment": "Malware payload", "value": "1319d474d19eb386841732c728acf0c5fe64aa135101c6ceee1bd0369ecf97b6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Darkcomp", "colour": "#38D619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713968, "uuid": "994d1858-71b0-482c-91e2-23ff0c9e6468", "comment": "Malware payload", "value": "4a54b7237dc9fdd745d0d19083a1ce4857c91de4", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Darkcomp", "colour": "#38D619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713968, "uuid": "c08b1601-a5ca-440f-8740-1bfe8b259814", "comment": "Malware payload", "value": "4692e14ce7a41c3016f1d6d77674665e810405e4c78cb92ac799602dd43257aa3dace4cc8c92d206fefcb1761df2431a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Darkcomp", "colour": "#38D619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713968, "uuid": "f9a3d296-f781-4feb-9ab0-0b0edfc7b5c2", "value": "T16366D93736C96268E7B3A7BC94B2099066757C367B65D6EF0885042F5C13BF18C3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713968, "uuid": "a9c2d566-cdc6-41a3-8687-69dac68f8f09", "value": "656d97a30b392cbed9ab12a15d88f83e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713968, "uuid": "7a0868b8-d155-41b2-b862-45f1a909b246", "value": "24576:Bi6W8RNckKMmUwcn9YB2Vt4Q7ateRHjKwz2psZhGxAdh5j5oSfGQCE2mkDOiIRvT:B0nUnVt4YFHjKKsubdhZKUX2mk3GV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772713968, "uuid": "a7899b6d-e1d3-40ee-b0b5-abb984373f67", "value": 6919680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772713968, "uuid": "b1b5441d-c8d2-420a-9e61-4ad88292aafe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713968, "uuid": "e0e5388e-03cb-48a4-b43e-dc3bb77c4684", "value": "visualwincomp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b2c334-18b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772731407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772731407, "uuid": "fc949365-5713-4773-b046-1948771b8e35", "comment": "Malware payload (Vidar)", "value": "da153cfe63cae14a0d66d9150019ce37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772731407, "uuid": "487fc763-1d87-4f01-bad0-4718127b3fdc", "comment": "Malware payload (Vidar)", "value": "132184d6f05f0d471b6f64c143d3d0bbd94a67ecb79c656c300662dc7274d25d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772731407, "uuid": "74e5a281-9e81-4a81-aa68-6983b8d65286", "comment": "Malware payload (Vidar)", "value": "be8a309a090ec662f9b956d9fc7e1e63c1aa6846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772731407, "uuid": "9c915971-c5ab-477f-84b1-0e99838027e1", "comment": "Malware payload (Vidar)", "value": "d685f15ddace949dbd3970395482f490d678316f3a2132a57f8be4933672aa86d6a2bd972ee6b980425e484e4fa63a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772731407, "uuid": "7d70dcb4-5658-48eb-881e-eaf90e0a893f", "value": "T1E3E6D76B796146E4C11E833ACCA64B0594FF7CB90722C6F7CEA0076C1A765D44EFAE24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772731407, "uuid": "30c6feda-20c8-4669-bad7-e7e51f553de6", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772731407, "uuid": "0db0aed5-65a8-403e-aea3-31528d1a5884", "value": "49152:LtD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUv:gxGLEUp9VDFtBdOTA/e9ZHJdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772731407, "uuid": "f65dfc58-7cd3-49ca-bbc3-74f75294456d", "value": 14389248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772731407, "uuid": "942fbd2c-1fa6-4897-a315-a6f50ef02d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772731407, "uuid": "587f8daf-ca9e-4a8e-b3cc-a16bf97ac5d5", "value": "SecuriteInfo.com.Win64.Evo-gen.28164156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4d69fe-187e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772706613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706613, "uuid": "4bca8ac1-454e-4e67-a22a-3020fc1041b7", "comment": "Malware payload", "value": "9b2513eccee4118c0da511d67ea9f533", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706613, "uuid": "01f0506b-74d1-4348-ae11-9e616def8fbf", "comment": "Malware payload", "value": "13f44eb1dc841faaabfed4a84a7f327689b42c03209a465db5bb0a8a86fe2a9b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706613, "uuid": "10e4b820-7a38-4486-83f2-63fcd7000c9f", "comment": "Malware payload", "value": "da0d7c2eb65e796744458a9d5cbcb58e78fb1ff4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706613, "uuid": "3371097b-ad6a-4a75-8671-a8405725096c", "comment": "Malware payload", "value": "cd0d451ec49730f627e2cdcb4c4f6c6ab6517992db0d2a16f241f85a400ee080c410a0348f4b661b64292c3a7e146259", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706613, "uuid": "85e264bd-7403-4ecc-b94b-5570fca0634d", "value": "T16F366D817A8465E2F0DA183C06ADB279F1BDFE715D2623076210F70E6DF12826B1AF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706613, "uuid": "2fe28824-fd6a-4ce8-ac13-f3c751ce0b5a", "value": "efb56419c1ba206d8c70e3157d5c83a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706613, "uuid": "473ac37e-7980-4350-a601-869c53f414a9", "value": "98304:xJZczGW8ke6KllNHsyBqGeQVrrNW2XkGMWriFLOAkGkzdnEVomFHKnPRUdMa:BczGRGKLBZ/YGkGMWOFLOyomFHKnPMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706613, "uuid": "c65a3809-cac3-4a35-ab23-064997d9c9a4", "value": 5127088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706613, "uuid": "a5b3ce66-31c2-4234-9932-8ce272019cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706613, "uuid": "ba993e4a-18f2-4efd-a04a-86923f1d2f99", "value": "mfc140u.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6ecc18-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707635, "uuid": "a5872a1c-bf58-4b0f-b486-d75b26fda832", "comment": "Malware payload (Mirai)", "value": "ca642d130c9372d0c8af0029106590d5", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707635, "uuid": "196bad4c-b7f6-42aa-8751-75f195d1adbb", "comment": "Malware payload (Mirai)", "value": "1414d67225695068177273b5e4e5d6ca812375a91659ef642c57c3e1b6819610", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707635, "uuid": "e53c748e-34fc-4654-a88f-cac285919f83", "comment": "Malware payload (Mirai)", "value": "aca0ea0746bec5a1df2d0564a73a4c732ff6c8d6", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707635, "uuid": "4a3213e9-fc02-49df-a5c0-5b06fe095925", "comment": "Malware payload (Mirai)", "value": "6dec33d0811ffdf7f6c443f127e341edaa25b940e3bbe85b95fa083f1f510e6e9bea05d290468a418927aec969b3b860", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707635, "uuid": "9c7ab442-357d-4792-aab9-7c4edb77683b", "value": "T19E6302B6C30523F3D2F35C3E42DA84E736FDF59952B11A5076A967E8B6C7C010AA58C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707635, "uuid": "b297df77-44aa-4e87-b794-ce469fdc78ea", "value": "1536:mAA+5n/JSDyhIe7jduUrt2wcybup6k2CgT1gJDehtOR849xLlcQJm96rK6Diq:r/0Oj/duLquz2VGJwa8YX4nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707635, "uuid": "5372f511-31ec-43a5-ba9c-66ddce730251", "value": 68524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707635, "uuid": "43d97eaf-53bc-45fa-b8b9-3fb92f5be00c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707635, "uuid": "4ea9b62b-f740-4636-8d15-d4db03d398b8", "value": "5r3fqt67ew531has4231.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dcf075-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697817, "uuid": "1cf130bb-b9cd-4b5c-baac-1e722bb32736", "comment": "Malware payload", "value": "ab24f8592c99fc41d5c535afbe277a3d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697817, "uuid": "5eaefdd6-3917-4096-aaf1-e7d554872e16", "comment": "Malware payload", "value": "1540b30c21f681a25adacb55a6c89bd389c2a1767437fc176f74c5f8d9db0b29", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697817, "uuid": "09b1694d-978d-443a-bd36-8761b7b34880", "comment": "Malware payload", "value": "73fa5440a2b058b5fd4ee26856f91c9b516329ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697817, "uuid": "98a0ef60-f744-4633-9bab-4ab3daf2be94", "comment": "Malware payload", "value": "8765b7c48e90795dc8945f4607916fa94d89120cf0bf2e168559ed388c418a67df05034fa4463ea0937730bc60a7ccb0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697817, "uuid": "99fc65b5-5d73-4aca-870c-496e9d55dea6", "value": "T150B2FE8E3FE6B46003617073792BA92BE37F4D44B04D8055C617A4B8FAACF14E4B696C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697817, "uuid": "05d8f883-11e7-4042-8e9a-2feea8a47777", "value": "384:s6J1VNlsqYDkFsF1heziF8xXped9ib+JPvcK9MuM9B/XOML:sO1nlsqwkFs7UuQKtIhFO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697817, "uuid": "17de5bcb-f0ad-47e9-97b5-b4cbda025ff0", "value": 23498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697817, "uuid": "127ee79b-683d-4f1c-aee9-bce149376716", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697817, "uuid": "40a7724b-255b-4992-8e31-2ab3ac0f5825", "value": "ab24f8592c99fc41d5c535afbe277a3d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169491d2-18e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772752051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772752051, "uuid": "727802b5-7d8a-4b56-8e27-0c15039e3ae0", "comment": "Malware payload", "value": "ece73e2426afafaf650e30c34f9e77e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772752051, "uuid": "4fc49d54-fff2-4143-805c-1e37da2a7a9d", "comment": "Malware payload", "value": "15546087453ea4d259551c021d25c8a3ca1150036659d53b09e42c891a1b9653", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772752051, "uuid": "22f8aa42-6f5f-45e3-8041-42d646960c8f", "comment": "Malware payload", "value": "05e4fb126fff84e0f1ebd6f984de4cb0866c2c01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772752051, "uuid": "b10b25b7-e008-48c7-9b3b-0e74023e57ca", "comment": "Malware payload", "value": "53019b8d5157a1da244564a1b51281b92dc3333d80c4fed529b57e77893991d6ddd945e05d2fb376bab4532d1ade3659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772752051, "uuid": "f95382b2-7158-4ae1-bc5b-cdfafdc7099f", "value": "T16B158E56F2F334FDC067C030835BDB626932F46541226D7B21C4DA382EA6EB51B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772752051, "uuid": "8984cff5-6614-4376-b0db-73ecc5140867", "value": "12288:juQPyhXq/PqY6W+MbwPPIKga4W4myOUpI5ko2ZcueIRy:SQahXq/PEW+MbwXIKx4Lpi26ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772752051, "uuid": "9d6b7713-851d-4fbe-afdb-ba30b7d98e8b", "value": 909632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772752051, "uuid": "8125d78e-69bf-4f42-8c40-a6d631662bc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772752051, "uuid": "30936624-5b66-4a57-be76-104f904f919c", "value": "15546087_15546087453e_infection", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf083a3-1874-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772702480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702480, "uuid": "27271bea-5048-4ed5-8875-e2937434adc7", "comment": "Malware payload (Vidar)", "value": "9e492497d9e8470a2c0ac509afb82930", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702480, "uuid": "a9ff2cda-7054-4d59-bb53-bd1ae36d3f70", "comment": "Malware payload (Vidar)", "value": "155afb71080beee7d606d99606193cc0824b73a0082709c259c026c74f6fc7ce", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702480, "uuid": "8bc0126e-5c7b-4609-8c3a-226b9da31816", "comment": "Malware payload (Vidar)", "value": "4eca4e258955d3480d31cd9511bd40dd1f54d9a9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702480, "uuid": "837ed0aa-3361-4dad-ae0c-c5c657923625", "comment": "Malware payload (Vidar)", "value": "2375c43708abe14335eb0a2f43a604f5bd89cdc2f260a9753a9fb0201f733a5ac6452bbd58227320264ce713dd32272a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702480, "uuid": "360e7e6f-b47a-4f26-b429-3d883c5afb48", "value": "T13DA617AB26E541EDC1F9823AC0628B00E8F375750726CFE3035217AB9A635D55D3EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702480, "uuid": "47e0b128-a64a-4c6f-ba31-a0597f6f7f9e", "value": "c777c0958f1392e5aefc182510e58608", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702480, "uuid": "186361a6-d8a3-452e-be66-c94738f91d98", "value": "49152:Bsx2id0vJ038GaE05/uzdQ/7KzsSwFYlPZPyen1qFxIjPpSCoeoIHkRAPKsWOPRH:oDqMPNoeoIERHsWOPuGdhVS+bLpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772702480, "uuid": "4d5a9bea-029e-4487-914c-be9ae883fbf6", "value": 10220544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772702480, "uuid": "d7220bac-a230-4146-a6ba-ec80b0600604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702480, "uuid": "0f3fb08f-46d8-4c5a-9288-00391653796f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c9744f-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772694959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694959, "uuid": "c3a5c651-f471-4c11-b459-4af88623a33c", "comment": "Malware payload (SalatStealer)", "value": "6fb4745109e3d0b9a430011be1cdb4d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694959, "uuid": "3ccf1e46-48a7-4a13-9116-07a9314f02b6", "comment": "Malware payload (SalatStealer)", "value": "15fb8c70b199a5fba09a4faa55acc75a6e4f86c018c6c38fb9bf755baea10e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694959, "uuid": "8fead348-75f3-41d7-aa1e-0558feebf469", "comment": "Malware payload (SalatStealer)", "value": "09a349556a10a2ce210d842dfd75a5f9256a7555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694959, "uuid": "cebf227b-49f6-4c03-a041-495a165b5ca3", "comment": "Malware payload (SalatStealer)", "value": "fcc1ecdc280f2daf5480e5f98b5be6b2995aebbe2ab6e3040ecab3e13a9aec974b8f7eb09aa092d506bf34b4d1ad1741", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694959, "uuid": "29cf69bb-8b11-4ca5-bdb4-5c6aa86cfc7f", "value": "T110E533DD69E391F3F8AA3C3722A20C9E7C955D1C11FE92D581ED115F8BBB06087E8498", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694959, "uuid": "23f3067e-58c4-42af-9dae-e5ad6c237770", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694959, "uuid": "18214189-40f7-45a0-bc38-9e8be1459c5b", "value": "98304:Lwn1Ls7b1N7cQvZbaKpto2YwBW3rETaWLSHjbK:Lwab1N7cQdo23d0jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772694959, "uuid": "aa61ed67-30dc-49ee-aecf-218ff24faa84", "value": 3297280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772694959, "uuid": "91e99fdb-cd77-4de7-aaf6-424838c2a6ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694959, "uuid": "b82a812e-faaa-4e89-aa97-57ff383f9e8e", "value": "6fb4745109e3d0b9a430011be1cdb4d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc298427-1834-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772675127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772675127, "uuid": "4f3ed006-54a0-45ce-a0df-e2e05d6723a3", "comment": "Malware payload (Mirai)", "value": "78b47f734fa6fedbacd7b170e5e689f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772675127, "uuid": "436c83cb-1a33-4d7a-b4f8-628c9838ef55", "comment": "Malware payload (Mirai)", "value": "16594fcc90351cb2e73b7381e9627806c79a376e11dfc9dffd9e1024cbd41bf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772675127, "uuid": "da856845-af67-4c06-b838-0f5da367780a", "comment": "Malware payload (Mirai)", "value": "a384d3ff5f5076d36354544fa41372b9441b4f86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772675127, "uuid": "c653ecb8-b242-4bb0-a0e1-771783d9e721", "comment": "Malware payload (Mirai)", "value": "f327ba7e8e96388954e7f4903569bca9b0769b56617adbc645e123bb5ad2ef2cc2873b53b1d6fe2e52eb98403c6f4985", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772675127, "uuid": "e1ded83c-ab5c-4e5b-ba39-6514a2b55e3a", "value": "T1BAE3288DFA8BC1F6D80788709026B3FFC731B4294076D35ADF99EF35CA639819616258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772675127, "uuid": "c370fd15-f8ed-4b37-8f69-5a2070d1e273", "value": "3072:9X+JjGj6QGB0Hx/P7N0NXMJIhw2orRYlc67:9XSGj6QGaHx/dv2c67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772675127, "uuid": "c5db5be8-da8d-46c8-87e7-60b5a826364c", "value": 144620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772675127, "uuid": "7a592a2f-4915-4971-8ce2-bcfd899a3947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772675127, "uuid": "c4df4eb7-3170-405a-bb47-32bcf92bfb29", "value": "Polar.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aeea36e-18c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772734905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734905, "uuid": "6a514cc6-cf0e-43ff-81b6-baf0834699a1", "comment": "Malware payload (Mirai)", "value": "3c46cf6d33b36d54fe273a39c0ca32d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734905, "uuid": "00a044c9-3fd7-4e63-b9ef-e415e96da93b", "comment": "Malware payload (Mirai)", "value": "16b28d499b3e3e7daa18346f4da791dd680daf5e09f3744693064476ba503afe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734905, "uuid": "e3b45679-d89f-427b-a570-9ef5c1c5d60b", "comment": "Malware payload (Mirai)", "value": "569151ac6257aa42f4e1d18bd0a44caa36955000", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734905, "uuid": "925094b3-fb8c-4784-bbb9-f8388ea377f0", "comment": "Malware payload (Mirai)", "value": "8526b61dd3acf57c2f980c79b51a88a665559379b1430b36e491c4311044e62c9e8cba6a36aa188a13c5d73f73bd4885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734905, "uuid": "78c207fa-778a-4105-82cb-a354a9a0e62f", "value": "T137332A31B5624923C4D2593A12E7063AF5F28A8E5CF8873B7DD10F58FFA4A442193EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734905, "uuid": "d04667eb-4cce-4852-8bd7-d4d008d668ec", "value": "768:L8fRFyblPS015Q+bN2NUf6hAPZO+75ezmsnc1tsI4:gfRQblPS015ocVB75eets/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772734905, "uuid": "a14a1872-6062-4425-b88d-9c892ff0d7d4", "value": 51528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772734905, "uuid": "31d627fd-c3cc-4204-b7a5-05e1c861bf36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734905, "uuid": "62a8c427-4f84-48e2-ba87-e2176e2a3cd6", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f5e1f5-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703361, "uuid": "f6fcfa83-c516-49b6-823c-981dfc01da9f", "comment": "Malware payload", "value": "8e829cdebb936879b2197103b6cffd06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703361, "uuid": "a4cef7ec-e78d-426a-8acb-f0ed05a06c63", "comment": "Malware payload", "value": "16d20b9cf5bc20f04368d323cd4729649b1be1e0569ec263c3ddad0421c26d79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703361, "uuid": "dccb3f4e-d51c-4c5e-b2f4-a1b97c3f8300", "comment": "Malware payload", "value": "be10b8bf08f213dd36e3a7084252a0b07a5f5fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703361, "uuid": "66d8d83a-b637-4d90-9eac-0867ecd10b24", "comment": "Malware payload", "value": "d260a8b77ce5efdc411eca1551ec216a8b1ac74a6b5b01ed796e022a7a8331111a6e8b24d0bdfce853f52feeecbad04a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703361, "uuid": "e93166e8-a96c-401d-917b-f85d4ef93785", "value": "T1CF060873E59441E4C1EED174C6259223BEA03C9B173423D77BA1A7E11B76FE46AB8320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703361, "uuid": "adc7df15-3167-45a4-a3a3-ad3392167d00", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQU:cqYUQuVDt0TZEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703361, "uuid": "9e9ccd9c-2499-4297-9517-379f2ed65409", "value": 3833856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703361, "uuid": "dbbb988f-1cc1-4819-8265-132bd238cb13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703361, "uuid": "62202e3d-14dd-43a1-be49-22295edd06cc", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f054d153-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772695293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695293, "uuid": "3844aaa5-5d37-4475-b7e9-8f7cc6ef8d5b", "comment": "Malware payload (Mirai)", "value": "aab3639cad20e64b6fb1a4f99b34037c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695293, "uuid": "784f57a6-4c52-4919-a908-8b570a7f8a70", "comment": "Malware payload (Mirai)", "value": "1899dba3ef28e2db8fd2eb98da1d9c060778139469d9b5db047fe5c3e4906339", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695293, "uuid": "407d0f2e-fa93-4c26-a8c2-236c1f7da21a", "comment": "Malware payload (Mirai)", "value": "08a94d076cd257bbcce215618ceca84136b066de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695293, "uuid": "c299b6da-8a39-4b25-936b-a0d21b7d116a", "comment": "Malware payload (Mirai)", "value": "c80b1ea800695ec873b5e3093a47eca8413fda8c86bbe95cc9f963601ad14be9fbedd329dd00a41c6ab20e2753a9987d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695293, "uuid": "3b627110-acd6-45a3-8464-70ae221ebc0f", "value": "T1E4E092CD0232083723DC8E84AA69A00A64806AC26A705A2C9C5900F70D80BDBAB4EF06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695293, "uuid": "1f035d58-2290-4185-9935-9771ddf63646", "value": "6:1hG6KgFgB1/hIq9mQExB1/VCNIvblT+IMB1/7CgLKl2gBnUv:1TqteqARHtkNIjlTBAt7CiKl2EUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695293, "uuid": "1ee87c69-4e51-4684-8215-b64f3e4ce810", "value": 351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695293, "uuid": "c38c3c9b-3cfa-4d9d-b2a2-ff589ec89a3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695293, "uuid": "7948cc9f-35f6-43a4-b45f-1ad003b28826", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9e5f74-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698057, "uuid": "accb4674-6f1f-467d-b0f4-75e7c66a80f6", "comment": "Malware payload", "value": "4e8e8d2ce8c22821fc7d14dbaff3ce05", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698057, "uuid": "222b7ff0-7830-4b5f-ad6a-f0968c3c05ac", "comment": "Malware payload", "value": "189c3de7bf4ccce4ae79b7c7e9193ee879b9a3fcc0dcbfa6422621ec50a85be8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698057, "uuid": "9934711a-ad35-4d50-8708-2196f36ead01", "comment": "Malware payload", "value": "773b835e92a2203ca0c4d3b6bbe3c2d72da43578", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698057, "uuid": "9208d5d8-5177-483f-8b7b-2f1649595c45", "comment": "Malware payload", "value": "1134b591af95ff3065328d0bdad833e4b6988139cea0eb918fdb956749b024a56636c97a421a843ab8036b2a6a69960f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698057, "uuid": "a9dd5649-c906-49bb-bef8-839107d7c768", "value": "T1A9A230CE3AC6F17C02C734763B7FA43AF57F8E542889A054C2563588E865B18D67EA18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698057, "uuid": "9d94a1c4-9ab8-496a-931d-92002ac32c92", "value": "384:x3vH7zxpG0DEvp8wHIL3vZ+K8acKzxcY3Uztd3kmY7k98Ovum:xfH7zxF4oLBqacskztZW7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698057, "uuid": "da89d732-77e3-4458-8e01-5c4090d01f52", "value": 21308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698057, "uuid": "2ffd30bb-c0a5-4705-ac1a-aee105e7a45c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698057, "uuid": "a2394047-82b0-4578-a1c5-edf7ac8985a5", "value": "4e8e8d2ce8c22821fc7d14dbaff3ce05.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e547715e-18ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Fuery)", "timestamp": 1772726199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726199, "uuid": "309e114c-8872-4ae9-b826-64d81253ef8c", "comment": "Malware payload (Fuery)", "value": "9ff305f437f337e6b56ce4269995e04c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726199, "uuid": "854ff267-ef9f-439f-9170-2ee8ca95c22d", "comment": "Malware payload (Fuery)", "value": "18e9a8bfad425d3ff9c0ab3d71e6890320166127b8bdf7460a7edd30f45be0ab", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726199, "uuid": "d58a8e89-5a05-492a-916e-26713c2e203e", "comment": "Malware payload (Fuery)", "value": "045ecab4bf0b7a78ce0f445eb9f1f4e25a52a5c4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726199, "uuid": "e60bf311-edb1-4167-b90a-fb903dd11c12", "comment": "Malware payload (Fuery)", "value": "17c528a825c50afbce8259d5e8ddcf99d1be682d98c7599586cbd7cc49301c566871c3cb30ca8c744aeb7f26a7000033", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726199, "uuid": "1eb4789b-dc04-4f24-8a1b-a2f3f2228d88", "value": "T1A6757C41FDDB24B1EA02163248B762BF2734B9090B31AFC7D9446A7ABD736E40D32759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726199, "uuid": "d03e3ca5-4bd1-45a1-86ec-b298fded9f88", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726199, "uuid": "87537847-c108-420a-8850-05fdb089cf6c", "value": "24576:TYXzsJChigMNRBCdXurmjSG4kl55aUpgRpZ+wMgee5SpeeZdY7tkHN3EAK1eQ2T1:TtCd+r3lRS7LQEtEAKF2TEGf9YK1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726199, "uuid": "f67d6177-84d4-4f1d-9162-7e64c1697c04", "value": 1660928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726199, "uuid": "c65fd233-3897-4f13-8f6a-02b41fc1c4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726199, "uuid": "a144f0c4-b818-4052-a6f7-0f2a9a3c7df3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb9b6d3-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703369, "uuid": "2ab37450-e962-483f-9b85-ddfcc3c929f9", "comment": "Malware payload", "value": "235a9d9b4169872f192d0b45b87b0d22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703369, "uuid": "bb7d7277-09c8-461b-941c-b0b425eb4d33", "comment": "Malware payload", "value": "1992364035341ec05d8b77028e23fc7f4e2d2f1bda5825f9aa4accb132eae9c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703369, "uuid": "c6b72a49-1364-479e-afb4-e2d8c8f2321e", "comment": "Malware payload", "value": "659b1bd7dafb4befc6ba6d68330f62d4742738b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703369, "uuid": "28af1377-873c-4eb2-babc-0fe0819058fa", "comment": "Malware payload", "value": "773434b6b9fc5527511d0f8d62dd8ec5b559201000ddaffabf48564378ff6e58c720b60e683ee1a24a4cb74569884b3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703369, "uuid": "2dbce078-7ac9-473a-8ac2-d0a3c8464aa0", "value": "T1D7160933A59145E4C2EED574C6256213BEE0389B273423DB7BD0A6E10B76FE49A78370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703369, "uuid": "4ae81dfc-2672-4961-a095-1f7c674c4da3", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQv:cqYUQuVDt0TZEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703369, "uuid": "066eda0b-cecd-457f-b6d7-2e363449f8d7", "value": 4292608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703369, "uuid": "1bdd836e-7d7a-4e72-907f-fba3ae53913d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703369, "uuid": "9fd31f03-ac1d-4bce-9d8f-5a256429b18b", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d1193c-18b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772729132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729132, "uuid": "77beb655-c933-44b7-8a04-99a3aec46742", "comment": "Malware payload (Mirai)", "value": "a85f5a055a700a45fe19993554bf2c95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729132, "uuid": "e4197e6d-bac6-45b3-b4d5-ff612518cfc8", "comment": "Malware payload (Mirai)", "value": "19fa2c68c801e456510e5c1bd83102bbfc73f81e6e6b069ad9a8f1ac8fb9e613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729132, "uuid": "e308ca01-9461-439d-b0a0-8365f1403650", "comment": "Malware payload (Mirai)", "value": "16d29e462e3dcaef458c678223f74c7c3015e599", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729132, "uuid": "e6ef631a-edae-48b9-839b-e2f06bacd3e0", "comment": "Malware payload (Mirai)", "value": "d7148ee5607073c3257dd1bb9b9ba4fe4d867aabce05acf33030d08b669c1a8e400e02bc9752892e494b8eb467c4b216", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729132, "uuid": "28980ea8-07a2-4343-9c52-7ef2343af754", "value": "T1A0039E53C93A2D94C63985B4F8219B7E2B53E949A5936FD6D826C274C003F9CFC2D2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729132, "uuid": "3e875290-7194-4a65-9ff6-383985b150a7", "value": "768:iTUc2eBs3+EuYG6TKjj53iGG/AEO9AKblZ3ay3VJ5egoS6VnYUvC5YMy3:4D3BsOEw50LOQS2rCje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772729132, "uuid": "91d870b7-23a8-4209-ba15-5019a6d3019b", "value": 39908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772729132, "uuid": "54145bbd-40e7-4101-a4f9-717655df80fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729132, "uuid": "fc3e9b96-4b5d-4090-9275-a5d2c1b343ac", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1d74f2-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772726931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726931, "uuid": "7b24fa9f-0fd8-4dbb-afdb-7cbb1e05d863", "comment": "Malware payload (PureLogsStealer)", "value": "62776a511def83021b34c10e29153205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726931, "uuid": "244d8044-8fca-40e2-881b-b62d94315404", "comment": "Malware payload (PureLogsStealer)", "value": "1bc913caa618a2ec3579ca0457106565e080b9f5a7c18cbde69665cf35389ab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726931, "uuid": "8d17bcbd-9511-4a33-8e17-3fe83cfdf97d", "comment": "Malware payload (PureLogsStealer)", "value": "017da5ba8691a926783267cac9d8cacba310466b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726931, "uuid": "62c9bbb9-0a37-4ddb-b026-5e0b8a5bfcdc", "comment": "Malware payload (PureLogsStealer)", "value": "f93fe50ba2ec93af7bf45fe3c03c96dc4f3a903bdaf716704c5d95864667dc25449922cd7a654d7c45af08673776f0e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726931, "uuid": "e417b7b9-c9ee-4cf5-bc0f-bf5032b5274d", "value": "T1CBC5E0933144CFE4CCAB1F32E93AC8A107765CDE46499B3FB38E77209B75656582A213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726931, "uuid": "0edd7ecf-cf4e-4ae1-a1f8-ba6309d1d216", "value": "c8ba23b6b87d52f10b27f48f2f6aa725", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726931, "uuid": "ee080354-7a1d-4977-acb9-58a6e8e9780d", "value": "49152:+bdYAm4zEbdYAm4zXbdYAm4zKbdYAm4zFbdYAm4zB3An3AI3AJ3A/nM75i4ZxzO8:MdrWdrrdrAdr1drlA3AaAtA/nq44LzUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726931, "uuid": "e86c91aa-28e5-45c7-b6c8-4280193a3e9a", "value": 2732032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726931, "uuid": "4b335805-1b3e-4611-b6c2-06c3faca2d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726931, "uuid": "30e5fe30-4a4c-4e76-a7eb-b4001d479a8e", "value": "62776a511def83021b34c10e29153205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e6dc4f-1875-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772702710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702710, "uuid": "5342eb4c-fc52-4063-808e-4fdcf77608d2", "comment": "Malware payload (ValleyRAT)", "value": "2f9f6a258648d8182d7d865a6de52f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702710, "uuid": "be765285-287a-4089-b5f6-7f416ae74fd6", "comment": "Malware payload (ValleyRAT)", "value": "1cb286faf8a66491d7e847ffbdae2fdd11497ccce997e9cb5aaa9a212dc810ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702710, "uuid": "26c87728-b0d5-4da1-a497-b530c0cc1a93", "comment": "Malware payload (ValleyRAT)", "value": "345ce587dcec2fe8addf60f5cd041c771612299d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702710, "uuid": "1e62cb53-8f68-48eb-9306-f1b53984e6c3", "comment": "Malware payload (ValleyRAT)", "value": "2285e5aef2d8279e43957a0bf119573e9a4306687b5e48364c3a91a9708ad5f55c1242687fbd4b80d6150e3eecdf8798", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702710, "uuid": "b582ebaf-fcdd-4399-a4d7-d7fac329307d", "value": "T145B37B2172A0C072C093253199F9EBB24E7EF93117B845CBB7E416BA5F603C16A7539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702710, "uuid": "6900073b-2a3d-45d2-9d6d-b3640f864ac4", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702710, "uuid": "34e49627-5430-4f68-a836-d4fdc31ea258", "value": "3072:ybWjdIPbcia0NFtwwnILn3py6D268XEPKW2:ybWjMbcCtwwnchx1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772702710, "uuid": "f8f3af3b-5bbe-48d9-bbeb-2b9b32c5e8c2", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772702710, "uuid": "f4c095e1-1e99-44c4-8a86-6694a5524757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702710, "uuid": "39589f48-135c-45d2-83b3-bb18597ae1d9", "value": "2F9F6A258648D8182D7D865A6DE52F9C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b193e6-18bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772734823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734823, "uuid": "fa4ed0bb-fda3-4efc-81eb-0843e68b14df", "comment": "Malware payload (Mirai)", "value": "3eeca5b1b77d3970b05588e6a6e3923f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734823, "uuid": "32643f0d-bb6c-4d6c-9894-463659cfc57c", "comment": "Malware payload (Mirai)", "value": "1d659db6ccc8fa9a896c628fe96d7d7a0ccff2ed1bdfc95b3d5ef9f815511502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734823, "uuid": "d67e518f-9b06-434c-a1d7-6dee8135a7db", "comment": "Malware payload (Mirai)", "value": "024a809a46fdfd82abe96e10a597099fd7ddc747", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734823, "uuid": "ee29a203-cc93-4009-9b33-efe8159297af", "comment": "Malware payload (Mirai)", "value": "29308e180ee13ab106ea055c0f0e8e0812c5ee841fef6d607f9759b1f8be625908e7be6a60497d2e3ede18a1e292cb63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734823, "uuid": "25442b1d-3f4f-4af3-8887-6408beda531e", "value": "T18453D616FF904FEBE85BCD3305AC8701399D685612B87B357A30C969F25E68F12E3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734823, "uuid": "924ce98d-99a6-45e1-9b4e-b2e084e4d4a8", "value": "1536:ozcXv+9ccTWDlLAqjgp3LaODXwZYwVg04BQYs:owXv+9cYbDAEWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772734823, "uuid": "b89789e7-403c-42ef-af1d-4c4a0695af38", "value": 64252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772734823, "uuid": "613c9c00-ba97-4f6a-a79f-ed32404ba1ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734823, "uuid": "179ab6fb-95df-489d-ad24-c571e7576f86", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59fe178-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703463, "uuid": "70098904-10fc-4f7c-92a8-98da84f91e97", "comment": "Malware payload", "value": "2beaae2edec5f1e43aedae0b3c1e1735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703463, "uuid": "dd6a2315-6cab-42f9-bcf1-9550548fd824", "comment": "Malware payload", "value": "1da1b4f2f0dd724914c9b94595729b4e40729b7a376ae04593ed900e33630ce6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703463, "uuid": "a512224c-c99c-499a-828c-4dc7159891fb", "comment": "Malware payload", "value": "54f44acce5557ff35a463f5acc37648dd7e54ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703463, "uuid": "85581ce6-8fd6-4da6-a6d6-04ebda043ff9", "comment": "Malware payload", "value": "857c9a21d13415723e2a383d8d380e4321709a9c5417ec1969eff9e1d8ba96d412bdb4e034840ca5dc64e060d0deaf6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703463, "uuid": "98f6b3e4-aa1c-4602-8b1c-09e40bea6b9e", "value": "T11A854B57BCE14CA5C4BAD23194668226FA70BC480F7663CB2B50B3782F337E15A76B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703463, "uuid": "387ee04d-cdda-4dc3-a64b-0f0b9497077e", "value": "24576:zjdDbngn9dILsEW8RfWOcJiuFN7iN7mNg1tlG:dDbgnyRO+uHqtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703463, "uuid": "7cfe6e69-5725-457f-aca9-fbe615250db2", "value": 1757319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703463, "uuid": "81959bcb-77e2-409f-b4ef-0c2f36abe4e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703463, "uuid": "24ca2239-dbe0-4988-b276-a91c291abc7d", "value": "ow82023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48510565-18c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772737532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737532, "uuid": "d664166b-8241-49df-ae95-89f788a5e02c", "comment": "Malware payload", "value": "3e9ef0aa0c63c21fd88804d258465648", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737532, "uuid": "c0ead957-b041-4bc7-b8eb-00f3a4f10bc1", "comment": "Malware payload", "value": "1e8965b4d9ff13d9a71f702f1290f1caec9a3569870b9cb4dd39182fd33b758a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737532, "uuid": "98d5bf2f-6129-40bb-afe3-04ab8e280d65", "comment": "Malware payload", "value": "0e8c5f472e33961bdf1706ffad00e1568d595eca", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737532, "uuid": "29de0224-9036-4e45-9b0a-f20ddc85db38", "comment": "Malware payload", "value": "939b7cdf928cc2b910c36af6d055765ec2c85490ef87f2a67d8a6772be8ed3f0f7353581811fba248d7c9d8c35e37562", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737532, "uuid": "1b66613e-57d3-4d47-8c8e-a0d75ee380c8", "value": "T10D150203EB91BEBFE4074735198B0852513F6CA3765E875B1F82725924B72E6F26322C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737532, "uuid": "b5720ad8-372d-45ea-8774-1ff84e96fd20", "value": "12288:0Eo4Yw3GhezxwYo7gZGtXJEo4Yw3GhezxwYo7gZGtXwd2l5IT7KGXEeb+M6txU:05w9wVgM5w9wVgjd7JEa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772737532, "uuid": "ef05cc21-5e53-4ec6-8c56-c262115a5b43", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772737532, "uuid": "bc94e17e-4bdb-433e-8c0d-b9606eac204b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737532, "uuid": "559cd15a-bdf6-4ac0-a6f2-e25512997181", "value": "3e9ef0aa0c63c21fd88804d258465648.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e487b1ee-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703434, "uuid": "da7ab1d7-15b6-4b1c-b4cb-288414abb2b5", "comment": "Malware payload", "value": "7864b42c12a4d74804abe2c1e98d9b69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703434, "uuid": "978d5ec7-807b-456a-af04-350a6eb2851e", "comment": "Malware payload", "value": "1ef0eb60318495dd0cb100fc828f28237d487b800605c7cc54155cf34582598b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703434, "uuid": "f696937e-eed2-4ee2-b7fb-c6dd065b22b0", "comment": "Malware payload", "value": "71cfd59ce1566ddd6dfb51f2be8c0fe065055015", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703434, "uuid": "4f1aa216-c9ac-4bb9-999c-7966542d3135", "comment": "Malware payload", "value": "55fdc931a707fb5fc6d107cac6a33c2bee18a31ece87ccd5118bbdb5bf01eeed63b83854661b375f827a5522b763011f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703434, "uuid": "30a81c7b-f45e-4d23-aa67-9c8ee89a11d1", "value": "T1C945E657E89580F4C1EEE174C726A213B9A13489473437E76FA18BF11B26FE866BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703434, "uuid": "21b42deb-9fd9-4398-9e5d-0064d0166087", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7FOQzjFyaWPli9+J:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703434, "uuid": "e1c8530e-e17b-4025-9e18-6d24a6cf9b08", "value": 1277952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703434, "uuid": "3d997994-d308-4246-8dc4-087c3f6f3621", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703434, "uuid": "d493d279-9168-4323-9f1e-2a441e0fdc8a", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c3f80d-18ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772740886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740886, "uuid": "107fa7a4-119c-44f0-ab8b-87b8c1fd5be6", "comment": "Malware payload", "value": "ac41092ca5333aa847f59868d5eaf5c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740886, "uuid": "23c2bdca-5bb5-4037-912a-4af36a38c07a", "comment": "Malware payload", "value": "1fc8fc78210f50f378a1c8d81e272608bb895b3cfa31af82576efff2c3f6ecd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740886, "uuid": "d95eaae1-9cc1-4412-a4fd-973aa4b59feb", "comment": "Malware payload", "value": "7aee8be7ecea2c07fd5572fec1dbca10248a9594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740886, "uuid": "bd2aa415-a587-4934-8ce8-d96435f6c713", "comment": "Malware payload", "value": "49a790a5f564acede8db8bd47d9b75d738daf41919475838ff183920162031ea7407fcd619b83f12a4c8433b71cc855f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772740886, "uuid": "1def90ec-aed0-45d8-a7c2-261b176200e4", "value": "T17404021C2B94F71AC4ADDA7D28F156435135C10353A1EB0FB4EC215CBE0B78A7AD2AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772740886, "uuid": "a4b9a837-3dfa-478b-8d20-7895ea2f9e37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772740886, "uuid": "4c5c9222-d9f9-4f0c-86ac-fc26ebbe3010", "value": "3072:Agvj2yPktY1K6LjO8ZpVbExMf/kSbHhb+7rEHHNZE+2h/yzggsSCg2Zb:nvj2yPk0zL/lHhbsrd6z0gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772740886, "uuid": "56926556-7b9f-4f9d-9fbb-89cf9c212697", "value": 180758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772740886, "uuid": "54d65670-fe08-48af-85c3-eb91c544e554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772740886, "uuid": "daaa712d-389e-4edc-8875-d6b4cc1c31f0", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec6a499-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681547, "uuid": "5a2fb74b-b7c1-43bf-9d11-702b7405ac37", "comment": "Malware payload (Mirai)", "value": "9c922ce8144d370a8464c915e28885df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681547, "uuid": "22ef86e4-7747-4a32-9483-3d47015c8502", "comment": "Malware payload (Mirai)", "value": "1fe9ec99227bf9bd0532f0eea55e604697e606ebe2b46963ba0f56138f1b04bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681547, "uuid": "c12eb074-f4dd-4926-b8b1-53bca56eec8d", "comment": "Malware payload (Mirai)", "value": "bc1cb387fc5ef0a733aa3768a26c32455b57e4d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681547, "uuid": "60a0f1f2-7524-4038-ae5c-49e6b4bacf67", "comment": "Malware payload (Mirai)", "value": "1f8651ccaf731be872da5357adcf89fc9bf23b6cd0e01894cec9b7c8d716453f97559d8c33db2b1d088683da04db4975", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681547, "uuid": "47f3ca11-c6bf-4b86-939a-0042fa46bf70", "value": "T11E143A45FC819F27C6D122BBFB6D418C371A27A8D2EE72078C255F21778A85B0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681547, "uuid": "848a6275-52b3-43d4-a665-edc385bd1f5c", "value": "3072:Dx5yZcV57am7ceIE7ViRP7n4ZGWt+H+kVBExwKoKw:l5ykmQceIgsDn4Zh+eyBExwKo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681547, "uuid": "63fd49f0-425d-4e56-bd14-651b31acbcaa", "value": 193376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681547, "uuid": "e80a23d4-195c-4b91-b061-00dfb16e42bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681547, "uuid": "d351a1f1-3e1a-41b2-8efb-9079ea8a5bbe", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1ca212-18d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772743363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772743363, "uuid": "61b5df20-3c1e-405c-93b2-9f58df1860e5", "comment": "Malware payload", "value": "aff6bc7de192f123df77aa2398765cc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772743363, "uuid": "fefb2832-2aa8-4ca5-a671-8348568db931", "comment": "Malware payload", "value": "1ff8e4e91a3685b6536aac92dafc6c05590709f65b7dfae77bc0f9ffb4e4a1e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772743363, "uuid": "26f1bf59-fe64-4428-8d30-dae68d16e7ba", "comment": "Malware payload", "value": "13373efffcffe59e2a794b850972aaafb802786b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772743363, "uuid": "b33f4beb-6efa-4bae-8e46-7655e96e8db7", "comment": "Malware payload", "value": "1d8e6e74a859ae54733772cfc0562bc71149913cda78e52d59ffa7df211f3b0f6656f49cd8bdc505d69580dd94ff6c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772743363, "uuid": "17a45a2a-ad30-4089-bf53-3b62591f817f", "value": "T14466D01AB3A500ECC0A7D5B98A175D17EEB174491335ABEB17E085662F23BF05E3E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772743363, "uuid": "a1463c77-7129-46dc-b5da-f5e32214380b", "value": "2e474faf9e9a1b219f43d816e7300de1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772743363, "uuid": "fb642260-e69d-46f0-baff-a25d4b34ca88", "value": "49152:haax0pejmGTNw09RM6VFD3n7Cy1YBwTjMrYIXP7IyyFT0yRYXwj3lcRpn5Ph+iRP:KpPGTBarYsPmYySmlgo+Kb1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772743363, "uuid": "abba2216-5e73-435a-b827-8df44169b7fa", "value": 6637056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772743363, "uuid": "c3d1d098-e31b-48db-8d9e-42470b563d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772743363, "uuid": "3ade2894-86a9-4ad6-b885-b50358f2b92e", "value": "rename.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e95b05-187e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772706837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706837, "uuid": "feba0935-66a1-462f-b05b-b7b3a1f03955", "comment": "Malware payload (Mirai)", "value": "5539da31dc1b857cfe22cf513c072b54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706837, "uuid": "bf99ec47-aa80-4cd1-82f8-c0053ed22d10", "comment": "Malware payload (Mirai)", "value": "209582fa8a5dda05f9730981daf8beb98e90bcd9fd359061d9f30c644d86eaf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706837, "uuid": "64296520-dc1f-41d5-9d96-2147ed96484a", "comment": "Malware payload (Mirai)", "value": "5b08a306a60fb4fd04853037b88a74caa86d812e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706837, "uuid": "b199a6fe-5e5d-4ff9-b626-6c59e44e8449", "comment": "Malware payload (Mirai)", "value": "4be260c041569b338eae588672cf1787df1343e0ca2ac3d634dafd059d7a6d534a97275cbfe59b463293febe9f601ab6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706837, "uuid": "18c22b46-3f86-403d-86d4-a40509cfe5b4", "value": "T11DC39E32D8396DC4C1945434F8B1EE711FA1A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706837, "uuid": "11fd7b01-e10c-4813-85ae-512cb3e78cef", "value": "1536:iaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKQk0kaXN7Y+UKigHcYSQwKprlzwww:if5Z5Z98XdmVMJa5aX7biySQHrMwEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706837, "uuid": "5b1536b5-59a7-482b-a6bb-45d592411d80", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706837, "uuid": "d61bfbf0-e462-4129-9aae-9938c85962d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706837, "uuid": "659348b5-9b4a-4291-a852-7d1dd93d90c4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bd7ec1-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772695220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695220, "uuid": "3f166232-f95b-4b46-b954-f1f91ee8ee1f", "comment": "Malware payload (Mirai)", "value": "44d5d42916ded24da7277cfd0ad1b133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695220, "uuid": "b85bbf86-527c-4de6-8009-bf0b37c3d5d1", "comment": "Malware payload (Mirai)", "value": "20aaffdb55736fa2907b097ff5949393041aa6d91c580060a1f4f717676bcd92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695220, "uuid": "a5afa3a5-03f3-4e76-a5f9-8d37cf602d76", "comment": "Malware payload (Mirai)", "value": "10905df6b4282b5cb18108471597099c0e1de5ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695220, "uuid": "1a3d15f8-41ea-449e-993e-2be005fc8025", "comment": "Malware payload (Mirai)", "value": "906169c558a6e574e6338b265b032f856ca648138ebff73b400e1189afbd3669bfacf74adfc780c275de21b6cbad5a44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695220, "uuid": "9f0e7a4a-e9ed-46a8-9d05-4c7927d77b28", "value": "T14F9302A7CA029233EBF1B876DEE3439F38267D91D1AF59770270829D04B654650E9D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695220, "uuid": "bb8d4168-3851-4f05-9ffd-1e2d1a370bec", "value": "1536:h3W9nMnpHg/8gjOPpkDW5c49v/gMvmUGN+bNCXLWQYzcIIdAn9KfYnqjuA4:anMnWEG2kDWnRPIqCXLHWgdTQnqz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695220, "uuid": "7484ef8d-dbe0-4bac-8d2a-2642ebae6fed", "value": 90852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695220, "uuid": "e8e3bcca-d82a-463f-87b6-1704cee4eb6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695220, "uuid": "4241c7a9-22b7-4384-ab9c-dc6dd9d9a847", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1cc401-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1772697974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697974, "uuid": "2fe2b60d-8605-42dd-997d-056e9eea8221", "comment": "Malware payload (DarkCloud)", "value": "e2a27093f1b2eee2b53ee6b665774d49", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697974, "uuid": "54ac296e-7556-4784-98e0-4e8a047d0b53", "comment": "Malware payload (DarkCloud)", "value": "20ce6e79e9694d87fc8cf940df80933e88d93b17143e4d0a9eb1a1dd5019ba53", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697974, "uuid": "96379390-bd6b-4051-844d-6e444b74af98", "comment": "Malware payload (DarkCloud)", "value": "4e5f1194d5af0cbc478429f4eb5c10ed0e2a2b52", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697974, "uuid": "fda725a2-94de-40ea-b365-62c9901ad7d7", "comment": "Malware payload (DarkCloud)", "value": "eda558f202fb65e50efc05cb1f8f957f5f42cdd4ecef9f604f395e1d9fa9178456222ecd075abeff406a641197f41715", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697974, "uuid": "7f96cd6d-a066-4a1e-981e-354bf235bf93", "value": "T1EAD5C01A7DD2AD413439F86A153242981792B9C3C35DEFFBCA99E831FB421953E072C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697974, "uuid": "37e0de4f-3d90-4bfe-8cf0-3431de8cf6e6", "value": "24576:UmXQ1s7E1vY4tMEnYdWVFzjwwFMesoAy2fgu5rxi8sj7xN+ng0KFbCeyUwIUTofA:/QO1iWgHby98J7UsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697974, "uuid": "07132e70-7a11-44b7-987c-2b4ea38f9ed1", "value": 2826999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697974, "uuid": "d074bef5-6566-41bb-8d85-a1626ff98b73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697974, "uuid": "aa9b3047-763e-4629-a26d-4ec8dfed39fc", "value": "e2a27093f1b2eee2b53ee6b665774d49.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fdb45d-1881-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707975, "uuid": "14f9754d-99e8-4be3-b9b0-bd78ff4b9d2d", "comment": "Malware payload", "value": "544d52fa420d307ed3bc59c0a383509b", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707975, "uuid": "97d3de9a-fb97-40b3-aab9-c81672155b20", "comment": "Malware payload", "value": "2403c188e7ddffd1250ee4209231fa1266522912741900b399084c4163df5519", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707975, "uuid": "b85af35a-76a9-4f17-88ff-5be4c4b6eec7", "comment": "Malware payload", "value": "13a9698abe09a743452de8e8c01ad3a57c7f1af2", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707975, "uuid": "cef64419-599d-48e7-9adb-c015b432603b", "comment": "Malware payload", "value": "34ef63f847147399ef254366859cae44aaecb9c40360e253f431ea7ccad241d3fd537bc2fed3bcd1520cd5dca7efeb32", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707975, "uuid": "27c98de2-5d38-4b68-a37d-305b6e709fff", "value": "T164310124DCD619D78787CA39E869E5A3237D0423494C2854767C038D2F9C56648B1EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707975, "uuid": "2c9df454-bbc2-4d6f-83e0-51dd8776f94a", "value": "48:XYtTOcXWQemQkVlfx4dqQSTTwneS7X5uH:IpvXfLrsVSw37wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707975, "uuid": "87d760eb-b6c2-4102-9ca3-5acda98a7ade", "value": 1555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707975, "uuid": "ed89eb30-ca37-4c1a-bbd9-1f3dc3580322", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707975, "uuid": "69fa400b-453f-4d50-b41b-abf1726b60cc", "value": "CVE-2026-24423.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b99318a-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772697728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697728, "uuid": "4e325d45-f32e-4fe9-8296-531812ede7cd", "comment": "Malware payload (VIPKeylogger)", "value": "bee605091ac63fc9e33196dd1634ed6e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697728, "uuid": "333d74df-48f7-4f81-9fe5-9de11054bda4", "comment": "Malware payload (VIPKeylogger)", "value": "2564ea3457def103fba2cb6bf2433f9dc1485b5556b40a6268daed08c04b796a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697728, "uuid": "4033aac3-aebf-411d-a94d-c569269788c6", "comment": "Malware payload (VIPKeylogger)", "value": "383587b936096543f54e8b385440f66c10338418", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697728, "uuid": "bfeae627-5cdc-4592-a366-aedfeca95db4", "comment": "Malware payload (VIPKeylogger)", "value": "225a5d28a8dcc7b4fd5f46b4c1a7c4df7bf3aa524d48a737d7930fea93fb42706ad4f13989e554fd9a00d5b05145da22", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697728, "uuid": "803a12ef-a2f5-4489-b137-3af986345062", "value": "T1A1350296938078A514CD220EB7C75E8DCE3D444733C65E9BB81375BAC0EE5C69229C9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697728, "uuid": "bdfe6e67-af59-42c8-af0e-7a2ac7204199", "value": "96:YmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmU:Qc04Dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697728, "uuid": "5ca78a58-ead9-48a1-9c8e-e44c7ce8652f", "value": 1137634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697728, "uuid": "8d6a0c73-f880-4c52-980c-4b60a2423382", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697728, "uuid": "dde14ca9-af3a-4239-9137-a61640277811", "value": "bee605091ac63fc9e33196dd1634ed6e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6b83e4-18c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772737537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737537, "uuid": "881e6296-f897-4bb5-a8a5-5cda06596224", "comment": "Malware payload", "value": "3be964421259ca08b3561c12ebc7b8b9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737537, "uuid": "441ac01f-b5ba-4f59-8efd-e217a68aa188", "comment": "Malware payload", "value": "257d76457e79d08f36b7dc67701ba3dc734f9ec2c71da03212305cb2394ac899", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737537, "uuid": "8170d7b9-6d0c-49b5-88a7-1071c3c32dd9", "comment": "Malware payload", "value": "3093d298a4baca98218693e3ee75b2d79622bc79", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737537, "uuid": "040983c2-692f-4758-83cb-99f33bdb023a", "comment": "Malware payload", "value": "a21f929dd78989656994986f81d69b0f355df11352bc2a0fa78a13b6e34cae46b92cd3b90908689f2b74ab236a5b4f08", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737537, "uuid": "41221862-ec9a-4fe6-9084-e54d1968ac18", "value": "T1E602747CC5D2FCC0876B32C579AAFEC2004F8713AA6A2FACA5C808915F54294DB7D58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737537, "uuid": "1cf49905-f9bc-476c-b3c9-47f4c25ef760", "value": "192:j6zy+E+b9/WD8Q6jOqdxJt6sEhDQ8MMccIgaNrMrfbUqp4jVPSw264DH/:j7+5JO+jNZt6suVccfadUbzYVv4Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772737537, "uuid": "df314cf6-37c2-47b7-b57e-7e8ecd269ba1", "value": 8781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772737537, "uuid": "af321e2b-d648-4799-a921-25e7229cb4b2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737537, "uuid": "159aa5a4-370e-4b69-b91d-706cd788481b", "value": "SOSTENER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee60ed2-187b-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772705491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705491, "uuid": "7225f397-1f86-49c8-8a08-b7c48106b9ec", "comment": "Malware payload (Stealc)", "value": "66e7e03ad26446d55fe62cb5e22bfc9e", "object_relation": "md5", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705491, "uuid": "72b93995-ec63-4515-88a3-51c3563245df", "comment": "Malware payload (Stealc)", "value": "25f61301b51a5fbd19699f4ffd3bada8c5bc4e6a613ce1b68e4fa111f18d6f6f", "object_relation": "sha256", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705491, "uuid": "6e95157d-c6b6-45f3-9f8e-c759fb110252", "comment": "Malware payload (Stealc)", "value": "1273f00ea850c0185989823fed7bb4a897603767", "object_relation": "sha1", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705491, "uuid": "8303dc5b-4425-48f6-8bc1-1bcb3d449afc", "comment": "Malware payload (Stealc)", "value": "76f06e9aa6a796df47795d36e4a62e2bc09330540bd36c834b8fb5462a103afb036a7f58d1be00cb28da9e40c0eabf23", "object_relation": "sha3-384", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705491, "uuid": "610dd027-2496-43a5-b3d4-ed8dd2874070", "value": "T162212C149FEC2F0DE1B246397DBE23A5C4267E8C6F1DC9CD0D11D1094C65952D829F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705491, "uuid": "f0d32591-f8c9-4322-8c9a-f9ff35704fb3", "value": "24:8COlHy+lfyN3UibScX15N+g10XlOCQl5u/JLCIxsRKGs+/s:8COlS+lfi3pBXrN+g1slG5uhLhFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705491, "uuid": "210196f8-0882-48c8-9aa1-fc8dcda81bce", "value": 1183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705491, "uuid": "c2b01a21-878f-4678-895a-9ca0b4beb687", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705491, "uuid": "4a11dd9c-ade6-4af7-8589-30395dcd86fa", "value": "Screenshot 04-03-2026.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e20d8d-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772681148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681148, "uuid": "2fadbda5-f7d1-483a-afb5-e3776a91d23f", "comment": "Malware payload (Joker)", "value": "41ba4cba26ea6a4c15171cf37a14ab06", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681148, "uuid": "fee99eba-f14a-47eb-abdb-189d878c3bdd", "comment": "Malware payload (Joker)", "value": "26ab873aed3c957e5768b3cd2ae7189f81eb7314740a7b777818188b31100305", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681148, "uuid": "264530a0-7b4d-4701-a7a6-9d5b87b541a3", "comment": "Malware payload (Joker)", "value": "798f10cec9f429fc0c58f4493ec3f4082f419446", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681148, "uuid": "bc5c91af-5168-4add-a4dd-1a68a566b44a", "comment": "Malware payload (Joker)", "value": "b092ba8ef8597e83b64d3afa1cd8641ea50d16646d1d32126aa07b4fd0cea6305eabb203fe0ce489e0d7225567f46725", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681148, "uuid": "5fe6eb85-2601-42e9-b832-379358663c56", "value": "T1FB37022DEA0DDE37CBD5B8F8495D221FF316A74A050082D33611A548BD43AD4AEB5FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681148, "uuid": "52584575-eb8b-44b3-b4cf-ce9b85c482bf", "value": "393216:iwXvWuhMVGBAQPGGrd4+hifXhNMcrzc0ZqhJaX5MIO27bqOO8cJ:PuuhMVGBAQPBrd4+hKRNMfNFKqJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681148, "uuid": "20ae8b3c-6dc4-4129-b821-d0ae69bf6009", "value": 24314055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681148, "uuid": "e0b23c66-4de2-4de4-83b5-afbdde60df00", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681148, "uuid": "e56fe617-fe21-41b3-acc0-e25723a0a679", "value": "com.mirror.clearup.markup_1.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0674bc-189e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772720303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720303, "uuid": "524c5391-ee53-42ef-a6a7-3f4993fbedc3", "comment": "Malware payload", "value": "20832ee14fd9da6ed8ea514dbd3f821a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720303, "uuid": "f050d21b-8ef7-4d2b-a75c-1b3388781e53", "comment": "Malware payload", "value": "27d59c4a0a27b8611d860365a4b6a1db8b5dcf9d8ec7737472d83050d342d3b8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720303, "uuid": "0c1d12af-7575-4078-b62b-cb7450c9c2c2", "comment": "Malware payload", "value": "a2d683029572c2726e2f203ca67e1a9cf55a85c8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720303, "uuid": "9a5d4577-5371-4642-9091-e9d8c9d94865", "comment": "Malware payload", "value": "02cff7c917a12606a89d3f532cbef6efa2977af10a6b20d0d740f3396155fad2d605e932f7ea21bc7482e4085e4ae195", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772720303, "uuid": "20fee160-6948-46d8-bf2b-8d26a2b0280a", "value": "T1E982170BEADD39A86E3443344EBFF091B18FA357A5C02956E0231A73557EB86339C587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772720303, "uuid": "16a8a55f-dcea-41bc-b4a4-a80bc6964da1", "value": "384:flS/add2EIo/IDtin92jB8UoDmYQ71h/VaCU7bFR:9ddzehino8DmYKrVaCU77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772720303, "uuid": "9172102c-c583-4102-b17a-75020042729e", "value": 18588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772720303, "uuid": "353405f8-f318-4237-88c8-c523612adbab", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772720303, "uuid": "ebecb75c-6ddd-438f-b120-389786d79526", "value": "SystemUpdate_2347.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ca8ac2-18b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772729144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729144, "uuid": "e8488e69-b77c-46e6-8d89-154129e989bf", "comment": "Malware payload (Mirai)", "value": "970945bab7bec6837c802124753682bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729144, "uuid": "7e34c950-8869-4230-868a-70e68bdbebd4", "comment": "Malware payload (Mirai)", "value": "2858a1647e23874ff6f5949e1941ad1297f58c2d90a4cdda2a94a7104e93c5fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729144, "uuid": "6f7fbd97-3dbe-4236-990e-a99e78cb557e", "comment": "Malware payload (Mirai)", "value": "35ff38316b907b44fdbceeeef0d0dc8343836d76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729144, "uuid": "3fbc3db1-ebf5-4db5-b776-c35a080293c1", "comment": "Malware payload (Mirai)", "value": "b328b6444c9d6862c3adc2e92ef1f89b72c656ad4873b08a1113fb7b10be3d49e54e3d07932b491bc7370e411e1a395d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729144, "uuid": "b4ddc2e7-74c9-41f2-a89e-e42045300a7e", "value": "T1ED53941A2A258FADF76C873487B74E229799379727E1C644D15CEE001F7038E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729144, "uuid": "2182a65d-0b12-4de7-9e43-fdc028218942", "value": "1536:dMBsSfxT6HdeKImzB1M126Bc2ueZqf3J3J9:afWHdeKFB1deZEZZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772729144, "uuid": "a6d3bc30-14eb-4c24-9baf-927ea415886a", "value": 63660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772729144, "uuid": "af13e1b8-6446-4fe8-a922-2733140154a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729144, "uuid": "ee5f559f-17e6-472b-b63a-a37b873bbdaa", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd09363-18a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772723559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723559, "uuid": "390f5129-d46e-4066-b694-1ca79f9db642", "comment": "Malware payload", "value": "879a1d9ba05e991a7154f66cad565e86", "object_relation": "md5", "Tag": [ { "name": "bapesta-akjqdf-xyz", "colour": "#CC15D6", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723559, "uuid": "7e42db21-7bf1-4f15-9530-b58f5ee98b64", "comment": "Malware payload", "value": "28d6e78b0f33f771aa49458a7adf89227e832574a71e214a6933b0116b70ca9f", "object_relation": "sha256", "Tag": [ { "name": "bapesta-akjqdf-xyz", "colour": "#CC15D6", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723559, "uuid": "3c66a3e5-5af0-4abf-b161-6daea1b44d35", "comment": "Malware payload", "value": "f9a6fd6c85ac85a4636c3f3dd05a06a1516e93d1", "object_relation": "sha1", "Tag": [ { "name": "bapesta-akjqdf-xyz", "colour": "#CC15D6", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723559, "uuid": "bdad9bd3-1e34-49c6-85de-97b95204ead7", "comment": "Malware payload", "value": "75469e0a18a26ada8ca992dfb5d46e97bd14336138ebcb26035178e33bd3c693118b6eb37982d50dab700ce704f5fc61", "object_relation": "sha3-384", "Tag": [ { "name": "bapesta-akjqdf-xyz", "colour": "#CC15D6", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723559, "uuid": "78e18e2e-3c6c-46eb-a7cb-654010c62172", "value": "T14A087C42A3EA05D5F9F79A3489E65213D673BC063B3082DF325C172A1F736E08976B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723559, "uuid": "ccc076df-3c03-4e49-bffc-a1c9e364cc57", "value": "8062a445f5cd940b5daefb09f80bc2a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723559, "uuid": "224a5af4-e05d-4811-bdf3-001588fc4845", "value": "393216:f9UZyW0PYsIUmgB9S7QJrojJgVXIXT9fN3aoIKF1H5XMutmnnY4nZFUT7HihCLJ+:fJX3mcLmSh81vxOtxth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772723559, "uuid": "4f35e212-b62f-4d1e-b95f-3a22afa26561", "value": 82160640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772723559, "uuid": "f39caa19-9711-4281-bc67-4cdf479c1f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723559, "uuid": "af83f489-c220-4f9d-aed1-979e38293792", "value": "eLaunch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dbf678-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697885, "uuid": "a564588b-689f-4840-baae-ed78b816aeca", "comment": "Malware payload", "value": "b0bd12de8f18e4b6fa57e98c49cb99da", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697885, "uuid": "929da721-f25c-42a4-8be6-27ff06b476b0", "comment": "Malware payload", "value": "28dd62f491188c6ff3ef1a1bb6238096d5beb2cf1f7d1522b5b40a18be8169b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697885, "uuid": "b5158653-b00e-4d20-92be-19e55f81214c", "comment": "Malware payload", "value": "b8ffddb0531cc4979286a1eb90775b941af09dd2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697885, "uuid": "be7dc715-1889-4454-993f-d0441e967097", "comment": "Malware payload", "value": "6e2e06ae29d7f6d1b84d8a7ae1a6700f66034f0c3132ea88c2f4b690c0e93443a4151f88beb1f33b813671cc9c1c67e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697885, "uuid": "e97f7d4f-71d4-4f92-a28a-9623bc73c3cc", "value": "T1A5C4FEDE2EC1F1AD0F826933F21AF06DF4F598F0935A5C68A1CC6C48F8956D5AD18239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697885, "uuid": "3eff458d-da13-48db-9beb-1224fbebbdec", "value": "6144:8+7Xi5te9JsicfvEedIcrvEQmr9dStZComts6xQH7dkYTPb:86cte9JP6dIcIThdo1Ms6I72Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697885, "uuid": "bac3a477-90c6-45ec-b0f5-87a40779ec93", "value": 560129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697885, "uuid": "2a90ef18-e664-483a-ad12-ff2ab6d9fd6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697885, "uuid": "c1a0e787-a532-429f-91e4-80cd306fdea2", "value": "b0bd12de8f18e4b6fa57e98c49cb99da.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48aa0c0d-1881-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707897, "uuid": "e20aaa74-fd8a-4faf-ba9e-aa69cb933ec6", "comment": "Malware payload", "value": "f13c9ad32e93277fc1d7d31777024eed", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707897, "uuid": "1a43bb51-99d8-4295-b193-521b209417b3", "comment": "Malware payload", "value": "28f0f308e028c438ef85969b4201e7ce9dad08f8086f38b75e0d7c448b977d22", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707897, "uuid": "95ae111f-4370-49c0-9fbd-b747cf48234c", "comment": "Malware payload", "value": "53732e0686074579baef4fdf0835fd3d7ffdeefd", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707897, "uuid": "05a76c9a-1e0b-4814-84ee-eee778fc2e2d", "comment": "Malware payload", "value": "e2db7b1a6d8133ee7fa0e370f590d7e0019c603e05babd9d7f8bb3a92663b725acce64387723d107c9f7d6bda35dcbc5", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707897, "uuid": "aaf03851-b301-45ff-a5cb-26727b40b4b2", "value": "T199D3A3913E13A08ED03B9F4F29F17C59E91E790B6AD0495F319FC69B5FB600A9C90878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707897, "uuid": "ff0ba841-0da7-4497-b49b-461b5454905a", "value": "1536:N2WJmKJ2XFW8/fpPtwYiYmVr/clNn3VhB2:NHmH4rUJT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707897, "uuid": "bf1ce9f5-19d4-419d-a791-0b20bddd6fab", "value": 137639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707897, "uuid": "e0638984-2332-44ae-860e-02f0d3bbcbad", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707897, "uuid": "72e4ae1b-69ad-4025-959e-0650858705c4", "value": "9242_exploit.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69aa031e-187b-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772705375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705375, "uuid": "e97748d3-a6a4-4209-9dac-af10d635d98a", "comment": "Malware payload (ACRStealer)", "value": "b855df8b71cd81605bd45e4058cc9b64", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705375, "uuid": "92ce0718-f843-400b-9e6c-e5e509b62d54", "comment": "Malware payload (ACRStealer)", "value": "2905c9c894e3fd2717b3a6a38a32e71682dfa548ece3172903de4fd29a9dc87e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705375, "uuid": "9ead1050-c691-4b5f-ab17-f0bec692a7d4", "comment": "Malware payload (ACRStealer)", "value": "cac2af505148ef38e6ef4f983f5788a118fbba00", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705375, "uuid": "1da334ca-ae60-4de4-9fd1-9bd859d18276", "comment": "Malware payload (ACRStealer)", "value": "aea8e19466b0ca24c794ae764a7507154b27a688614d592bdf50f7a96b097bcd8a905e62ea7abb15b6557335d60f610d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705375, "uuid": "01731a40-a9c3-4213-a695-d7b8e9930deb", "value": "T198463394EBC85A36E4A2013898CA46FC1A712CB843F5C42BB5AF79F0DEF2F6E1055750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705375, "uuid": "8d6121bc-3048-4dee-9bc4-91f6513d0989", "value": "98304:0h7gdMRmOUzm4pDJuOZV15R/DlbkTw1zV7Vpz3BnRjzgoeB1HJWN15NN:0WMRmD3ptdZRblbkTy7j3BRjzgxBpJEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705375, "uuid": "f05d29b9-e441-43b7-93e4-6e6d2ab8d526", "value": 5705728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705375, "uuid": "c820cf39-a936-4efb-8644-9da062410ada", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705375, "uuid": "b9d17993-b841-4f29-8c62-74e80ddc70fe", "value": "GVJXQUQR.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adad4287-18b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772728682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772728682, "uuid": "2228c01f-e290-47ee-b0ff-bc9b3eb5b5da", "comment": "Malware payload (Vidar)", "value": "eada7a30cff1db6cecae2d17f3f33d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772728682, "uuid": "a58da104-9ea6-4c5f-a5ce-9ab922ac9509", "comment": "Malware payload (Vidar)", "value": "292a3e6b59484054f7634e9cf8c92de17b95fbca34d3681c75b09e2dc3cffb32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772728682, "uuid": "8890e5a2-5846-4af4-80a5-b47776546c2b", "comment": "Malware payload (Vidar)", "value": "e109dc9dc55106e8d119d1f5c14e16c23d33d28c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772728682, "uuid": "91d112b8-c40b-4907-acfc-d1c945922eb3", "comment": "Malware payload (Vidar)", "value": "003c2cdb4f152a4e7bc4bf620cb7c1720a12f07d973dd183d428be39d842b8076d63ddb9d1760a47468e65096845a540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772728682, "uuid": "b0535037-9e3b-47bf-bba5-1df653f932e3", "value": "T1B8E6176B66618569C23DC13BC0A78F05E5F371B90F33C6E786A103682ED69D44EFE624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772728682, "uuid": "09135d61-0d97-4ebf-a95a-46b7275919b8", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772728682, "uuid": "648dcf9b-5da6-498d-8991-c060834d7b62", "value": "49152:YtD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUw:lxGLEUp9VDFt7dOTAsqdsif+KdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772728682, "uuid": "a62b7f16-b899-4169-befe-97b3caac41e7", "value": 13950464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772728682, "uuid": "7842fac5-572b-41f1-812f-b423d6de7f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772728682, "uuid": "516e65e7-8c2f-4dc8-a38f-ffe3197f714c", "value": "SecuriteInfo.com.Win64.Evo-gen.36642349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b26809-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697790, "uuid": "4d17caea-08aa-4baf-8352-89a6b7c9998e", "comment": "Malware payload (PhantomStealer)", "value": "c318fa2df5ed47c3a5223d3c431e2312", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697790, "uuid": "fdd304c7-84a6-4571-aeee-f56ff24cfd05", "comment": "Malware payload (PhantomStealer)", "value": "297846d8c38f1eebcf80c6d93f9fa9553b6dedfd8d1b1390ea8cab6ddf3acd65", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697790, "uuid": "f61da85c-9187-4047-867b-a3e4de10a76e", "comment": "Malware payload (PhantomStealer)", "value": "da7f62ca58a39a9a7c6fbccb655041cbfa2be318", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697790, "uuid": "cdb5ffa1-e454-4f62-9a21-69438b48d6be", "comment": "Malware payload (PhantomStealer)", "value": "6d1dc73d924d02c712262a2d324faeaf6ecdc6640272e2db4bd214da2240ce339324535fa7bdd38d299a08e160b1bc81", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697790, "uuid": "4632f3dd-4e33-4716-9a4e-5bda0ca7c665", "value": "T12AB210C93BD3B4A153B3742B6D1BA06BA5BA1C88B44C9054C3E5F091F978348D9B6B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697790, "uuid": "5229f0b2-4d34-4b78-bc55-b7002f09bb89", "value": "384:xyp1oZ6O/v6qHqe882r7LECBWbJMV310upADayh9971SxdmYNim0:xypbOpHqNr7LEQ5pagmYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697790, "uuid": "4acfd0ec-6c12-449c-88af-a1dbe749ce4e", "value": 24207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697790, "uuid": "5369da8f-fc2b-4ff3-8bba-2535491dc500", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697790, "uuid": "9c77954d-727f-4bfd-90e3-4a20571c5e25", "value": "c318fa2df5ed47c3a5223d3c431e2312.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d039d16-1892-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772715125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715125, "uuid": "e3591018-f443-43d0-959c-ad93fca6da7b", "comment": "Malware payload (LummaStealer)", "value": "41e0115b13f48d945961f89231f55bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715125, "uuid": "31a65628-dd26-4c2e-8130-232f8b0a1f76", "comment": "Malware payload (LummaStealer)", "value": "29cd8ff24d7a6230d129fdb0167bd3cd1376fe7579cac0454d069a7360960a3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715125, "uuid": "dd354390-aed3-470d-8949-7758b2d93053", "comment": "Malware payload (LummaStealer)", "value": "89548f4e0c1a79b59e5c4e5aae8f89fc51ec3275", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715125, "uuid": "7a1cd1eb-e108-4dd5-94cc-d4554e3bb50b", "comment": "Malware payload (LummaStealer)", "value": "87fb8c62aaec828e425a8e63d25c1ea523e46f420e8ceac981e3c119d97b4eaf59fa450c85beb7c132f0c9ed68dec688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715125, "uuid": "d2e1ec9d-7b32-437e-a758-6fe230270505", "value": "T108A52311B1DAB4E2E5F64BB6A09305935F3578636BF611FF1698C23E88231C09D3AB17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715125, "uuid": "a99953f9-224e-4fcf-891e-0a1926c9f5ab", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715125, "uuid": "b2d73eef-db03-4871-8c47-4a9059abde9e", "value": "24576:C9DSLcyiHVgQBRI63pV1MgANNnFMw+PH8A5pvAzjgK5chcFw+y2Z6UP6IK367VIH:sSLRQBRB3GPHP+HH5b42+DEIJG4GDys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772715125, "uuid": "bedac991-45c8-45dd-82c0-4ec9af342db9", "value": 2205696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772715125, "uuid": "c7be3caf-5483-443f-aafb-9ef93580d27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715125, "uuid": "a4f782d1-aaca-41b7-a7fc-586c3e143637", "value": "29cd8ff24d7a6230d129fdb0167bd3cd1376fe7579cac0454d069a7360960a3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3563e48c-1892-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772715166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715166, "uuid": "f3768d4c-b6df-4756-9ee8-06dfee26031b", "comment": "Malware payload (LummaStealer)", "value": "39ce634a11142fe9fedd5b9efb18580c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715166, "uuid": "69760fb0-2d4b-4395-b3e2-dd06cd17047b", "comment": "Malware payload (LummaStealer)", "value": "2a270526c683d00acfd007a4ddb502168e4ad4e541767e528abbd23be5ccc6f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715166, "uuid": "c9707c0d-9a3c-4b23-aa24-da47aab50d57", "comment": "Malware payload (LummaStealer)", "value": "9b026a12e58c3b01b5b4e52fa42b9a4c88bfaa99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715166, "uuid": "d6383390-df85-4c1a-9da1-9ba019812013", "comment": "Malware payload (LummaStealer)", "value": "30347a8441083f646523588c51588795a0966ddcf69ac4b066b93ae0056c863636bfa26cc90499bfe9d8d760b61f411b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715166, "uuid": "1c1f0e99-669f-42c9-b66d-f645848102be", "value": "T106B502E1D5902471CCB33379DFF2E835D1AA5FF5EEA6AB0790803560ABB30DB1924946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715166, "uuid": "a6d0182c-1a73-4560-a72b-672c21c95771", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715166, "uuid": "3199fc1d-2979-412d-a0f8-302b8fc13398", "value": "24576:QKKoKZKoKst3HDay7VmlG5zpyt0jc1oySi3rdfHnC99f092C5cSdv7o6gtYB+DWj:PKoWKoTayECp9PCrB5Bo6YmV560rO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772715166, "uuid": "d9fcfa08-e2f9-4816-908c-8c0dc546b135", "value": 2307584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772715166, "uuid": "c40478f5-0af5-4e87-a158-37b05601d8fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715166, "uuid": "6cfea0c7-023b-40de-91a3-57c16eb5239b", "value": "2a270526c683d00acfd007a4ddb502168e4ad4e541767e528abbd23be5ccc6f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc1b9af-1892-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772715391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715391, "uuid": "da9dd398-b0f8-4fcf-93f1-800008cfb952", "comment": "Malware payload (AsyncRAT)", "value": "1029c7437f039674652ecc35c1b2bd53", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715391, "uuid": "e65bcf56-4d67-4ebf-8881-9f02ec894c41", "comment": "Malware payload (AsyncRAT)", "value": "2a66f8741911e54fc74d4b9b8fb67916923831a4f2cab7b2fc7612278589c5a1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715391, "uuid": "8aac4f74-3de5-49c2-820c-c7061baf82a5", "comment": "Malware payload (AsyncRAT)", "value": "aff237552f44db0c4e2f52561b23480f4cf5cba3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715391, "uuid": "a99fb237-4278-4116-b25e-00ddb01d59f9", "comment": "Malware payload (AsyncRAT)", "value": "7870ff059b4c2b934f15003ed2cf009baef96dfa252d3a40498332721e52d4789a3f62f24506049300f355f27df9f8b4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715391, "uuid": "ab40a3e8-4bc2-4817-972b-43a50ca09845", "value": "T1A7F2390573E59665E1FD0BBD5C3686044372EA474D62DBAE2EC450AE2A237C8CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715391, "uuid": "4a0c0c29-7f48-408c-9799-c1ef2f2ae363", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715391, "uuid": "85e94b65-abe1-499a-999e-aafeb2e4d35f", "value": "384:kMTJSg21zFoFySh0lE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCUtWW0EQ+:kiJSXpFoFjhj1hV4RbJwB+WWXPQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772715391, "uuid": "88db6549-2dae-4503-a37d-b27d41d40724", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772715391, "uuid": "226e522c-91bf-4666-85e9-6292415975ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715391, "uuid": "6803d215-1700-4fff-a1bc-22220a3ca5c2", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4563a8b-187e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772706843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706843, "uuid": "875e65ef-a6d6-454e-8034-c70ef8f02870", "comment": "Malware payload (Mirai)", "value": "8b575ea80fae18851575b58c8b3b9f82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706843, "uuid": "5b449d4a-1c61-4c1d-b157-d431a6483a5e", "comment": "Malware payload (Mirai)", "value": "2b690b73ec009ca7d0b677e8a15187ad5cce099e147622580c0384291d5283ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706843, "uuid": "703d874d-86ad-4bf6-a1a3-bffdf62b53c4", "comment": "Malware payload (Mirai)", "value": "5a83b5c4c3bf542e81a9feeb144479cc26506f09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706843, "uuid": "9bb384f9-0bce-4850-addf-f0b69eb834cf", "comment": "Malware payload (Mirai)", "value": "48b693510618850073ebc82d298403345fe7502b8de2827fbccce3d1a33dbade62af5b19c31c2586e7b7eab0860c9390", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706843, "uuid": "88a990b4-5b90-4c0d-b6cb-421590ad7593", "value": "T1E4F3C50E6E198F7CF79987344BB79E32925833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706843, "uuid": "303da4d6-13ff-4eab-835d-b54c57ee1372", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiws:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706843, "uuid": "33d87735-57b4-4fdc-a95c-8aae94239ba7", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706843, "uuid": "bc1e1fbb-cf30-4a6b-aa68-6d664fed2099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706843, "uuid": "02794f31-0f25-4223-a749-91c9eda3ba9f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f29151-18e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772749876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772749876, "uuid": "286eb708-c74d-4cd4-b4f3-ce1e666634fe", "comment": "Malware payload (Vidar)", "value": "4091a5a968ed00196f8e0b9a9f89f561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772749876, "uuid": "f8855b5f-19b5-4f77-8965-e1f59cdb00e6", "comment": "Malware payload (Vidar)", "value": "2bc0bc58a57391fdc74610daf320f42c78cea527edc1d26e80c730c9abe6bba0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772749876, "uuid": "cb725bb3-ebe1-4d0b-a5a6-62614062cf2a", "comment": "Malware payload (Vidar)", "value": "d54dfa4cda19736719957c1657884f36cdadaf2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772749876, "uuid": "58784fca-5ee6-4f31-bcc7-cb8ec702a2cd", "comment": "Malware payload (Vidar)", "value": "4c8fda6152a108344d5cdcdcaded666b5fac3f2a558478a5484a1a20a16ef0f864f1544c54989fbd20cf9520bed50a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772749876, "uuid": "5c8b5a52-f38e-4d2d-8249-ace38054455d", "value": "T10CE6076B765186E8CE1F813BC0B28B0DA4F370B90732CAF78791136C1E569D44E7E6A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772749876, "uuid": "5c7a97a4-e2df-45fc-b02e-66636cd39925", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772749876, "uuid": "052c2398-03ee-4a14-bb37-786cfae46d4f", "value": "49152:jtD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDU8:oxGLEUp9VDFtCdOTAn4JUbM9dQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772749876, "uuid": "941c413f-c786-4a35-baf1-cd3676db8d9c", "value": 14409216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772749876, "uuid": "f439a4da-0857-4456-abc4-a79dbd3c5520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772749876, "uuid": "6d22a46b-5e01-43be-9d07-5d63e60fa64f", "value": "SecuriteInfo.com.Win64.Evo-gen.95661446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23caa0fc-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726733, "uuid": "34ffe58b-c409-4fff-94b6-db8fdf99d5d0", "comment": "Malware payload (Mirai)", "value": "969203628d48a30de45f5692e5067e10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726733, "uuid": "97e17b23-5566-4056-9a38-03f984d0d272", "comment": "Malware payload (Mirai)", "value": "2e7cf866d7559032af891b14164bf8431b139311a929242d179be0aee94790fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726733, "uuid": "389d23b1-0129-40d3-a8f1-434ece96c8f7", "comment": "Malware payload (Mirai)", "value": "74eb55ae7573a43f2603f2af6b1adf89e1ce31bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726733, "uuid": "63975c1a-7319-478b-b7e4-9c69e5689887", "comment": "Malware payload (Mirai)", "value": "09334c321e7445a7d754bbbc617ab70ddd07306aa95d48271233318148527a67fdeae54f9b5db7c685092ed44cb9168e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726733, "uuid": "282bf605-d098-4a09-a9fa-6471bdc371af", "value": "T172834BC8A5C3F8F0ED10093C307BEB715A77E13B6138EA97E7D67623A945242D21629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726733, "uuid": "80ee848e-530d-4295-8d97-efceaaf568cc", "value": "1536:IPi5hLx141jsiV8abcdOBNCBVBLTQ/YpGlBOve5B8rc18HBVcW/NGu581jtoZri4:/hLx141jb8aCIsBV5k/YpGlBOvi6cCH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726733, "uuid": "c2327425-78ac-493c-a731-09d92c86eb93", "value": 82704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726733, "uuid": "dd23557a-c7ce-4a72-b8d1-c28cf36eb025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726733, "uuid": "c80b0153-0143-475c-98ef-598744bc0b8f", "value": "MMaaRRiiOisecTanee.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26172257-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772697960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697960, "uuid": "e02b8858-5936-48bc-ad12-5cc247d25df2", "comment": "Malware payload (VIPKeylogger)", "value": "b40e5820caf2bf344501239da0cda1a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697960, "uuid": "dbc50c0d-9f9d-4474-bafc-c8dde9678a37", "comment": "Malware payload (VIPKeylogger)", "value": "2f6afb25de01f5302be5c12c5f4837f01c55b3219fdfe78b1acac23ac68a7852", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697960, "uuid": "8010b83a-95ba-4cad-8e24-f90b40971cc3", "comment": "Malware payload (VIPKeylogger)", "value": "358402bb2fe1b2a136d488a30e9e1d3f2592ba04", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697960, "uuid": "af2243df-f77e-42f3-9421-914dadc8a570", "comment": "Malware payload (VIPKeylogger)", "value": "d29a393bb9d1fb7084a8129b1fa0375947bff0cf8a6a7129964d42681def462d97ce9385efcadcf2d1b4c1c44169150a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697960, "uuid": "67431bb6-a7dc-41b7-a2ac-2712349bf242", "value": "T12D621B645E8BD8F44A1436215CDF0F66CCE44B10C519D0697A9FE3E87304A98EAB4BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697960, "uuid": "1c3ee150-3a67-4f50-b400-3ac8fff268f4", "value": "384:uSsgYWVXorZpd1BNP1a4yxEm9sduVDz2v4faC7oL5GIMGuD2BrKX:uSswmxtnV4f3dloKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697960, "uuid": "8d75ac82-8b8b-4e1e-8dc0-438cf4cb57cc", "value": 14833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697960, "uuid": "ba7f8343-f16f-452b-852b-466c49d8a7de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697960, "uuid": "3a0890d5-1cf0-4eca-a28f-cbc35de64618", "value": "b40e5820caf2bf344501239da0cda1a7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec5a08e-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772697814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697814, "uuid": "675931e0-c24d-4338-bb47-44e7fa237047", "comment": "Malware payload (Formbook)", "value": "69f5a1257a0145b74a568b29ca198bb6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697814, "uuid": "99a5d075-585a-4a87-a051-11b0f464c206", "comment": "Malware payload (Formbook)", "value": "305acf72d7bb7a8f1d4de996138938355523840811359801ccbf5e2fbc971572", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697814, "uuid": "8bb67a79-39d1-433f-b68a-ea9cd7f16e90", "comment": "Malware payload (Formbook)", "value": "a3241fbb8d1252ae1911ef08583500e7bac46d51", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697814, "uuid": "e25a7976-5aa4-412a-9bf3-eb7a575685f1", "comment": "Malware payload (Formbook)", "value": "b722c4458713c2da05844937a2054dabe580584df98df1a4772ce4da86028191792a0cef87547f33b61404cb191c3dba", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697814, "uuid": "db8855e2-565d-4fe9-9c06-cf4c68463b5b", "value": "T13AE2F2D331EB0F396706A60B74F672CA8C694B618DA3BB81C57C5B8DCF16744A1226D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697814, "uuid": "31a5aebd-ea13-427d-bf98-d5bb968a58e8", "value": "384:SNwi4yIfHUqRLviPWF/9sW8JArUzmHQ7g:lbLXFAzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697814, "uuid": "29ffeb50-ee31-4400-9bd1-23de85e5ae6b", "value": 34039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697814, "uuid": "12f2b8f7-622d-4bca-8d51-e71a47bcec6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697814, "uuid": "4a471d04-a3a6-42fa-ae8f-e849349ddef6", "value": "69f5a1257a0145b74a568b29ca198bb6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7482b19-1896-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772717209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717209, "uuid": "6fb2658f-060d-4591-86be-4c916274bba0", "comment": "Malware payload (Mirai)", "value": "ad2777360d18543b83cb00a51b9f9559", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717209, "uuid": "0344389e-c3b5-41ee-85b7-2bdc750b6f45", "comment": "Malware payload (Mirai)", "value": "30a42bed3dfab5e74e30157fbc969a4f1c68f5ee9c51ae25d34d521ffdd43139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717209, "uuid": "207c45dc-67cb-43a2-9818-8bd38b6901d8", "comment": "Malware payload (Mirai)", "value": "bdaf56baba3236f9124f5c1605edf8cf0929b372", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717209, "uuid": "155f80b7-5e0d-4dbf-ad4b-923f151a4b4f", "comment": "Malware payload (Mirai)", "value": "3517137b5725ad98826eba3168b1a49726ef371cebc35197ed6831f2b2821c61adf806f71a529fa6dd86e200c7e48eb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717209, "uuid": "9c4042f1-775d-462f-b0ae-91a63d0efc13", "value": "T1ECD34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717209, "uuid": "befb031b-4879-40bc-aa5c-f0a003173595", "value": "3072:lCldeCsOs9kzj2vV4XcZgqniE230IO1BlsT3jTA:APeCK9kzivVYQitymTTTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772717209, "uuid": "25e5b3cc-d1e2-4b54-a1df-2eb4a09d0315", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772717209, "uuid": "d935b91a-0134-4f49-91b9-151c497dbf07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717209, "uuid": "86e10579-e849-46e6-9147-544eae2e578f", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d49f95-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772697720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697720, "uuid": "1ee894b9-a2b4-4f54-af0c-2e1371d981b6", "comment": "Malware payload (MassLogger)", "value": "b174555f4629f8bc4b0696994e809161", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697720, "uuid": "191920c3-a8f6-46dc-ab93-d26addfc60c8", "comment": "Malware payload (MassLogger)", "value": "3222961025f0c9355c305e68cfd5288e92187162863dd885038302170485ccf6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697720, "uuid": "7b1db757-a439-4df0-8788-740a595e2016", "comment": "Malware payload (MassLogger)", "value": "c157d9e64f3a3d79103bbe13b4679a6654ace09e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697720, "uuid": "de3bd0b6-ec6e-4f08-ab39-178b5d54d332", "comment": "Malware payload (MassLogger)", "value": "60f2493a0c0f86a88adb5d67dcf4776138bfef9fbc548f78ccd6c2ed1b27dd33ef46ce91777d65adfeb68ec6e1818702", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697720, "uuid": "175e09f3-5050-41ae-890d-a4f41b6541e8", "value": "T1C1656D03FFF81B408A685B0EE3DD820711E28751815DB7BA665569807CFBBC4EBD928D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697720, "uuid": "e17ac287-fca7-4904-921e-ac1791b0e015", "value": "24576:eAwd30vtkruMq1t6iwr79jEF9dHhknBu+IA5Yn/OqLN6NkZr4RlrKq3GQr+2tttb:ZM/0+TEtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697720, "uuid": "43130d1e-1a59-4209-8619-5f91a63e3da3", "value": 1537146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697720, "uuid": "f9f282d6-7543-4e39-8fc1-255230da0000", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697720, "uuid": "16ffbf45-e8e3-4d03-89c9-f46db3c9d71a", "value": "b174555f4629f8bc4b0696994e809161.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711374df-1897-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772717414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717414, "uuid": "2ab63cd7-cc5d-4aba-9c8a-10d6c14413a3", "comment": "Malware payload (RemcosRAT)", "value": "f5068a3e73a0403a195e399acc912759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717414, "uuid": "5c5da5b8-8bda-4aa3-bcf0-957354ed5b3f", "comment": "Malware payload (RemcosRAT)", "value": "330ea0ac29c5a7a686d2aed75bad4c7e53d1b29e7954653cadc887e448026173", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717414, "uuid": "0989dc46-7f97-459c-be26-3ed48a425303", "comment": "Malware payload (RemcosRAT)", "value": "fc7082d5c28653e781a05a9dd0fddcf341a3d297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717414, "uuid": "ad3885e4-c27e-43e9-b986-0cf88ac749ac", "comment": "Malware payload (RemcosRAT)", "value": "1fadd6f98dfb765b741e13ff7c1a353921f5b3a77c60630959e07003b6f18da9ad4cda9b428795c0ec56cbb44749950d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717414, "uuid": "b2f8f4d9-a029-4dbd-9896-53ca6d61090c", "value": "T10B65CF0273C1D062FFAB96334F56F6115BBC69260123E62F13981DBAB9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717414, "uuid": "9393f596-40cf-4465-abba-69c1fab66b03", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717414, "uuid": "aff936ec-b3ff-485b-a5ec-dec7fea6f853", "value": "24576:F5EmXFtKaL4/oFe5T9yyXYfP1ijXdabV5VVayYk4NeVvIwZj7nHos:FPVt/LZeJbInQRabVL05kY0nH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772717414, "uuid": "fac8b02d-959e-4ceb-b723-f13102025d40", "value": 1435648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772717414, "uuid": "58ea9ece-ba13-4f36-a909-78ea91146c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717414, "uuid": "5db6dc99-9567-4249-b0af-65b4832b0fb1", "value": "z78Factura0987654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3e850e-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697887, "uuid": "4b27aba2-4a63-4305-a191-99527a78ba22", "comment": "Malware payload", "value": "8dd720b52ba1b5dd22aa5157aa2a7996", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697887, "uuid": "55c35a1c-dd42-4e73-ac4c-034c087a0930", "comment": "Malware payload", "value": "33713a3650a3c1d64045c3832835dcacef92ad4f09c030fbe674454266880fea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697887, "uuid": "29f35df7-0b66-4bfd-9447-84a5b9344b06", "comment": "Malware payload", "value": "88933884ca47e505536f06d0fd9579c20b9cbf60", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697887, "uuid": "226491d6-736a-4e5a-b775-bc31086b2283", "comment": "Malware payload", "value": "ace40da99c2e81207816d9230501ebe803b3df4d316df43739c0bd14edd00946389f89ad7b9332f4a34b046be067c28c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697887, "uuid": "23b07b32-7dd9-483f-ad40-cbc40c9b8b01", "value": "T1B5C4CBD82EC1F59D0F82A933F21AF06DF4F488F0536A4C2AB4DC6C48E8A16D5ED55639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697887, "uuid": "64c65940-dbd9-4100-8353-7a7d5fa8ab55", "value": "6144:cXwjLFEBDa5Nk+NxwHRDL+dBSqcjaDi7n9i6:cgHFEDCr7664lKij9i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697887, "uuid": "e9abd23b-23eb-4d9e-b491-9d5d744afed5", "value": 560604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697887, "uuid": "c0b76e65-ad1f-4525-9f01-33968f50b5da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697887, "uuid": "d58a095b-72d7-4d11-91fb-23ac403af945", "value": "8dd720b52ba1b5dd22aa5157aa2a7996.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c58876-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772707359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707359, "uuid": "f9bfef5b-e649-4a82-8f07-8b8551f0fb91", "comment": "Malware payload (SantaStealer)", "value": "d1de255f65b7f9703454d979b3fb2ece", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707359, "uuid": "13c6cf0e-9111-41f3-8be3-e12e9fd68968", "comment": "Malware payload (SantaStealer)", "value": "34c66ad384152bf37b7a878c5d5a75337212227b9adb9e9d76e792438ecbfb08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707359, "uuid": "18f7c9e2-4d1e-4f21-b3f0-a4f00df1eba8", "comment": "Malware payload (SantaStealer)", "value": "180262aea23bffb7addb48f339aad1ee2b89a0ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707359, "uuid": "91729a96-9edb-4c29-92d4-20185803aa8d", "comment": "Malware payload (SantaStealer)", "value": "33935b4fd6f0d2b21f60215c504cb8847a0c8623bc53cc6b900b7d260904189b7a961ab6079219d900d2d5541b681ca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707359, "uuid": "70b9adef-7380-4a03-8bd1-2630a25c5bcf", "value": "T1ADA702D776A36A7CD01EC07E8347B87EBA67F87D0123A9F64164A6322F5AE103704719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707359, "uuid": "3f3c12db-42e5-4a61-994e-8c4602e18d7e", "value": "c49b4a54626f07bbebcf76bd519a86b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707359, "uuid": "a6e69e27-825f-4931-9c22-9acb21d5cd86", "value": "98304:bk5AY0pfc9jzUhZdX1+/6jzcmE2LeB+UrmuXQTs+vHAzc/:bpg0hZp1MaAme+UrmuXYow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707359, "uuid": "e93e429e-ae51-4b7f-8d49-a47cf000eaf5", "value": 46316544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707359, "uuid": "b3bfd993-b48a-4891-bd43-fc37d1038213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707359, "uuid": "6ceabc87-646d-4160-9329-988ebf49ef79", "value": "active_desktop_render_x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e220c3db-18ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772739508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772739508, "uuid": "1cdf6ec9-679a-47b0-a0fe-04dc0d09bdbc", "comment": "Malware payload (Vidar)", "value": "0db9a2730a51ab561fa2ab2d05f9ab01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772739508, "uuid": "c753f37d-e228-42ab-b1c4-9d8d242f22fc", "comment": "Malware payload (Vidar)", "value": "35e696f5f6272ba4b763e0c37e55265ed39f605d1987065de9e4b275bdeee3dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772739508, "uuid": "b2089759-b708-42bf-886e-4da8b473e6fd", "comment": "Malware payload (Vidar)", "value": "e20ff6e93ecf1b71e29357e125aa19cdcd650373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772739508, "uuid": "e3dd7afb-2854-4195-ab89-022589129434", "comment": "Malware payload (Vidar)", "value": "c5babdae5ce87a548f947063238a9476271edb00f78fac2417cc7990a4de64686ac67910225d86fc392261a7c549b461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772739508, "uuid": "2de0e813-813a-4906-a8e2-3edd7623caf6", "value": "T15CE6086B66514669CF1D813AC0A28B4DA7F370B93732C6E782B007681E5F7D74E7E620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772739508, "uuid": "513d86a3-3b5c-4f37-a94b-36b3332dfcab", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772739508, "uuid": "d10bc8a9-ab67-422e-9644-8a270d872de3", "value": "49152:BtD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUA:qxGLEUp9VDFtydOTALSkAhXdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772739508, "uuid": "598ef878-7535-4173-bf34-49a386fb049e", "value": 14032384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772739508, "uuid": "0a5ea7eb-a65f-4745-a76b-c59267c8f836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772739508, "uuid": "78ad07d2-b4df-4221-9aab-e874809bb556", "value": "SecuriteInfo.com.Win64.Evo-gen.11613783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863f499c-1885-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772709718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772709718, "uuid": "6e31d355-9c41-49fa-ac41-53d714022d5b", "comment": "Malware payload", "value": "d3832131654ce9edf8583af357d1ee41", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772709718, "uuid": "67f78eec-d7b8-4a61-8ff2-a94f428537c0", "comment": "Malware payload", "value": "36b19ddbdcb11234978f6fde82f501108d42fc60d963a54194ef8c0bba235a77", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772709718, "uuid": "ffdacd09-3571-453b-85c5-af8bab06b550", "comment": "Malware payload", "value": "0b6fab59c4c3c28a9919c8a421ea794fcc03e809", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772709718, "uuid": "150866d2-8b5c-4115-8e76-432fa1f9aa99", "comment": "Malware payload", "value": "1575c0f691d4e9a4bcf42a8b42bccbedc43e3af0acd18c09e9838277d8da8031cffb309d42414e16dd2d9606d976e07d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772709718, "uuid": "d9838bb0-47fc-49f2-81c4-f572789899f9", "value": "T12E14F8493E8FF25A01B76377D6870804FEE9553A01AE18E5B1EC44E036B2E95F670CA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772709718, "uuid": "edb82ded-43b0-46fd-9db9-2713ea5a7bf7", "value": "1536:kH5FR2QcsLG9TwpCylMpz0HvdbobEkIIaWelrREtapER7HOonUTds0QL:kFkD6ubEkIjWehpAOongML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772709718, "uuid": "4418f5ed-65a9-471d-bf81-dda0b08b445b", "value": 194646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772709718, "uuid": "1b3ca3a1-d876-4215-8c81-c214e1736a31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772709718, "uuid": "4eed3cef-acad-4a38-8f3d-f071420cb02f", "value": "facetiously.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186e9451-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697508, "uuid": "296b520a-8b45-4bcf-a4c8-c8212f25140e", "comment": "Malware payload", "value": "c7abd6896a016cfca26b721d57f68e72", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697508, "uuid": "95bb2954-4bcb-4e43-909a-c9c016b06b1f", "comment": "Malware payload", "value": "36d966d5113a83a306efc06e0808e7ed1f091e4a64d05f42fe18226f77d5773b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697508, "uuid": "56f7684d-421d-4bb6-a584-3a18f2a4355b", "comment": "Malware payload", "value": "3ea05e652cd2bb7c11918c8ac44c84d750192082", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697508, "uuid": "2af0ed56-7d04-4e0e-b7e0-ba5fd400d33b", "comment": "Malware payload", "value": "f18db2d9d771a129065419191b35cb9b85bfc5afe84873db8021006642d849f4fd07cf24e4535df5340dd68a5e3ca685", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697508, "uuid": "cb8742ea-1655-452e-a036-430ade97d1f4", "value": "T129418567E10B2EF39A1143A2D1025E8DDFFE002921B118E4B908C41E523C97E9FB45E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697508, "uuid": "bcc779b4-e194-4ab9-9fcb-49170f4cb299", "value": "48:2LCpcS1CrPAawhpyuBWohRujYlM0H+zoSv8AMtAjcPXl1:MC2SsAawh7R2WHufv8AMtAjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697508, "uuid": "a1c0c539-cc71-471d-b088-3cd4fdbfefd6", "value": 2274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697508, "uuid": "500659d0-0fc4-45e7-adc0-95631f7c3c5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697508, "uuid": "51373a37-4cdf-46b0-81ea-ca0b831ceec8", "value": "T4-Form9886750012046681.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496a8cc8-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (TrustConnect)", "timestamp": 1772707469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707469, "uuid": "8ff40438-084e-481d-a7eb-85ddfe481307", "comment": "Malware payload (TrustConnect)", "value": "bd45296ec3006176fe07d784bbe00bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707469, "uuid": "586e5489-9375-4db2-a9e1-8ccf9def9cf5", "comment": "Malware payload (TrustConnect)", "value": "36fdd4693b6df8f2de7b36dff745a3f41324a6dacb78b4159040c5d15e11acb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707469, "uuid": "8dbb23eb-0ad6-49b2-9fb5-836aec9e89cc", "comment": "Malware payload (TrustConnect)", "value": "eb165bc46f2f94b1b14d2c4c08b29a51389093ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707469, "uuid": "a7ae961d-0464-420d-97f0-db6603a76929", "comment": "Malware payload (TrustConnect)", "value": "bebba41fcf6c983386797aba32345611e597abec57aa4bde726a794c11f841034b7a436971fad9df5be454c4fa528232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707469, "uuid": "b611c4ed-e914-4eb2-a952-776d30d95a68", "value": "T16B871256E2FD00E8D5BBC0B8C6575517E7B1341913309BEB66A48A692F37BE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707469, "uuid": "d957006a-94bb-4ea9-8784-6706ae2b1f52", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707469, "uuid": "bcd8bb23-3a15-402f-a16f-cf70cc27377e", "value": "393216:FKxapWfkTIlr4SvhZ6sRvI9cR8vq/mQFgeyh0LfHPQu2jYvnUwEbc/81l:R446r/vbpvuY7Key+7PJsYPUlbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707469, "uuid": "e0156374-2801-4a15-a560-43d287fe4adc", "value": 36331584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707469, "uuid": "fb981b05-4023-4e37-8db8-a45b40bf75d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707469, "uuid": "0bec2d32-5f90-4f2f-a476-a153377cb9f9", "value": "MsTeams.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721c256e-1855-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772689069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772689069, "uuid": "59fda543-b82f-4dc4-a38e-e132b95272e9", "comment": "Malware payload (AsyncRAT)", "value": "5a65716dacb5beded950441091a5737c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772689069, "uuid": "4eee1dd6-b0b4-408c-8092-c5df76b03d77", "comment": "Malware payload (AsyncRAT)", "value": "376704ba2418121d108740902cf7eb572993469660ac44136ac51f8fdea2d779", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772689069, "uuid": "d2f865d0-9a41-4dac-8ff5-91d297282426", "comment": "Malware payload (AsyncRAT)", "value": "dd082f01b25bfe8151f7b189971e184fe2cbbc3b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772689069, "uuid": "bb3cafd9-f592-4cfd-bd49-8fae002937e6", "comment": "Malware payload (AsyncRAT)", "value": "d5a8b6ca56487900244ecde5004dff1ff0bd507d104d0c18abc022a91a0da4e5372d6134f189a188abaec15cc7076bd2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772689069, "uuid": "8d3b539b-0f4b-4ce9-b92d-f55b926997a6", "value": "T135F23A0573E59665E1FD1BBD5C3686044372FA474D62DBAE2EC450AE2A237C8CF14BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772689069, "uuid": "046e9676-4154-4d48-b5cb-c834e0652db9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772689069, "uuid": "6e08c920-9e48-41e7-93bb-9d354d708234", "value": "384:TMTJSg21zFoFySh0lE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCYIWWQEQ+:TiJSXpFoFjhj1hV4RbJwB+WWerQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772689069, "uuid": "13090dd0-44c0-4b2e-bbe4-490c7f175c31", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772689069, "uuid": "a0f9561f-c5fb-430e-b0db-d3a3af22fd7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772689069, "uuid": "c8188ad0-f3b6-4d62-b236-b9f92d236848", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc2e8c9-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697864, "uuid": "d5379c48-435e-4e76-a11c-652ee454e397", "comment": "Malware payload (PhantomStealer)", "value": "e3f253515af182fbc10db4f0283157e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697864, "uuid": "591d9aee-6603-40eb-bd93-af439643690a", "comment": "Malware payload (PhantomStealer)", "value": "37a1e0fabebce9ee8856da4ef67d0e2a2bf2220f1ca743123d186d1c1b708b2d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697864, "uuid": "1060fdc1-e91e-4917-89ea-a0ac208a26db", "comment": "Malware payload (PhantomStealer)", "value": "ad5d3fa1a2c76b3b2b7840bac83cfa9d70f484a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697864, "uuid": "e26389d8-d9e1-4300-89cc-c7bda51cb640", "comment": "Malware payload (PhantomStealer)", "value": "f80cbc691c79e79f91bbd70e6462c3d0bf6ffbee048a22f12bb3873aa6051d7d265324e2d55f5be50d3b7e1b6d9d81c3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697864, "uuid": "83ee37b1-7a04-4150-a718-5b1a6be968bb", "value": "T15826BE2934686EF84FBC4A1820190E4E33AD47DEA0C86D6CF563DE306BC7EB5559F4A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697864, "uuid": "643e4425-984d-45cc-9ea3-978e2e2d6e83", "value": "49152:VIcJo6gzglAjZxXAcQFYFqRQxWwMBFuLOQDgScOaEFWxJS4B8I4c93bhn1L4vjKF:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697864, "uuid": "d308c51f-12de-4ace-8982-a1a990f36072", "value": 4628174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697864, "uuid": "b786abdf-9eaf-4ce2-90b9-035f0b330eb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697864, "uuid": "ebcea36e-f5b9-451e-b0cc-a9c30ca2c5c2", "value": "e3f253515af182fbc10db4f0283157e2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d8bff9-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698005, "uuid": "b4d03050-7669-436b-9a51-2e2a268b1974", "comment": "Malware payload", "value": "2f7a2b8a0984f8cc2e79d755e3597176", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698005, "uuid": "e0623a5b-2d60-4ce8-83e0-03efa1534127", "comment": "Malware payload", "value": "38b7f5873eb0021379453940bfabf33c65effab4345f1fe28d66dc2037fdaa70", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698005, "uuid": "e2ef3a19-4d0f-40aa-bd1f-a9dbdd2b23eb", "comment": "Malware payload", "value": "f8822311a072c6eab8f598def7e15035824207e9", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698005, "uuid": "60c00139-adf6-4e39-9eb2-68cb40d6c162", "comment": "Malware payload", "value": "1d54dda35141a979457665c070150a8144abebc921c12c01c4680b7d5bc47c6f2ee97dc5d10db097c4ff10aff683b7d4", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698005, "uuid": "f8d74969-6d9f-419d-abc9-dba3697766b7", "value": "T157A412C971E420EFEA785978F13E2C909F54924AF887A03C5574C9DAE9A0CEC64B64C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698005, "uuid": "08597968-d075-4888-ba60-1d664020d268", "value": "1536:R88888888888888888888888888888888888888888888888888888888888888x:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698005, "uuid": "1b3fab81-10b8-4349-946d-16dd42a79216", "value": 452280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698005, "uuid": "23cd05ef-a726-4fad-a7ff-88bdef4a09da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698005, "uuid": "0de11346-6101-46a4-ae04-5de0e8d61d12", "value": "2f7a2b8a0984f8cc2e79d755e3597176.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384651df-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772697561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697561, "uuid": "ea82515a-c3d8-454f-beb3-3f0cc2be3ce6", "comment": "Malware payload (QuasarRAT)", "value": "158701466a0b55c689e310829989af2f", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697561, "uuid": "40f46574-168d-4e9f-b84f-bcb612f557be", "comment": "Malware payload (QuasarRAT)", "value": "3a348a2c63451e5300bf79444ba5ea77f597ae109d3132389ac1e8edd04327ad", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697561, "uuid": "210e7ed8-a6eb-4e84-b4e0-25ed1f34b611", "comment": "Malware payload (QuasarRAT)", "value": "7cf11b255408e93b06cdc531d3a7eb18048fe62d", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697561, "uuid": "52d86e04-d694-456f-8bb5-cb66fed04e44", "comment": "Malware payload (QuasarRAT)", "value": "2e57354daebbaf8da3d96a23a75762ccf5495b1c4ac88e2cc156a936b4b5ec3951009c756e8f221bdf4bb06e20140ad7", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697561, "uuid": "a2558030-a4d3-4df4-b5dd-7c2a0750598d", "value": "T129751231873BBD7E0A682E6554073EC01D7C7BA3455CC1B7F985BABBB2B61A0CD09960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697561, "uuid": "4a7a90c0-b443-4da8-aad7-df02c2b614df", "value": "24576:8vQEgHLYrmMZG9ox2UjxwgduJwNcIL59A/Gv6R6:WgHMC4NFdLdL59bv6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697561, "uuid": "bad5c5ad-b154-4a11-a2f7-91163a276dfe", "value": 1610917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697561, "uuid": "4e9b81e3-928a-4b78-a5f9-5c047f04108f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697561, "uuid": "c56e2969-efd6-4b6a-9bdc-bb92ba88fcb8", "value": "158701466a0b55c689e310829989af2f.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe10c8a-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772697890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697890, "uuid": "ef58bf0e-bb2b-4d2c-b146-30de4e0f7270", "comment": "Malware payload (VIPKeylogger)", "value": "7eb6023ff4d1949c1aa62dbe86917ad8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697890, "uuid": "ef808d4f-31a8-42f9-814f-a7ea4a5b866e", "comment": "Malware payload (VIPKeylogger)", "value": "3a62a1659d6173d20dc8b388f357af3de2feee931cf660d080caae91d792e6f9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697890, "uuid": "82be6f33-dc00-486b-9ce2-687fac95451f", "comment": "Malware payload (VIPKeylogger)", "value": "b9805b17e8a7913e0a2ff6d09d61ee53236576fd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697890, "uuid": "0450e1dc-e2ab-47f0-9698-4b9d9e5b5c25", "comment": "Malware payload (VIPKeylogger)", "value": "b136079f3bd3169aef68b94e40fd0e8601766e5126bf67e8a76de6f0438302bbd98bdcfb695c372eeb77c8fdec395273", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697890, "uuid": "ce996031-73f6-4d83-9467-bd554f9f55f4", "value": "T1E292758E3FC3B0740221783B6D2FA59EF72FCC54708C8054DA659495FE68B49C9B5AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697890, "uuid": "2725bbff-b64c-4b28-94eb-64e1d489d527", "value": "384:yKng3OL/PYhI2a2qoBaupKwJPJ9RPqD0LGYAZtmS1sS1vOpQDg:fVL/P6qupBzPf2/V1Wpqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697890, "uuid": "29797649-a98a-4987-b107-d64a67f0cc41", "value": 20419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697890, "uuid": "39e37e98-0126-41e8-8755-35cdf2b201c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697890, "uuid": "bdf470ff-cb31-4453-9493-f3168ce11560", "value": "7eb6023ff4d1949c1aa62dbe86917ad8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e84f4d-1862-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772694504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694504, "uuid": "e4da8cff-b987-48d7-b8c5-6baa45bb37ea", "comment": "Malware payload (AmateraStealer)", "value": "fc4adc7a0ad2d8619b8bce7adcc5b287", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694504, "uuid": "a92cd2e2-45b9-4437-b76c-f420e927ea6d", "comment": "Malware payload (AmateraStealer)", "value": "3a705a4987cba73f9a93c24654999febe598194ced3984b1e303ef357db5e8b1", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694504, "uuid": "d12a28ad-7cb6-477b-92ba-42a0b9d2c16a", "comment": "Malware payload (AmateraStealer)", "value": "2db033d03accc22d7c57e1851d32e2d1a1eae94d", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694504, "uuid": "45f3784c-f450-4f20-8a74-42f7c6cd7e83", "comment": "Malware payload (AmateraStealer)", "value": "25e2c1fd83e74577f10d05ccc6a7d492910b5c5be3a7695ad1afef73a54e85622119e64727fc406563b37325b607e895", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694504, "uuid": "daa36277-910d-413b-ae8f-6e43d6ee2b85", "value": "T14EA6AF42F7DA41A4E4FB2BB0987B66259A7ABD058734C2CF62547C0EAE327C16C74317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694504, "uuid": "28f22c58-87d5-49e8-b911-78cc74410073", "value": "1f567ef9939cf23c51d639635cf7e5e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694504, "uuid": "21118443-0bb8-473a-b6d5-44f0a4808bdd", "value": "98304:1QnBI8OS67B9x//DnzPTrvmDx7YzVoY+cgfdRyrFSpL9/2WC/0z4:qnBI6S9xzLrvoYzVoYpFSpBOLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772694504, "uuid": "1a529db7-7865-4437-9fe6-c6d0ace7bd1c", "value": 9755848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772694504, "uuid": "20d4653c-39e3-4717-89ce-c86cb9ea0f81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694504, "uuid": "40da9adc-2fd6-4585-9ee2-e598546ac461", "value": "3a705a4987cba73f9a93c24654999febe598194ced3984b1e303ef357db5e8b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1701e336-187c-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772705666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705666, "uuid": "4563fd31-1d81-4caf-9ccd-53ec5e4caf6f", "comment": "Malware payload (Smoke Loader)", "value": "c4d51f32cfaf1c066e1fa9eba91f8042", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9911", "colour": "#29747C", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705666, "uuid": "c43dcb70-e5ed-4a91-9f79-b61b55394541", "comment": "Malware payload (Smoke Loader)", "value": "3aba0850c99661e7832bf1d735fb8dc6c34b2205a9f266478b0741f2715165e1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9911", "colour": "#29747C", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705666, "uuid": "998253c8-3f1d-4434-8e6c-ebf93bcd50c7", "comment": "Malware payload (Smoke Loader)", "value": "b62ecf43adfbb0348386c68219401b77fd36bd8d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9911", "colour": "#29747C", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705666, "uuid": "a8eb6d1d-d60d-4b7f-8ea0-0f3d9fb6e799", "comment": "Malware payload (Smoke Loader)", "value": "880f073ff938e1b029b80ebdc52de8f85b587ebf7f13fff321086fcf206684f44f9bd998e81b12942a64423d83da6c08", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9911", "colour": "#29747C", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705666, "uuid": "7684079c-7858-4161-9c0c-754ad10f5ada", "value": "T1B6E633D2EE57A9BE3E5EC2F225163E16811D72A3A0865EC7491B08BF71CE5F41E8604C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705666, "uuid": "a0ea8660-97d1-46b9-b2e0-4db3d27606c5", "value": "393216:RCrkER3p+lMc7O38lP4hBC0uxqrQIsx05KCkB2C9c7:c+lMc7OUP4jCXEQEkBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705666, "uuid": "9faca5d8-b3cc-4855-9e71-731e94699339", "value": 14443475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705666, "uuid": "43c42712-2ee8-4088-8b83-a4b1520ad598", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705666, "uuid": "fab8c2fb-a0f6-4d90-a634-8aa351d84422", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271cc46c-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726738, "uuid": "5656e310-8240-4a3d-b5d0-df9a28619fcf", "comment": "Malware payload (Mirai)", "value": "69a0b8413e19eb9ac3d7249765b3cc0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726738, "uuid": "fde25dd8-eff2-4de5-b91a-9a49d5219c6a", "comment": "Malware payload (Mirai)", "value": "3ac1735b4580236c7a80a9096a32fc2c77f23c02ef38c37269867e67254dd730", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726738, "uuid": "bdf5cfa5-10a9-4965-89ad-d123728e56d2", "comment": "Malware payload (Mirai)", "value": "74c9e198e4e5161e3429dd66145243713f444035", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726738, "uuid": "6b9a0d3c-87c1-4e4a-b539-50660d2e08b6", "comment": "Malware payload (Mirai)", "value": "0991dd44e9390eb665c2d86b27546f70f037a9561f15764c7f995d4a4482c0839ae0195a802dd9256c14fef8e59c2ff5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726738, "uuid": "30f4c965-3508-4b9c-a42b-c17fc94d2142", "value": "T1BC833989B4114EBDFA8FD9F940160F0DF92163415B630F27A7ABFCA37C620A59D07986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726738, "uuid": "1213af7a-2eb4-469a-a985-b21a007a70ab", "value": "1536:ILsK6i5sfGWmUgb7KwXkAgC0OefO+tWblctZDNJ82mA:ggGTZxB10/9YgZp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726738, "uuid": "3675503a-b7dd-4a3a-a35b-276f5d07a723", "value": 84948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726738, "uuid": "eb824e7e-d445-4d25-b814-b4da8d1ce318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726738, "uuid": "c3dd8a3b-3b0e-4611-8ec4-8ceaae66f3b9", "value": "MMaaRRiiOisecTanee.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2358ba08-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697956, "uuid": "3ee6672f-b289-4d12-b973-df31e9035230", "comment": "Malware payload", "value": "911296561052394416abf9d8c77d1990", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697956, "uuid": "3b502044-9106-4d4b-b26c-426e475204f1", "comment": "Malware payload", "value": "3b26d60813545bb6ef93298beaec1b748eb80149b721745f40089c5b39581d55", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697956, "uuid": "528da65a-56bf-4b57-b82f-a0cb353f1806", "comment": "Malware payload", "value": "580d37bb6ab588044814d2a378923d003b24a0be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697956, "uuid": "d2b845f3-9612-43a0-9297-3aab61e75f68", "comment": "Malware payload", "value": "c93824745b5838c1a233a1641d52d3e1c2e73edfa53b8865bf123fc597f14f2bd474f272074641e5d54f1924c026aa2c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697956, "uuid": "46d235f2-1127-41a5-a14b-a871261263cb", "value": "T1C692858E3FC3B0740221783B6D2FA59EF72FCC54708C8054DA659495FE58B49C9B5AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697956, "uuid": "ad98bb69-9647-426c-bd37-31db84d31b09", "value": "384:yKng3OL/PYhI2a2qoBaupKwJPJ9RPqD0LG0AZtmS1sS1vOpQDg:fVL/P6qupBzPfY/V1Wpqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697956, "uuid": "f9a18ea1-1112-48b5-8885-ab7e1814661c", "value": 20422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697956, "uuid": "82840f22-dfac-4424-b719-ec7ca2251987", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697956, "uuid": "467775a6-bb93-462e-aeb8-c940c5a922bb", "value": "911296561052394416abf9d8c77d1990.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fbb526-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697558, "uuid": "4ac570b3-5852-4140-81b3-8173b622052b", "comment": "Malware payload", "value": "12ba437c39f09a4fd8153ed43f920a5f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697558, "uuid": "28a2552b-ced5-403a-8ac5-bdaa2e31cc99", "comment": "Malware payload", "value": "3b34fb13bdd334fd6d43f88badaced783f71c41224d56dca427cc17e61f3a2c0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697558, "uuid": "4c65eba5-e782-4892-8f6c-9ce1a2690d26", "comment": "Malware payload", "value": "a87abe29b7e82648b3ca2b9785d45c11b39a5581", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697558, "uuid": "be7c8b52-e7ed-45fb-a4a2-c8092a116cb0", "comment": "Malware payload", "value": "44b5f1f0289a58e53f305bab818cbd37533fe4ecf565c0ae42249a74cd841e1f76d94afa3bf71ac4bb8f7c7f4a0d4363", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697558, "uuid": "455f0f45-6420-4a8a-b73d-a91a98c0b13d", "value": "T1E8C412F52270D89C1106B4D9E3C67EA8E8D8BE9364114AF6BB450F1107A27B8A5337DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697558, "uuid": "f7c54eee-382c-4d9d-9c2e-29bdfd94e271", "value": "192:i22222222222222222222222222222222222222222222222222222222222222/:1ZyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697558, "uuid": "cf99f787-cc7f-4726-bb7d-a641a2f19a81", "value": 572197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697558, "uuid": "9bfbd99e-0b20-4b86-baf8-dd1d0b63751d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697558, "uuid": "76950437-95d7-46c4-8998-c98ca81b33b4", "value": "12ba437c39f09a4fd8153ed43f920a5f.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158fecad-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772697503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697503, "uuid": "728b7770-01d2-4179-8f71-ce85456fd482", "comment": "Malware payload (XWorm)", "value": "bd052bc946edd39a88fa99a1189ef5c5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697503, "uuid": "cd9b2edc-e69e-4fb5-821d-040f483dba57", "comment": "Malware payload (XWorm)", "value": "3c2f60f21bf2bfc3f43344009aec5befc57e8b3002bbe99edb6b7d4b0d4f2e61", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697503, "uuid": "326c34d3-f206-41f2-9d31-c2a7eeb20ed7", "comment": "Malware payload (XWorm)", "value": "702b458ff96b237583015e1c068c16961dca335b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697503, "uuid": "78857525-6fe2-4a39-b2c4-f54155f2101d", "comment": "Malware payload (XWorm)", "value": "ddb2a89019922eebbc097d0e5645df59c5861e3bc633ea04355091a02bfd6d3e0ad988ca2d4fa095e248cd5be5cc7800", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697503, "uuid": "d6b605ec-58de-43c5-9cc8-afcb24b7f836", "value": "T168B22E3EC9859FF00B2B31A5A56F7916A9580363B5382A4C7DCFC0993B36550CBB50EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697503, "uuid": "e849582e-9253-4d45-96dd-924168e76eca", "value": "384:KdSeT880naPthvhNacbeJrtwBhFtGIX+UrDId4HlqXYCn8Wh00ad7bmDa55Xa+ti:KdTHllVr0dgAml3LJu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697503, "uuid": "47c82a23-ad09-4da1-a538-6d1da9edb31b", "value": 23861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697503, "uuid": "8d591c15-d522-4524-8803-5b6529128c22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697503, "uuid": "3d5c3aea-3541-4bb0-bd30-b0123c611f9b", "value": "bd052bc946edd39a88fa99a1189ef5c5.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e14f01e-18cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772741434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772741434, "uuid": "60a63bc7-0e29-401b-9987-4a431ceb19bf", "comment": "Malware payload (Mirai)", "value": "005e593af571b0ce3658f810418cc467", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772741434, "uuid": "ae6c19de-14dd-41f2-836b-2dc44922b5a4", "comment": "Malware payload (Mirai)", "value": "3d77eace9ed19b14a1bee55a201961d614c2f6916285f224b7c8feb8b33da564", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772741434, "uuid": "5b24501d-972e-40fa-9556-467e8aa764ec", "comment": "Malware payload (Mirai)", "value": "ae97bff41e90e38d25881496e91261f2aacd4a73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772741434, "uuid": "67304a03-43d0-4e4e-96dd-55cd8db62504", "comment": "Malware payload (Mirai)", "value": "35c15c8683c0f65103a515679e09fae0d8046d67f421f36d3980b36dbcdb9dc10afc32c91ed259353bf9c2806879ecec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772741434, "uuid": "bcd97b6b-2a7e-48c3-89ab-6c9f7eecb737", "value": "T198E34BD7F800DDBEF80AE73748530909B630B7A215921B372257797BEC3A1981967F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772741434, "uuid": "325cf51c-c4ad-4b0c-a8b9-04ac5e625f0d", "value": "3072:KqTWWxXUM9Cyw6j0Z1DE5WY6tIL2yVxjbiqL2N7+oK0:KqxEywA0Z1DGWQL2mL3oK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772741434, "uuid": "fb3f1815-22b4-414b-86b1-fb670980293a", "value": 152864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772741434, "uuid": "bac2fa9e-8ef7-4d1e-a5c4-9b4d53ca10bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772741434, "uuid": "e867e818-384b-4a26-ae02-c79c383477d4", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d645f6b-18c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772736627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736627, "uuid": "09f64799-1487-4632-993f-6c2005d8fb76", "comment": "Malware payload (Vidar)", "value": "0c5191e81933b98ae584402a57082c6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736627, "uuid": "35093b9f-5c78-4bdc-99df-ceb570bdedce", "comment": "Malware payload (Vidar)", "value": "3d83dc7fa4ef0b916d8ce30fcee6969f3a51df2e38a09bf9bec93ee4d0e19dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736627, "uuid": "cf0f6679-5490-474a-ac62-ad039ee4822c", "comment": "Malware payload (Vidar)", "value": "1fbc2e2f8f46eec1d2c083ba0e5cea30a3d75c97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736627, "uuid": "1922325f-d82e-422d-988a-4c94de4db363", "comment": "Malware payload (Vidar)", "value": "fb55e329aa1c8f615fe7edd66192118a07e536b409822727c5627a21e760a78831a300e6d7644b9349c11042d8450c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736627, "uuid": "e4d654f7-3f3b-4f00-8d98-2262b247ed37", "value": "T1EFC56A07BED498A4C46E937AECB652927735BC480B3233C31A167A742FF27D5583A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736627, "uuid": "decb0c86-df6b-42c3-89ed-e28aac19d2ef", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736627, "uuid": "10682feb-ec79-4777-a5ec-5286ab5ba0f8", "value": "49152:TfixeQaU8S/ao6x8U9F48H2kVLS/1Smo7QWSg8TmUdTd9GScClVzc:TfsTbsYSdEW/8xrG1yzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736627, "uuid": "2095748b-40bf-48cb-9e7b-846729ff9487", "value": 2677247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736627, "uuid": "090714ec-c850-4db5-8dbe-e35d25e87157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736627, "uuid": "23443ff3-5f02-4486-bdb1-6314673a7f38", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a69b23b-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772697538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697538, "uuid": "e09b2288-6841-4b20-b277-9b5dcf4ec867", "comment": "Malware payload (XWorm)", "value": "402b4a004c948f74aab374ba15ce6e4f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697538, "uuid": "22d0ddbb-7852-4054-87eb-98308182b011", "comment": "Malware payload (XWorm)", "value": "3d8906e564f8dbef6b45f9431a304eef40a1a4791639d98f5fe1bba9b30305d8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697538, "uuid": "a470cd4f-a7d7-4d8c-9e59-03ed9253b26f", "comment": "Malware payload (XWorm)", "value": "a779269d47d48f10b998f0200908131799e5f9b3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697538, "uuid": "f31f1bbb-5463-4fa0-945e-a2ac467f1653", "comment": "Malware payload (XWorm)", "value": "4d2629421eb6465082407be78472ac7fe8c4ab3ce896225026b560c65f1b4cb90130e83c40b377c75911fdd19c723cfd", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697538, "uuid": "dc4a0ddc-3d34-4f40-bb2f-0f4a81776968", "value": "T1FF72773BF518EFF40B2F51E1118B6C0650545796B43A4EACB4CDC0597F2A7548EEA4EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697538, "uuid": "746f0664-f75f-4ba2-8fad-7f4023669a8a", "value": "192:IDx7yGk84Z4OKNOnx3tAer/T+C3qdbIvZ1l88j4wIP5d4P+CTeMProjW17J/qP:o994rKNOn5tt/SdwZ15jlIxiiBC/qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697538, "uuid": "03079f48-6f55-4c96-b258-45ce708ac809", "value": 17022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697538, "uuid": "cf2b42ec-c48e-41aa-938f-13aeacc8fd05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697538, "uuid": "492c9b54-c509-45ec-8cd3-1031040c0595", "value": "402b4a004c948f74aab374ba15ce6e4f.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89518f4-188f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772714151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714151, "uuid": "c48120b3-3be2-444a-9d8b-f6504ebbb2b0", "comment": "Malware payload", "value": "2115e69f71d9f51a6c6c2effdaee2df2", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Darkcomp", "colour": "#38D619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714151, "uuid": "6e501043-23a7-46d3-93e8-417a27e0867e", "comment": "Malware payload", "value": "3df9dcc45d2a3b1f639e40d47eceeafb229f6d9e7f0adcd8f1731af1563ffb90", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Darkcomp", "colour": "#38D619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714151, "uuid": "0b57f2b3-7529-41e9-8a01-9109680b911b", "comment": "Malware payload", "value": "559052799a52d1b29ac7e87935e9a0c80df5fb16", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Darkcomp", "colour": "#38D619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714151, "uuid": "66f87012-cc87-4ad6-9ce2-ab1c65f1d4ba", "comment": "Malware payload", "value": "5d970d2d18f0d02de41c688877a70238d691e1ae10c54e120281a128fdc3ab9480303ac5f7f32c28af6cf93c5a31e226", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Darkcomp", "colour": "#38D619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714151, "uuid": "457ccc12-14f8-44b4-a81b-9760529e0a10", "value": "T13C25F815375107E3C5368E38C9938F00AEFABC59CB23867B469B71D53E326D46D2A683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714151, "uuid": "7997a492-a6a9-45de-bde8-bc1d9c4ea59d", "value": "3e0c71a2291f77b692ad54bb26dfb680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714151, "uuid": "34f965ee-019c-4679-b402-0329905b71c9", "value": "12288:xX2c7RgrjQGUoIoK/xibSzbQPvUjw5ebbb8bHmb4Ab/NFbOmb45bQxbDabnLlvUt:IcRw8GUoIUq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772714151, "uuid": "5ccc7889-92a4-4243-a95e-6e7c7caf3939", "value": 1032704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772714151, "uuid": "2da3d8bb-b580-4b8c-9876-7d5fe15482c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714151, "uuid": "17cd0686-71cd-4154-b9f1-5257dc0e5c67", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ac1e16-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772697832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697832, "uuid": "78d8dc79-a441-4e55-9742-9425dbaf9f89", "comment": "Malware payload (AgentTesla)", "value": "deb1f5d9861acc9d56d52fe6b8839a88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697832, "uuid": "7c4676cb-1e91-46f1-8c8b-48b3e78473b3", "comment": "Malware payload (AgentTesla)", "value": "3e1426fbb5c016a4cc2c5b9d2fe63514202e49b4b90c10da55c7018ca9662ea9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697832, "uuid": "ebc9d70f-9a7d-4756-8a81-d608be6e312c", "comment": "Malware payload (AgentTesla)", "value": "8fb40fd6eae477b56d53df4dafc435b35c51f591", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697832, "uuid": "4921d785-c8f9-4bb6-8164-7709cb08d3f1", "comment": "Malware payload (AgentTesla)", "value": "252b42f8ac00611f72c2bcb382c4ec60ca7f810531f0925c3d80acda457a6e45daad8a3ecb641d22b2993a91190f963d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697832, "uuid": "03fd6666-b938-4a32-b600-8dbd1775f34e", "value": "T1C355AFF1AAD71BC0BFB9B076580FD3013A6AA9DE23C14647A2741F18ABF99C1D427513", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697832, "uuid": "4efa6abe-1131-4f29-b592-f4a8bb4f8f17", "value": "24576:xc3AfYfjFGSacrfJNxUERurIfE9mNKeQbzSGO2ry4HuwS6/tyPu4peAsOocFgCmH:8eXw08BAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697832, "uuid": "ffbc39d1-bb1d-4526-a673-6ea92ed1a8b1", "value": 1372313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697832, "uuid": "b6159bdf-c1b8-4452-8b6e-dcb43d00a7ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697832, "uuid": "aa715e90-354b-4738-8e61-bc5952f247d3", "value": "deb1f5d9861acc9d56d52fe6b8839a88.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa24123-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (WSHRAT)", "timestamp": 1772697995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697995, "uuid": "8ee32f3b-c336-4d45-9d9e-6ac2b3428c2e", "comment": "Malware payload (WSHRAT)", "value": "86f8791818f504f5674f38106cf75a1e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697995, "uuid": "f3dba8cf-f859-47fe-a580-b79755eb5793", "comment": "Malware payload (WSHRAT)", "value": "3e5112342fac7fa5d6e486140c1cdac66cf653513354d78e1882f88073b16808", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697995, "uuid": "93d386be-172e-4a30-b4f7-b9bba8331e8e", "comment": "Malware payload (WSHRAT)", "value": "86e5e5319e527dc86bdde611ebb01325166a2726", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697995, "uuid": "7b2f432c-cd9d-4645-854c-00b879c0dc45", "comment": "Malware payload (WSHRAT)", "value": "044b6074dad49c346d285b0a0ac28707232377beea763e36602967d47af54ed537142ba8623f851a6047e11bb1d42674", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697995, "uuid": "ccb26d55-793a-4c9a-958f-10d387e0648d", "value": "T1BDE19B899555BC9D718D5B20B57228F8172C583E7E9A78DF18C2B0D02CF2EF279A11E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697995, "uuid": "b207b398-36ed-4537-abc2-c87d37ca91dd", "value": "48:lNCc76titxA/6F7e1CcutJi5H6kQS9yCclJPTvErCcHuoT:M3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697995, "uuid": "7c3788e8-e74d-4c1d-a54e-e9b88f254f5f", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697995, "uuid": "caff7b8d-06bb-4a92-a4a9-35d607f83f16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697995, "uuid": "f6b64c06-f5a3-41e4-bd0b-ed9acb8a1eb3", "value": "86f8791818f504f5674f38106cf75a1e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a870ac4-1845-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1772682211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772682211, "uuid": "52a591ea-2e4c-4dad-91d9-dd6165dea045", "comment": "Malware payload (Arechclient2)", "value": "f85ad1fe631407d4a80a9bec1b373185", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772682211, "uuid": "f17c9d60-2126-4b8d-a010-91f19f4ad712", "comment": "Malware payload (Arechclient2)", "value": "3f1154df91b9ec324943c5a72519722ddf544c8adb8ca40701124b4a05136b8e", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772682211, "uuid": "1905fb11-8e9c-493c-8028-24ba80837535", "comment": "Malware payload (Arechclient2)", "value": "071845148f46542f7819a0135f51095350198bbc", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772682211, "uuid": "6cfbf9ce-6672-439b-9d4a-d666e1259ec9", "comment": "Malware payload (Arechclient2)", "value": "6b93800adb852e52da9df53bb30785240d571420ca5ad7626b4c460267100aecf004530ca00742f370cb39daac1d2a4a", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772682211, "uuid": "bc08b2b3-cfb7-4bac-89de-c9629c516053", "value": "T18B12B97DDE76FDC043BE71D089153F0720985A23EBB85E68ED8608AA0D24A45DF3A25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772682211, "uuid": "b592239c-0115-4e70-b4ae-b43d2d7c38bf", "value": "192:tPS84e6MmXrfICLIxhPJ0vCSQ8u5lrYFLe52pScIMESGQF8x87QBisSGbf7WzX+b:tPJ4e6MKf3LI/1SQntmLe52ocIXSGQF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772682211, "uuid": "a5a55fb6-e8db-4c8b-94b6-82d976432926", "value": 9023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772682211, "uuid": "c6af2d26-e940-4147-8bd5-3ca17ab3f0a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772682211, "uuid": "7b085150-ccff-40f2-bed8-60aff358ac66", "value": "app.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce7174e-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707716, "uuid": "341d74d3-7603-4d82-9fbb-5fa834494885", "comment": "Malware payload (Mirai)", "value": "0fb3f31fdd49ab877736818668a1f818", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707716, "uuid": "9e2d4bd6-45aa-46ab-9188-2b1ec066acbe", "comment": "Malware payload (Mirai)", "value": "3f8b0c577cb823a6cee39cee94df9e1c5866727d02a9226620fff108ffb9d89a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707716, "uuid": "146cac81-b446-4e74-9af9-ac5e436ddad4", "comment": "Malware payload (Mirai)", "value": "7e23e137ff0275b6f255248d3a9f26fb274b81dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707716, "uuid": "907dcbd4-3bb7-42e4-9112-669949767f7c", "comment": "Malware payload (Mirai)", "value": "1bedf0987edc9fde0479f7a3efcb95c42946327cce24af05dc0a59a46e74765cb5b722341c7b9435047cc127fb6b6580", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707716, "uuid": "88194ea7-bfda-443a-93a0-8f5e52dd861a", "value": "T13B044C46EA804F13C4D7177AB6AF42453332A7A4D3EB730699287FB43F86A5E0E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707716, "uuid": "b96ad983-1684-404f-9896-5e6f6f5f2ce4", "value": "3072:6Rhr+yVzkLfr+K6ImRnytaV7PopKJpy9FXK49cW4MwbZn0JqmWlvM/9ShRl:AhZ1kPrvuytaV7PopKXy97KnMwR0Jqm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707716, "uuid": "81acbdfe-f6d8-487a-8b37-d9849c925a33", "value": 188524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707716, "uuid": "7eeb0e59-911c-477a-a48f-9061a17b0309", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707716, "uuid": "72e626ec-1645-444f-aa6b-9da9b76414e9", "value": "5r3fqt67ew531has4231.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec29212-1893-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772715665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715665, "uuid": "652cb24d-a32e-4454-90a0-5abe2fce13b3", "comment": "Malware payload (AsyncRAT)", "value": "85a6bc4cedd4e30322ca2ba5d663a293", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715665, "uuid": "75ce409e-8be2-46f5-908c-494b82b93c01", "comment": "Malware payload (AsyncRAT)", "value": "3ffdfbc462498a8a82d2ea17250c791218a12b2dbd903913d487c5a69517d085", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715665, "uuid": "f3061835-82ef-460a-ab87-91c9138065c8", "comment": "Malware payload (AsyncRAT)", "value": "f1475dcc3b886797ddda9db0c0d33898cc56d66a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715665, "uuid": "1a1b82f0-f024-429f-ba27-8d6f4dcc7d87", "comment": "Malware payload (AsyncRAT)", "value": "419596dd87c2563094113ff807a81a1a81d08ed2ef59f853334fd3581cfad046b6a91f87af5642461dc7e41ebe4e3573", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715665, "uuid": "86668045-413e-4caf-b008-028613fc80eb", "value": "T1DBF2390573E59665E1FD1BBD5C3686044372FA474D62DBAE2EC450AE2A237C8CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715665, "uuid": "ad063b37-c8f3-4756-a02a-5a2ddb74f80e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715665, "uuid": "b682bb7c-1144-49f8-917e-fc8e2d330155", "value": "384:HwMTJSg21zFoFySh0lE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCOJWWSEQ+:HwiJSXpFoFjhj1hV4RbJwB+WWx9Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772715665, "uuid": "b43299a9-c177-42f1-bfe8-5c6fdb9811b5", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772715665, "uuid": "15f874c5-8208-4699-b519-7393d871b08a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715665, "uuid": "0f4c32a2-7355-44d0-9fea-bb094de40e67", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4e0272-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707718, "uuid": "83d12300-adbd-4e89-8916-6419e6201c8c", "comment": "Malware payload (Mirai)", "value": "a9dde9fd250e28e432d1a2be3aae95dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707718, "uuid": "119892bd-97b2-4671-bd60-2f341865abb9", "comment": "Malware payload (Mirai)", "value": "400f2071b6e39026a592c74b17c29f74d6c96e996bcb53086501d93ec4568eb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707718, "uuid": "cfbac7ce-f652-4027-af5e-8bfcf4d7d401", "comment": "Malware payload (Mirai)", "value": "40dcbefef93ff84f1b95bd16298a04111a587dbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707718, "uuid": "14dd1c98-c69f-4bc6-b1f0-303e2dea1076", "comment": "Malware payload (Mirai)", "value": "655ec9b73d1698ffe4c87ee3f716c9c39f605697253eb5d4c41e51b6cb42d3ec3387f8cee52624a8277428c0233af509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707718, "uuid": "a6776ee9-305b-46c0-93e8-22b0d32b2023", "value": "T1C9C3C60E7E219F6DF798C33147B78A21A65823D623E1D582D2ACE9025E7034E745FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707718, "uuid": "489d8d17-7641-41e7-a118-2a024a752283", "value": "3072:3kyQgAakpvF4YDsEcgxm2oIUy97kj4SEmU+CrwwbZnmlmE:3kvakDQ2oIUQI81SwRmYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707718, "uuid": "d8ec8dee-cd16-48ad-b641-0819b7f3ab3e", "value": 127956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707718, "uuid": "60650de0-ac53-42cc-937b-3491016e0fe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707718, "uuid": "c5bdc8f3-3997-4efb-a13e-4ed4af29721a", "value": "5r3fqt67ew531has4231.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b73dc3-18c3-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772736427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736427, "uuid": "38529adf-a547-41f6-a55e-18352a39bd6f", "comment": "Malware payload (AmateraStealer)", "value": "00e4bf4697faf97079ed6bcdfbbccae4", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736427, "uuid": "338f41aa-e3b3-4e54-95f7-f7bf35acbfb7", "comment": "Malware payload (AmateraStealer)", "value": "415737aa1366bd168719cd65e6707a3875cc9421cf7e62d1184016b3fbbe7aff", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736427, "uuid": "02edfb6e-0847-49ab-b7d1-f12b86fc7b62", "comment": "Malware payload (AmateraStealer)", "value": "8514d398b0927fc33a187725ac6c213351e4ba65", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736427, "uuid": "57c0480a-12c4-4cd8-8d95-4a09afaf339c", "comment": "Malware payload (AmateraStealer)", "value": "0db1347ea5c84063d17d754e7e4b177a6e9a6a009ffacd6f712f315d2d6803cfeb129c3aab376ef1e58ee609463aceab", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736427, "uuid": "e6b94003-fbf6-4ca0-9699-7e3e7ab8c9a1", "value": "T135E68D23ED808274F5C655FA87FE6B2A9C799E01032951C795C83C915A30AF17B3EB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736427, "uuid": "949ff095-0494-49a2-aa8f-c3d190ae83db", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736427, "uuid": "1f5545ed-f976-4224-b532-1d3ce5728d63", "value": "196608:1g4kRa2wVkA5P+NmijBH1VIQ6nmC7hWDp:1ma2SkAIlp6nmC7hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736427, "uuid": "135dd2af-336f-449f-b5c3-f96ff2b0b6e9", "value": 14543360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736427, "uuid": "de0d2470-48a9-431b-a0b5-29fa48aa636f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736427, "uuid": "569648db-f7fb-4011-83bc-5fefe871b9c0", "value": "00e4bf4697faf97079ed6bcdfbbccae4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6d1e70-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772697892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697892, "uuid": "c08f35ca-68ff-4b1f-8d8f-ee7ac33b5acd", "comment": "Malware payload (XWorm)", "value": "0ebbc8bb2383daf186ad0861bd28c184", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697892, "uuid": "4b121bad-961a-4d99-a159-2f54cd3b4dea", "comment": "Malware payload (XWorm)", "value": "41a2a3a0206358b8884a6d80cc2ec32ea510985f68deee9ddc6596e2085005ad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697892, "uuid": "26d61b6e-1a0e-46b9-a91f-cc013a7aa534", "comment": "Malware payload (XWorm)", "value": "7a2d4fca2482848af8575c8f6b9655bb15e7c206", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697892, "uuid": "ed8078f7-bdd2-4f45-b9af-18b0c0d13726", "comment": "Malware payload (XWorm)", "value": "bd3ed6f333125b4cd124bb0d7d3e98be31707096583993144b88fb823c1d5f8c19472d844a9e4f24542bd0d971b2d6f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697892, "uuid": "7601584d-3e55-4718-8891-3e8d0da7e8c5", "value": "T1D26219AC8D17B8F4562932406CEF1F75CCD495049106E135B6AFE3A97300B68E6B42EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697892, "uuid": "80e6ea92-465f-448c-bf52-0cfeb300154f", "value": "384:TSsgYWVXovVFv4794NQ5BMyfYnlLkzlhlg4ubCWEm9sduVj0v4ffZRPSf8u4:TSswmggKAnu7Vr4fxRPSf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697892, "uuid": "e4052340-7fe8-452f-9684-2572a74e514b", "value": 14600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697892, "uuid": "6e780cc9-8da8-44a2-a013-9398a08d3e17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697892, "uuid": "19a22644-f828-48cc-a31e-63b09c3f5180", "value": "0ebbc8bb2383daf186ad0861bd28c184.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf5acdb-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772698158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698158, "uuid": "cecea060-04bd-4d44-b87b-4bf0482de814", "comment": "Malware payload (VIPKeylogger)", "value": "5cd283538c7c7e9a2d3950d37f833b89", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698158, "uuid": "5c9ed3bd-fba2-4370-9a9e-bb1bd24855b1", "comment": "Malware payload (VIPKeylogger)", "value": "41bd01608135d7e67150684598df1347c47a403510c7bdabe42e976958f22935", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698158, "uuid": "7dc36f8f-dbcf-4163-ae53-4a6e004c121d", "comment": "Malware payload (VIPKeylogger)", "value": "d9fa34f2385c4261c3cb41cfa078a4d0d3a7054a", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698158, "uuid": "094d970e-91de-4142-af11-8dbf44ffb4e7", "comment": "Malware payload (VIPKeylogger)", "value": "3261d8ebf9fab61a525f2426ab17b8cb2521d8a194997e9db14e6bac4de8a2d918d413290d89ab5e2225c766fc547aee", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698158, "uuid": "9ec175b1-bde1-4104-baf2-9fdc479dc9ce", "value": "T1A835126430AFCF9755BC6034CC143EAAFFC612A12C66B48D3B4A80DAFB65C1A5F11D88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698158, "uuid": "1bec0607-f55d-44a3-bb87-6083cdcf281e", "value": "96:6yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyys:PzSFX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698158, "uuid": "39a9d46f-a4b7-4ef9-9132-4dac7ea1e9e9", "value": 1158747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698158, "uuid": "bc037128-e1b7-4bba-9504-fe77b366986e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698158, "uuid": "73fd37b4-62c6-4168-ba1e-2d531adb62be", "value": "5cd283538c7c7e9a2d3950d37f833b89.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468998fa-186b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698444, "uuid": "91b98fca-b721-45a2-8656-0702cc2577c2", "comment": "Malware payload", "value": "dc79d9c6e6d16f624d0dbecfa1c7c7b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698444, "uuid": "164041cc-ad15-4bc5-92d0-6e0ae6be9c04", "comment": "Malware payload", "value": "4284f4f1f2f6844d4ee84fd841bf807d99331333de26398398c666be2c824d59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698444, "uuid": "e61639ee-6ec9-490b-aab9-6bba7c2caaa5", "comment": "Malware payload", "value": "6054e2bb4ad6cff699c3b2552b92ccecd8b07853", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698444, "uuid": "7471329e-5edd-4298-b19b-2fbd6e8af92b", "comment": "Malware payload", "value": "e87b04bb33237ae0ffd057ab6358ccadadd1b944cb2c20dadde0fbcbc54d1f325b05201ecfcbb0a4d3f9324bf14b4848", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698444, "uuid": "c0d8b930-e65c-41d2-ba76-f6b152307701", "value": "T13132C517A7BBAE1BC4D037770193072162E95F916024472FBD0D1C8E6E9B3412E3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698444, "uuid": "98634cdc-6780-4a9c-86a2-a844bfbc2fa0", "value": "192:xvrOR1CQOsz1NxfAzmH9iG0GhWaDpU/O7Q89AGSybcqeif:xvrbCzfam2GwIU/kwGSbUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698444, "uuid": "9a940129-8aab-4bce-a415-2243857d1639", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698444, "uuid": "acb771db-e230-4964-b92c-c60b260423aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698444, "uuid": "6e1b8f53-4b2d-47e8-a7ef-d2bcd6b4fc8b", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80258418-1872-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772701548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701548, "uuid": "6295eebc-240b-4a53-9dbe-6e8fe0bbf89f", "comment": "Malware payload (Mirai)", "value": "9b17480c5b540db84a5e6c9d3bf9e263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701548, "uuid": "4346b316-6657-442e-a4ee-cda2c8853d04", "comment": "Malware payload (Mirai)", "value": "42c3948df83889e7bf3c9ad1fd4a483eeb483550cc446b2719a74dd5c94aca25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701548, "uuid": "6cf34cf5-ad69-46d2-87a5-e24826bf51a6", "comment": "Malware payload (Mirai)", "value": "91476a20b81381db26922c8b6433eae9bd3baddf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701548, "uuid": "76f484af-0f80-42d7-95a9-1a5cc39158ea", "comment": "Malware payload (Mirai)", "value": "cd2a10a84729a496e4b7742762fc873a8e89dcb8c668aeebcb2db1b26b854f2033aa2b5c0e67cebcabf496dacf492379", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701548, "uuid": "53711908-aeb4-4bf8-8156-60dbd7c37221", "value": "T1FE930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701548, "uuid": "5165b17e-2d31-456e-b161-43da5c056e14", "value": "1536:wqnZU8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Ykn:s8NUv5nTacgzafVAwe4BNRIbT2gXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772701548, "uuid": "910a0873-5cee-4ea5-bd23-a8fc9b3a4599", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772701548, "uuid": "3bcfe350-9e1a-42c1-a0d5-55a5578c3df0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701548, "uuid": "1445b8be-2230-4471-8f60-65581a16dce6", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d741df-1838-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772676680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772676680, "uuid": "175cf478-7b32-46b5-acfa-fa5af3f0f7d4", "comment": "Malware payload (AgentTesla)", "value": "0e984dcb990759c98a6fea1f111999fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772676680, "uuid": "764b6622-673f-4622-ae85-9b5571f4d381", "comment": "Malware payload (AgentTesla)", "value": "42fe6fc75209a3dfa01a956afd9a7c83f5627dccce3b2c77bee9a2156df4af81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772676680, "uuid": "eec3d7de-43ea-4b61-b237-431cfebc8f90", "comment": "Malware payload (AgentTesla)", "value": "57bfa7e69c3ff4ab5966b733b9d22702d910450a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772676680, "uuid": "3f37eb48-e747-460c-9f95-fdc294f1db63", "comment": "Malware payload (AgentTesla)", "value": "0ac56c8c367a6972ec5e01dc9831970fca158675d0094f683f6234e0ce632a7f4149243ee1149db0a5e86ec82ee5234e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772676680, "uuid": "9c44db0c-372c-44f0-b518-872db9edbf99", "value": "T1BD451881FD19A4DAA0D7C64C332D3C269D61310DE743EE29A171E6C9AA2CB7647318F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772676680, "uuid": "875d2ecf-46aa-4d33-87f3-ea6f5b8cf69b", "value": "768:dTwQ56USKs3FpP5eUwW7IsWDUbWFLFOFO+Wh2PGe+kFmFfFmFfF1AFNFmAWSt8WB:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772676680, "uuid": "5a90f81e-6cb1-4ae6-9f3b-7fb5ec1fc7cc", "value": 1188868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772676680, "uuid": "f78dd7e9-3c3c-4967-9321-fe9e49e780a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772676680, "uuid": "0346cd20-e55c-4819-84d7-c698f746f10d", "value": "booking_letter.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e144645-188e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772713597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713597, "uuid": "3cd499c0-2424-4919-b919-feeb2c6c619c", "comment": "Malware payload", "value": "34141769bf86f9583b853e5fe4b86784", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713597, "uuid": "4b828ac9-0ae5-4f3a-a701-7aae3fd40366", "comment": "Malware payload", "value": "43dccf680d3f059389aab714cf9e6b04b8249ae173be671c2425c6df3335e0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713597, "uuid": "8aa3376b-77a7-4780-aada-f86634c2695c", "comment": "Malware payload", "value": "2feed3fd1e0bea853bf8fb6b84f75c9e7c09cb31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713597, "uuid": "94b1fa3b-c316-4d6e-bb32-f4d6b847298f", "comment": "Malware payload", "value": "c227b47ae3f1c718cfa08de339645e9b5f3e697f1551bd26a91fb567160388ffe9874d19668155ded7777a12060b3e02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713597, "uuid": "8042b8df-47a9-47b3-b33b-c10338003fe0", "value": "T11B2733CFC1707473F256F53E6211A1409743F9C5B291EE2973E083835BD6BAB79A026A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713597, "uuid": "bb3f8893-2ea2-4320-9bfa-f7a6c496bbe5", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713597, "uuid": "ea71f789-8f59-4fdd-b3ab-3e7a6ade2846", "value": "393216:Ys9vpxNhD5aZOfFuRbwrQy/OacEGV266DKrlvMFoObnlW9jA7WNcZejz1/pNDW:YsxMRA/OaCQSlvMFPlW1Aad1Ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772713597, "uuid": "da9585f2-c24a-4a02-9889-7507d460a4e6", "value": 21899656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772713597, "uuid": "a81f8e78-bd03-4c47-95f0-00de4e156fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713597, "uuid": "b2c6ef48-a6a7-40b9-baa5-fef281937c87", "value": "RV Tools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b3c3ab-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726743, "uuid": "7927bdf5-2011-4cc4-ad9d-38e99c9bb81c", "comment": "Malware payload (Mirai)", "value": "dd3998e7b9d5663bddb931f97e77dfe7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726743, "uuid": "d92f6cc0-1e7f-4e1c-affd-00e019138c38", "comment": "Malware payload (Mirai)", "value": "446bb989efc83080df6a9f93888e14d664d226980d5383e4dc74262a6c6be02b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726743, "uuid": "1b0133fa-e5f7-4e9c-bc9e-e0dc7ae9402a", "comment": "Malware payload (Mirai)", "value": "8b09d4c9eb7cdbdc45c4258a5f7d785b3035a896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726743, "uuid": "e348f337-a3bf-4f3f-8955-c6cc2ba8a4a3", "comment": "Malware payload (Mirai)", "value": "ab790637cd5bad1118a08664220fd9fd7645d54f2c57ab2b937e92a3c7a24f7757dc7e3c6ea5bc678c716fa79f7e2037", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726743, "uuid": "10af0105-a7dc-4bed-b140-d6e175682392", "value": "T103B3830E7E215F7DFBAC823987B79B21928833D626E1C5C4D09CED026E7424A741BB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726743, "uuid": "831dfed8-92b5-4801-b8e0-08ed0f6b71a1", "value": "3072:DVdkxv6gtgocFSFupk3JhLg+6BeCTyA6di9nD:x656gtLcF6upk3eBeCTyA6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726743, "uuid": "843bfe4c-ef57-4245-81d9-d2527487835c", "value": 116912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726743, "uuid": "8b2e5a9a-83ea-4392-b4fa-2cc1d6e47602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726743, "uuid": "f649ad79-d9e4-48e0-a271-d135027b917c", "value": "MMaaRRiiOisecTanee.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50eaec90-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772698032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698032, "uuid": "7b4b8b55-8324-4e30-a32b-c638fe23adf2", "comment": "Malware payload (AgentTesla)", "value": "655b7a86fd2b42589c9a4ff808e82b4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698032, "uuid": "6dcf9aee-6304-4a44-bff2-6ce21e8587f8", "comment": "Malware payload (AgentTesla)", "value": "44fc7d02421b1133674f931b5f6c25b161524d9ed48238fd4a1097033d9754c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698032, "uuid": "b834f186-4ef7-4885-a132-2fb521dce238", "comment": "Malware payload (AgentTesla)", "value": "91cf8faffd4fe02ae002136f070df2f63c80caf5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698032, "uuid": "8b5646fe-720c-4f47-b43c-58de6f107f94", "comment": "Malware payload (AgentTesla)", "value": "920ff028e2d2d6d581d24603147515e3dff98d09c07850972b3bd2b904acfc8f372c470c666241edb64ea822931a42dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698032, "uuid": "d85a3d3d-a916-4811-af8f-56de342f6da4", "value": "T10955AE121EA6F5D8277CC50A917F180BA2C64F8DE0D71F26A46868D4DBD380B4FDA27D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698032, "uuid": "aa8a63bf-b030-4cf2-a05f-3fbf4e02ba10", "value": "12288:eF+o1A+r/D7C8kd/evBdod2CUcwPcj65OlM/R8rMjDwGvsN:U+o1A+rvn6/evBdpCUAj65Oq/R8ADw6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698032, "uuid": "a4143ef3-f5db-4be8-8721-0077f62f131d", "value": 1402031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698032, "uuid": "06b00f4e-4ca0-4b59-8330-94c80b1fd22a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698032, "uuid": "ebafaea7-d504-4fcd-a73c-a79d86b35f0b", "value": "bank details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192709b4-1895-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772716407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716407, "uuid": "2d660c42-2b3f-41a4-8a36-e4cbdf950db5", "comment": "Malware payload (Mirai)", "value": "9c990bb2cf1e9b8cf75b2d0b86d15c10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716407, "uuid": "667aba83-2836-40a1-b0da-cc03169e1a35", "comment": "Malware payload (Mirai)", "value": "4623975a463058dd63a84b13e48362d7bdf1d347e06c9e74c9e72d0ebb8d6c63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716407, "uuid": "4964ec66-bf47-43e7-a7a9-f2320d5d416e", "comment": "Malware payload (Mirai)", "value": "12491ee69c5c5560349e27a2a3be0b428b4b56c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716407, "uuid": "f34a4b44-2f95-4820-83b3-f63c2bbeb7b8", "comment": "Malware payload (Mirai)", "value": "85cfeddb5b96f729cc96a79e13d75c9742c46aadd1fd926571968db4a4c647b8456f2a274043331fa9b6d96e47dfc90b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772716407, "uuid": "3f9bac94-c111-4d89-bf60-06e1a3eec1e0", "value": "T14304D719AB550FFBDCABDE3706E9070539CC641B22A43B363674D528F54E50B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772716407, "uuid": "51b9d7f0-3b97-47bd-a1b8-03b06d036360", "value": "1536:c/jMt1chsHcfnDq1etVfR0TKVzZ1paTEjuqvUNIx6Z8GhMna4lxVs8dpThT1Wtsq:wjMt5HW+0tVV6qvd6rUxVVpAKdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772716407, "uuid": "379204d3-b57c-4e4e-b3a5-eb1ceaed8db8", "value": 181852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772716407, "uuid": "07cab212-499a-43d8-91b6-ed6528ec1c0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772716407, "uuid": "3085ceff-0c11-4821-a1ef-77b547482c82", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed942293-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681545, "uuid": "77575e1a-2ef3-4848-ba36-b0160759cde1", "comment": "Malware payload (Mirai)", "value": "5bb9b079e58a41a690f9c7daf84664f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681545, "uuid": "6b1b6f3d-a850-4684-bf3e-f26a016fc064", "comment": "Malware payload (Mirai)", "value": "465fee7d62187232b4e5efbbd2d9f03e901585d5c31c2be8ce6ce37dcba6967f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681545, "uuid": "0ebf5f2f-42c8-4fb0-b056-da70191e6457", "comment": "Malware payload (Mirai)", "value": "7d85ebe29e3d4516edaa1405bc8b94e21d4867b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681545, "uuid": "89ec91f4-f48c-4b61-b7ac-4a3e6fb09e2f", "comment": "Malware payload (Mirai)", "value": "76b9a35142edd813969d565744c526e42b04c15b4e2c2d9120103322d3ebc6c11d3b3e33525dc8a73b1d0d94790b35f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681545, "uuid": "67d1743c-7ae9-42f9-817d-ab28f126d416", "value": "T1B2930991BD82966BC1E013BAE67E518C336677F4C2DF721BC8254B21778A51F0E63B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681545, "uuid": "ebf2dd46-1978-49e7-8713-c91c675df37a", "value": "1536:uXYtLGCVx9ddP9eTrDA2ptbtTLwIMXPvKzLbSXA6cw8sKrJfVV922XxdQVP75:uXYtLG+dvSpWPvm/PVxqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681545, "uuid": "41f450f0-2eff-435b-847f-50ccee24dc8d", "value": 93156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681545, "uuid": "fc70ed5e-4aa5-4766-a4be-9b47546f3389", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681545, "uuid": "ad40dd16-77a0-403e-9fa0-e5aace98ea4d", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb8b416-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697540, "uuid": "2ca16ed2-c247-4689-8bd5-44dfc4d6b077", "comment": "Malware payload", "value": "4bc3bae37d64a0ea03896f556feeedc6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697540, "uuid": "ffd52a0a-4a90-411e-9a9f-12f02e93383d", "comment": "Malware payload", "value": "4723531c96db3b4a7f960a30079dcd5bec76545a387b1d977b96da3258152676", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697540, "uuid": "72c1133f-b350-453d-ada5-69afe20602f7", "comment": "Malware payload", "value": "83624ec6de3480afa6d00bb3f74b525ade65b7b9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697540, "uuid": "d5ae0a39-5039-4a72-a9f1-8c05d8aeaafe", "comment": "Malware payload", "value": "e9ba84ad1b3976fae58e9e0a811238cec7581753ec69d8bf0f723aa59bb07d17385cffe1223ae70d60de6bd04dc1904c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697540, "uuid": "e7c3bc6e-69ce-4e22-82fb-49d2e58cb7e2", "value": "T11D72A52A8D199FF0053E3592B59BB81AA9600362B5383C5C3C5FD4AE3F76A14CFE10D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697540, "uuid": "b4e287f9-7229-444a-94c3-4c9566ce77f9", "value": "384:K1bZsKjew5jO6ulgyJkkcyhojfsm+0C9/Y6KnZVlabwpY1e:K1VXIVmRIUZnbY1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697540, "uuid": "92406175-2005-4f9b-b6f1-4abbddc60243", "value": 17347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697540, "uuid": "a5e16eea-4d9d-4b31-a5ac-1a471bc1db97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697540, "uuid": "94aa6ddb-3de4-4598-961b-af6ddf96a010", "value": "4bc3bae37d64a0ea03896f556feeedc6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c2a38c-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726735, "uuid": "06cf6015-05a4-4a13-a6c6-ce3ea3cf2125", "comment": "Malware payload (Mirai)", "value": "dbe3cff519ea9c61b36fc1045a97d9ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726735, "uuid": "7ebcb0f1-829d-4086-9437-1abbc75022a0", "comment": "Malware payload (Mirai)", "value": "489b9188ad357c045e282d9731004f84815fe8fda98caf569ad788369eae9e4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726735, "uuid": "2983bc44-0e46-4d13-afd3-3f3b68f08c01", "comment": "Malware payload (Mirai)", "value": "6dcfaf32f9dea332a66684959665569c4461f799", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726735, "uuid": "3a9e464e-98dc-48d6-a992-4ae762e60a71", "comment": "Malware payload (Mirai)", "value": "d4775a643f8b57375c4ca8b8b91c2083a9e63721e38b7cd3bb34694fe6ba46b0a657019a6a4cebd126b6646d25f4ebd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726735, "uuid": "97c2c095-b0bb-46e5-9e7a-640a0c577b55", "value": "T17BB3921ABF601EF3E8AFDC37499A2745249D180B21987B79BD30D818F64B24F55E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726735, "uuid": "99c5052e-bf7a-448a-b56d-9ff2cd8f93df", "value": "1536:SLCdg3QO5QR/fk4Yr7WuNHgQZMucjx/wDvFNsE1ZoxuP0Eib:SOdg3QO5w/c37WuNHpZMfE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726735, "uuid": "b2bef84b-5a37-432e-9cd3-0eb7869c40ad", "value": 118064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726735, "uuid": "a6732f06-f0e2-4f8b-b524-5986097bfa15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726735, "uuid": "442c1517-ad69-45b4-8dea-91a9c146f0c8", "value": "MMaaRRiiOisecTanee.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e690869f-1893-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772715893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715893, "uuid": "7755bd9e-1ad8-4c0a-a8ba-76aff91f4e85", "comment": "Malware payload (Joker)", "value": "6ed20e847c9fcf2153deb3b1d7738a6c", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715893, "uuid": "6f61af16-6950-4a51-9d4a-8ece47267c02", "comment": "Malware payload (Joker)", "value": "48ac386124c0ecd70e3d35e30510386ba61ba9e0972c076dcab763b500a5d4ff", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715893, "uuid": "42b4bbf1-703e-4eb5-8f44-4e852a4886d0", "comment": "Malware payload (Joker)", "value": "6b7d0c6364b3d3ea2c906cfa0052b71144625be4", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715893, "uuid": "cc917d31-cc00-472b-bc32-f639fff818b3", "comment": "Malware payload (Joker)", "value": "a9cc331a282aec84e1bb51d0020bd99e22844c96e84b05f20d790dc93868d6c275138a69b6faa2792d70259738742024", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715893, "uuid": "4613224d-a06b-4464-babf-b4a289648777", "value": "T19DA7020DDE0CE937DDFAF0BD8E9E029370263C595290C1652912910DFB936F54AA6BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715893, "uuid": "b3053319-fa8a-4455-907b-8b4539eab360", "value": "786432:VdzRFfrTseSCP/gLtu/3kPUX3kEYeR7/6th7o+0cBTcQ1OyaubhDJS:Vd9FMeSCHgBekUXsmWh7bJF1OYbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772715893, "uuid": "394a5884-ab8d-455d-8f7d-637ea1f8ecca", "value": 46609294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772715893, "uuid": "dd86e66f-64c8-4a5c-a8a9-42500971a7da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715893, "uuid": "5307286c-4b9b-4751-ab9e-cc89ae9aad8c", "value": "com.braces.icamera.hdcamera_2.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb5634f-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772694968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694968, "uuid": "5a0f6c2b-4050-4bc1-8463-a969b60c4394", "comment": "Malware payload (SantaStealer)", "value": "c52d3b1277f10a647e5b09b927443a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694968, "uuid": "c3db2384-3967-4c55-a951-54aca81050ea", "comment": "Malware payload (SantaStealer)", "value": "4a3ab120474879218b84e8be86f3243ae0500b6b65ad52f794413e6aafc9ecf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694968, "uuid": "341c86d7-6da6-45e0-9ee3-5d28103a1dbf", "comment": "Malware payload (SantaStealer)", "value": "9ad1fa825cf8a03f970e431bf596456a25985260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694968, "uuid": "e970218b-67e3-4c6d-b890-f95e9f787478", "comment": "Malware payload (SantaStealer)", "value": "75f8d089496189db49d446e5a9105d53293338cf59b4eea70bf7fbf35571f88da8731137ea4d480b03177c7f43a6b8fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694968, "uuid": "549289f7-fdbc-4892-9d5b-1043b7df3635", "value": "T1BA36337CD2478EA5FD76D0B294117581EBD01C35808B31A106F6DD2A366D3D2EBBFA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694968, "uuid": "bcfc9b83-4139-4ef6-9826-b44f5e66724c", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694968, "uuid": "04c51aee-afe7-4bea-9709-ce1512f649bc", "value": "98304:ZzLhROq1CtoDZ121J4dVDgyrCnxBA2kl2mW1fDypRtWe:1Fsq1XDC1JI4HnkI1fDypLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772694968, "uuid": "5455bbff-d8e3-484a-adb9-03cbdc1772ec", "value": 5160960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772694968, "uuid": "bddba8c6-0cea-498b-aefe-0ed1c195f5ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694968, "uuid": "ca6de628-cf6b-497e-99da-3bfb87d7b323", "value": "c52d3b1277f10a647e5b09b927443a03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8282d6c-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772707628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707628, "uuid": "f61d1b9f-0867-46fd-95f9-58d8ad28ac71", "comment": "Malware payload (Gafgyt)", "value": "aa29ea6a633dc750e32cfc3c318e1dcf", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707628, "uuid": "318e3b5c-8add-4b85-b321-ab2ede82b4a2", "comment": "Malware payload (Gafgyt)", "value": "4b825ded67b948cf9b26da13faf99d6cc091c20ea6a61395e6ee01adfdd16be9", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707628, "uuid": "311c248b-7c8a-4465-85a6-fddb202e4ace", "comment": "Malware payload (Gafgyt)", "value": "3e68ce70983cd24143d6290220d53bde48ef2d72", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707628, "uuid": "77b3f8b7-7fac-4626-a3f9-2c7b30cfcb93", "comment": "Malware payload (Gafgyt)", "value": "914c1fff58b42490b33964e58a9b86ea18a6864cd16493f296ca73b3f163b23dcb515e7ec257259e88961bc4dcde45e9", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707628, "uuid": "886c5709-9f98-4458-b720-c344f0dcafd4", "value": "T19E13F174D68C5036CFA10D73E5AE8700B77B41A892DF31B3162C87D9ABB21525EBE2D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707628, "uuid": "de6335ec-ea71-493a-ac6a-259d9977d84c", "value": "768:5jT+YGufoPFYgEc+OL/if7Pwvyd3685TuvLmjjQOHeHi1zLfoD3UK:BbGJmPEvyh1HQOzbov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707628, "uuid": "12c279a4-72de-4e97-8bc3-b91bc73c06c4", "value": 42464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707628, "uuid": "dc3016db-3b77-45f5-b7bb-fdfd9f9d0314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707628, "uuid": "b3498f8b-4d52-4445-9ded-b0c96dd0a50b", "value": "5r3fqt67ew531has4231.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc417daf-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703420, "uuid": "67289fa1-0713-4521-a4c7-c9a013e1b9df", "comment": "Malware payload", "value": "b58f486faebae6cdcbf4c77a8a9230ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703420, "uuid": "06530df0-5aaa-4ae5-8d18-f46dd4edfebd", "comment": "Malware payload", "value": "4db5989204b5d98f8ddcfc7216c3f104e5bb8e5ec8f322b5ad6886011d1f1118", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703420, "uuid": "5978516b-0c0f-488a-99fc-ecd9d7770867", "comment": "Malware payload", "value": "50aef6f31cd1843882c2ad94bcf681be1c97abc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703420, "uuid": "31b723b3-87f4-4323-8294-47703be470e8", "comment": "Malware payload", "value": "c8c697a1052073712b22354759ab95d260da2d34fe77f5988f8ce68534f2a14b1d5ddc92265b76d15be5361e42da3754", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703420, "uuid": "49feed1d-d1f8-48b9-abe9-7e9c2f96f1df", "value": "T1820733C7F507DEF5C3D5D0F428E0D7952271A02BC6130AB26A45E38AEEBA3A51FD1981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703420, "uuid": "56c4a7ac-9c26-4f39-8eeb-37a8b3d7f60d", "value": "393216:1Dfc39/iPqXPHCkHFDlcugmERcS0nc77YeiD526BPDmmERcSn:1LwWkHJlVY0Ph5D2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703420, "uuid": "9f3eb8cc-b0cf-42f2-acf4-0623bdcb3961", "value": 17235968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703420, "uuid": "8026a58d-daad-4876-a1c7-0ff4ba8a0c12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703420, "uuid": "35932490-28f1-46d0-b126-bc023dc8a367", "value": "pqXRAoII", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff85221a-1897-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1772717653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717653, "uuid": "6fcb862c-e23b-4b5b-970a-b1fa8cee6724", "comment": "Malware payload (Phorpiex)", "value": "ab6467f131c74c1dd37c781a82a00140", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717653, "uuid": "1591aedc-8ebb-4424-8978-3c72dcb7a31c", "comment": "Malware payload (Phorpiex)", "value": "4e6463620c3c1a001e7fb411bbfd7ca9f2b5bdffe0a84bb964b6fd5406bb232a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717653, "uuid": "97adc5a5-dfea-47da-a4a3-b721668d93cf", "comment": "Malware payload (Phorpiex)", "value": "882ca1c9619683806bd1a701baec479ff005550f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717653, "uuid": "20bbe98e-1589-4f8b-aa55-4113905659c6", "comment": "Malware payload (Phorpiex)", "value": "c9340d24aa9ef43f267ffa09518a80110fd048492f26fa8895200f4a0f0a39bad295e054a248bc43ef4f930c4c7be437", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717653, "uuid": "c9f91d1a-7246-4c73-ba2f-1661847c5d5f", "value": "T16DA20806AA865346E4B1187553B72E356439BE36235D50CFEFD00A392174EE0FE3739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717653, "uuid": "66cc314b-b881-4f9f-99f7-8d74ab49ed10", "value": "d0f945da54f20d8bcaf079f2d6ea9f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717653, "uuid": "7d4184a7-1d4f-47b1-aed0-c84e981f910d", "value": "384:Au1OuP/oADDqPUaQFYhJ4JVB0W/UnwnR:ANuP/oAHOUaqY+x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772717653, "uuid": "530eed78-69e1-4366-a523-33903ee94104", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772717653, "uuid": "6bd8bb70-51dc-4a2e-aa6e-7dfb75791bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717653, "uuid": "2b592251-a3b7-499d-9f84-820d328f5023", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b37934-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772698010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698010, "uuid": "a0e58c17-2ac4-4615-b836-3650cfa76bcf", "comment": "Malware payload (AgentTesla)", "value": "939a1b8e79423645121e1a547e920e19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698010, "uuid": "45e6271a-1828-4fd4-bb30-1074e1d5d540", "comment": "Malware payload (AgentTesla)", "value": "4f0f7232dc36c768cd481ee494acc71c1de3581e46776d2ab6707ef8b225a3e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698010, "uuid": "1c91de1d-6732-4c50-8f22-24d8e6b45176", "comment": "Malware payload (AgentTesla)", "value": "cefc5e2ae40ca2e26b9a09024b913575f95bec00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698010, "uuid": "75b46186-8486-4717-9ce2-bffd4f4285fb", "comment": "Malware payload (AgentTesla)", "value": "abbef17b91aef2f82fdc8abec66b6c49b5c105be12813c4ec1301feeb46edcb46f4676c6143614356bd279c1350e4f71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698010, "uuid": "305a74ad-a8cc-47b1-9901-adecfa89c1f7", "value": "T113163C60F485C6843C232D71F798789149EA55FB2D86B202E01F67F5FBEB3C2AD61216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698010, "uuid": "c89461aa-4955-48fc-8276-3c37f26c0025", "value": "98304:7KE86X1xS28JoAlwA0Ht5dZYCk5L32dxh6pPGd3kDzE3Zt4RUzBSNxeBptfRoYbt:7vni2FAlw1t3ZwLG5GPGFOzwvWHNxeBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698010, "uuid": "5875cee5-25fd-4551-b200-90338dde5445", "value": 4183709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698010, "uuid": "54841b72-127b-4ee1-9bce-260232a4047d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698010, "uuid": "64647224-2bf1-4d2f-9a61-ba5f8afdf0e7", "value": "Product List.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7285548-1860-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772694016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694016, "uuid": "d12003e1-6b24-48d9-8509-81384460f74c", "comment": "Malware payload", "value": "8c5ae5bfa95c0911e036045c7169af0c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694016, "uuid": "f0aeeedd-17ec-44cc-80a3-5375f1100975", "comment": "Malware payload", "value": "4f79f55cceb663d09383de8e4f9e180207b1308223ea700368907ee101c51d6c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694016, "uuid": "e7a13e47-76e1-4e34-af87-892b29ea016f", "comment": "Malware payload", "value": "eab137494264253c8ce0508970fd6d2aad412e4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694016, "uuid": "b7f47832-307f-4221-ae15-414bdad62bd4", "comment": "Malware payload", "value": "ae2c4a597b977ed0d7a247925e00e03a7b7cbfbe9d341766483fe23cc3d6496520242cfa81fdad04ad3ba2fc03e77a3f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694016, "uuid": "d196a8d6-da4f-4d09-a83a-f43e1e19e58e", "value": "T1F951F0F4F430D8B33F0E0CB4A5A65DA83A63565F11792C24714389B5C0AC6B872BE2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694016, "uuid": "d4ee2bbe-2a89-47a0-8b0e-6883aee34a98", "value": "48:UC/X6MEWd5jqXS0BTNt7cFLEuYJahIhcojjuFvmZFGuZFmJ579p1QNtA23m16Roy:n6vWTjqCQ0V0Dju0O579piPVb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772694016, "uuid": "412f2d66-18d1-4d62-b8e2-c8ad7d348526", "value": 2787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772694016, "uuid": "43cb0e55-9134-4d69-b88f-fcc55b39749d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694016, "uuid": "1fd45ee3-a234-4c9d-ab21-b74fefd92fdf", "value": "ac89f59b0a770d0230ed5a948248e6dc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630d75e9-1887-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772710518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710518, "uuid": "c9d887bf-3203-493d-a91c-2d15a6ff8567", "comment": "Malware payload", "value": "ed4f6c70880a02763866826d5532f859", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710518, "uuid": "72bd8308-301f-4bf6-a2da-dff5da4fe401", "comment": "Malware payload", "value": "50d0bc51d3da3b76f89bc455bdb1f99df3d0bbdb38c2b85f6afcabc97cc831a7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710518, "uuid": "2b4a4a6e-f538-4064-95c1-1108a63ca681", "comment": "Malware payload", "value": "39719b1ab2cea9a3a0fe2daaf98edc812e22468b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710518, "uuid": "47587087-eedd-4111-80b9-4179d2e72c0c", "comment": "Malware payload", "value": "63f44bbbdddefcf7180db4e2e09357a9a316ed887cbd0df1ad904298b7a3150ca09c8bcaef458b45b1e10ccc8dbee160", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710518, "uuid": "7466b984-af2a-4893-ad05-46c94714f53f", "value": "T12D0623137C85C139DC3219B1CC8F9EA51E386D707E520947B7A67E4ED9B1B809B2732A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710518, "uuid": "c671a31b-27cd-4cba-84ec-f29440130959", "value": "49152:cZr3+qkejHzM+pq8kB3R4SKkyMZVJOdjLrx9gigzFUgudmWg7I0nS0azEHvH:i77o+pq88JXsL19gvGvk773FaIHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772710518, "uuid": "46230f58-63e9-4031-9da6-b6fdd7843468", "value": 3832320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772710518, "uuid": "7a27b1cc-d968-486a-a08e-4c28ba3fa75c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710518, "uuid": "cac5944e-30ac-49c2-bbfc-93178a55a383", "value": "install.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37dbc9b3-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772697990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697990, "uuid": "31cad615-11c1-46fa-a6b0-d2bd09e6494d", "comment": "Malware payload (AsyncRAT)", "value": "c3a40ab2c4cd170ac18100539ec05a0e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697990, "uuid": "a1c13176-ce50-4877-bc4f-9e62b8a8fdce", "comment": "Malware payload (AsyncRAT)", "value": "5140b02a05b7e8e0c0afbb459e66de4d74f79665c1d83419235ff0cdcf046e9c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697990, "uuid": "d38ac252-582e-4327-b5bf-b9561d87e906", "comment": "Malware payload (AsyncRAT)", "value": "5bf4c5c84812af4153845a23c1759b962cfb3697", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697990, "uuid": "f608ceb2-4a98-40b8-b03c-45534c02f795", "comment": "Malware payload (AsyncRAT)", "value": "bcbea54dffb7da1b8e416bb87672a0ed378723f2151b03f808cb49b6d5775f96f07aa3fa97f6729f9320fd8d874959cc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697990, "uuid": "f4941969-d76c-4ed9-b69c-7415c828c7b1", "value": "T14384D070BAC17F54F758333A90BE5418A67D0E48762505876732F6CDB7EA30AA217B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697990, "uuid": "967b9d43-3cee-4175-ae07-e8e33c1b75c8", "value": "6144:iDQkqlqWH2Ve5mWZnLUSgEWUC74Kg8/d9GgxMFSboZQuAF4:i/rWWQB77SvG8bIAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697990, "uuid": "1bd786bc-eed7-4cef-8fcc-66e4ee6f30e4", "value": 393283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697990, "uuid": "f43cccf0-d28e-491f-9e4f-04ddf251be4a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697990, "uuid": "820cf438-7e05-4022-9240-c093e5ce2f9c", "value": "c3a40ab2c4cd170ac18100539ec05a0e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d90cc2-1868-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772697314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697314, "uuid": "230b7f06-daa2-4685-a4db-fb51e840c561", "comment": "Malware payload (Joker)", "value": "c01b012d2b0693385a6fa799a2183b9d", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697314, "uuid": "68365919-7e51-48e3-899a-e431f6f29de3", "comment": "Malware payload (Joker)", "value": "516ce51db59f0e21d0e998ace83007603a73e5edb09fdeea7d27ef0f5918776b", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697314, "uuid": "a77a2242-99c6-4f87-9c0f-11086dcdd6ba", "comment": "Malware payload (Joker)", "value": "72eb50750da4330414b9cf5f3d8f34a4d2fc9793", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697314, "uuid": "695906b0-d5b8-4c3e-bf3b-532d5ce4ff77", "comment": "Malware payload (Joker)", "value": "a1d4ed42eaa8eb07412442a792caaa6d582a7b38ff2810a4479461604c2b5ee09aa97b30c658cc25fc96e67c9ecc8a6c", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697314, "uuid": "46269ac7-3efc-4e07-bd36-2ca0e607bccf", "value": "T109B7F115FB0DDA2AC8F6B1768CAE03653322EC595F4283AB4501B12EBCB37E45E197D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697314, "uuid": "9fb2346e-08b2-4ebf-9a96-fa7962f40aef", "value": "786432:bUPGiYdc7SWvlguTenaSZgfuHSeHwvRKVfaj1aiJE10uf1R:AP1N76qwa+yeHwvRKVfaj1aPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697314, "uuid": "81cb444b-372d-4ff8-89dd-a07a365dfdbf", "value": 48199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697314, "uuid": "ba541c16-fb0a-498d-babf-2871d8144afc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697314, "uuid": "b2a94ccf-8731-4a7b-948c-ff5aadd96f58", "value": "PDF+Scanner_1.8.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1ee6e8-1878-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772704175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772704175, "uuid": "e519049f-e1cf-4778-a72c-0acfbf26383e", "comment": "Malware payload (Mirai)", "value": "2c708ea0ffef5fba3a03c3d12b9157ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772704175, "uuid": "5d01680f-e49b-44bb-99a2-e6e96ef40a14", "comment": "Malware payload (Mirai)", "value": "51fc022aa7e53b9fe16f255bce7c53c3887300b0e564775b3b7a7ee26689b9d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772704175, "uuid": "9ebd6a00-a068-4d60-a39b-24187b68f7c2", "comment": "Malware payload (Mirai)", "value": "35bbee9935b7d7d0f15d73f496d15a5966e5e404", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772704175, "uuid": "aa63a158-da5e-4453-8920-c33bb592b1c4", "comment": "Malware payload (Mirai)", "value": "3d7402676398bca9e6878eb7bb5999c1086b313dd3fd61ae0ed1d994d05b501347f9d8993dfd6aa6d49fcd4109e2aa0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772704175, "uuid": "314da9d2-adeb-489b-a45d-23ce755e08ec", "value": "T171B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772704175, "uuid": "94ad06c4-9842-4c82-9359-ec6c25681d79", "value": "1536:L7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxQ:3zPqF41OUBljSIxecUtCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772704175, "uuid": "fe81063e-9e55-4217-935c-97343dcc730b", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772704175, "uuid": "9bd45f30-b62c-4b08-bf33-b78ac511d464", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772704175, "uuid": "0b2af870-4c25-44ab-a5ab-f918afd72474", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33a7a43-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681554, "uuid": "932e2323-3fb1-473e-b310-debb7d938d2f", "comment": "Malware payload (Mirai)", "value": "06fb6fc5884010e2e5ef83f08fb1dd9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681554, "uuid": "97b3399f-49bc-4ddd-b71c-85071775145a", "comment": "Malware payload (Mirai)", "value": "525b45def6c1789f6efc8f99a54b56f88a8796d67e36a14667f0047e2b3ddd86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681554, "uuid": "ccf40b69-19dd-4642-85f1-5e16e16c3b6c", "comment": "Malware payload (Mirai)", "value": "603ebf05ebd361371591a96917bf888374aff3a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681554, "uuid": "df1c1ce3-ef64-44a2-834c-2be6908be52b", "comment": "Malware payload (Mirai)", "value": "3f3cfe9de320e8505f6e86ead7ca9c36d342c244f3c6d0b007538f3321cd6926d9b3d7be9e887295dbe56b2d37492817", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681554, "uuid": "f74f8759-0a6b-4b28-b72f-eb33106d4e5e", "value": "T137440806BF510EFBD8AFCD3B06F9170625CC651B22A52B3A7634D918B50B64F0AE3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681554, "uuid": "2c2f9d4e-669e-4f4e-9449-76ba4cc907fb", "value": "3072:XVi5OPMWIZxBeaPHq6Wlr7dQHKjZsf1ndwJEIIKJ17i9TRJI:XVi5OPMWWIaPHq6g7uHosnFIN1E3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681554, "uuid": "beb08d8c-d29a-43c9-a49e-0420b11af5a8", "value": 255892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681554, "uuid": "fff0e64c-6e03-46b3-9246-edfc6f3b136d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681554, "uuid": "7d7f1594-e2a0-44b7-b2b5-a98e987c35db", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4f8fee-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698048, "uuid": "43beb6c6-40c2-4462-ac22-369b8e8b0a18", "comment": "Malware payload", "value": "9c56c20f7bc0b0e15c7e8a7245bd4cb6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698048, "uuid": "09bf4945-bcbc-433e-b265-184531a597b4", "comment": "Malware payload", "value": "5413c942cfc5b610fbc4010b1d3f9dacec1bc80b81f586a43952832d9280b22f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698048, "uuid": "148b5070-3c7e-476d-90f1-a152d51e18bf", "comment": "Malware payload", "value": "78d33bf22afe493fda33a49997fa5c6221a067f1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698048, "uuid": "c125152c-65b2-45b3-9bf1-22bebe79960d", "comment": "Malware payload", "value": "843caae5a9240e5ec8a9015d0ef4d270e2b76d106078aa5248e2999bac413538930625a073aa62df29cdf4cfe61a66fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698048, "uuid": "762262f3-bbe9-4dce-8d2b-11f5ec270601", "value": "T1CEF2087116193FE947992CEA8427BDC52C493F4BEC3444AC43ADBB8A8B357811CBF586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698048, "uuid": "7e5584e2-6829-4fb8-87fe-7820713f0431", "value": "384:5zmmCMN09dAknOhW4umyrtk/kG/FgCtmLvzniIV:5aOOdAkeet3G9JwLvDiIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698048, "uuid": "1bc7a50b-4ff6-4238-b6cb-8fefdb965e67", "value": 36011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698048, "uuid": "76d188ae-2992-4374-8446-0c4996dbc07e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698048, "uuid": "dc0cc429-e167-49ad-b65d-a4563e4b818f", "value": "9c56c20f7bc0b0e15c7e8a7245bd4cb6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4fafe5-1855-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772688930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772688930, "uuid": "2d6bf898-31cc-4d7d-9804-bf40cfdd5144", "comment": "Malware payload", "value": "82de35e133dd4936f3a8b2a69b30c9a4", "object_relation": "md5", "Tag": [ { "name": "filebulldogs-com", "colour": "#CE9CE9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772688930, "uuid": "3f512213-c5e6-4c87-bbdb-ede54e4921f7", "comment": "Malware payload", "value": "54ba437ef06386043eaefe9fc5b45f8eb774f4d53d9cd646bb9b37bba0cc9dc2", "object_relation": "sha256", "Tag": [ { "name": "filebulldogs-com", "colour": "#CE9CE9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772688930, "uuid": "1a594d47-88fa-478b-97b1-b80b8054df1b", "comment": "Malware payload", "value": "a50dde0bafeaf2b6cbc7a25da145fc4772a76b66", "object_relation": "sha1", "Tag": [ { "name": "filebulldogs-com", "colour": "#CE9CE9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772688930, "uuid": "adf21766-acb2-49ae-826b-11cf8f81392f", "comment": "Malware payload", "value": "7c8192943d6c02f0aaa4a162003b6c8b04b0c55768cde605f915148d5b07214dd8690fc126fa2b8dc7f51da50d49b9f3", "object_relation": "sha3-384", "Tag": [ { "name": "filebulldogs-com", "colour": "#CE9CE9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772688930, "uuid": "5b75df4f-9613-4265-9299-79d424209343", "value": "T1983733FE2E49D2ADA8BCD0A0C9C0188DC45D99CDDCB2B4324037DB875CE78DAD2B6655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772688930, "uuid": "fc20ab77-4582-4f3a-9ae7-ce35091d18d4", "value": "393216:nGP52++muB++P1EZqFe254CUvI6Po7XaxQ2Fl4FtclIHFJhcTTgYBrFjEO51zUPl:w53poYqFeEUA6PjQNQ+Ph6cYBp/yqIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772688930, "uuid": "8bce14fa-1ecc-4a7e-a40d-eaceb0d85c07", "value": 22667359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772688930, "uuid": "6806f85e-9ffd-4ea7-9537-359fbabf60f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772688930, "uuid": "e0cf3eb9-c509-45ab-901d-7996ae2c4054", "value": "a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c278242-18c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772737511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737511, "uuid": "4f744209-74af-4027-81a9-b214fe2dd651", "comment": "Malware payload", "value": "e362412b15c861b187fa0762ff5c5581", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737511, "uuid": "b5db9047-9494-483a-9f74-f7c46ecc543f", "comment": "Malware payload", "value": "5501dec4aed51de2c33ca105f5897cbb73f4d65e32b239877a30db918c7c2fea", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737511, "uuid": "49d92447-fb88-4c73-bfa6-980f5d44e8ec", "comment": "Malware payload", "value": "5d4e84925cefa8e972b4283f7046243cae81cffc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737511, "uuid": "a65e74e0-9043-4d18-b944-891dff325df0", "comment": "Malware payload", "value": "420033a4fec3e7f668f0f4d9bcd972da88bd972de7af0f28170372bd1fb8d9ac72a977fdf3b4a977036fbf58a88562e9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737511, "uuid": "ab86c4b6-9654-4209-a714-263d138de169", "value": "T104E41213A396BEDFEC0747765CC50881910FACA14B1D841B3982B35B597B2F3B6A276C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737511, "uuid": "15e5b273-797f-4b6e-b837-26d3c95802a9", "value": "12288:2X3GhNpuLccGf/X3GhNk7gZGThkTuM7IE2Kw+ljhorw:2XeuLc3XJ7g4k6M7IxKjlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772737511, "uuid": "43ff2dc1-5b08-417c-a40e-4ce0c3cb6540", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772737511, "uuid": "0c9182e6-4730-423e-844f-a2c1469d5f7a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737511, "uuid": "a6a876d6-ba35-400b-a775-63b2bcdf3331", "value": "e362412b15c861b187fa0762ff5c5581.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f30a954-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697573, "uuid": "25a4935b-3679-436f-9f22-a855b7a711a1", "comment": "Malware payload", "value": "7965ed2a2f2e28c54b582c224f5cee19", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697573, "uuid": "b16de3b5-aa50-49e1-8256-579cb0551e95", "comment": "Malware payload", "value": "5583e2a4d20099931da85dee9e423858d0f8beb0453b1cbcb4b3d206f7a07591", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697573, "uuid": "035f740e-9ffd-4da4-9608-017c8111a519", "comment": "Malware payload", "value": "03873798892b70e80a446cc0eb8cbd1c2f623a4b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697573, "uuid": "f022647f-1891-4bb4-84e4-001904a7a5ab", "comment": "Malware payload", "value": "d779b1d970e6c0e7957068fb254b259b3ee7e5b5a03576f3286860518d4efdea3c11512b84ffd6f628630b9619c5b6b8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697573, "uuid": "feb41ae7-5fdb-4301-b2a4-63f592995e00", "value": "T1B011CC01DC0269E75E53B6E8CA130A18DCB9FD3B4066A84CB310CD492E359FCB120BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697573, "uuid": "de8138f4-d8d3-48fa-b02f-54f19a9af31b", "value": "24:KXnAKqahwAq3wc0K5NU9RGUimUwn/zii9nJswC9KVk6Uwn/zii9nJ7wC9vZ44:NBr50YNIGfmdJJC9KVk6dJkC9hT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697573, "uuid": "144d1161-63cb-4b62-be5d-5a7a56c1ee04", "value": 1102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697573, "uuid": "23bb3a1b-625e-4f51-ba83-ce9265deff0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697573, "uuid": "96e6fe8f-39e3-49c8-85f0-0e5b16ee463f", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f921567a-18d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772745989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772745989, "uuid": "474216d3-0200-45c0-8ce4-244ee6f50cf9", "comment": "Malware payload (Vidar)", "value": "49953eb3b01850cb69f383be8c2a2353", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772745989, "uuid": "aef44a27-7c68-4067-90f8-55a2506a129c", "comment": "Malware payload (Vidar)", "value": "565cf2b3dc6ff362b1f77757f83770d429ee3ccdac1d54bcb4fcb5ac646d7486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772745989, "uuid": "2d71296a-20c0-4020-97fa-574db1994fb1", "comment": "Malware payload (Vidar)", "value": "8aa598231b12ba5b2d87af83cbbb109cf7f1312e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772745989, "uuid": "cb5cc7a1-f115-43b5-ac13-ceb4abe366a9", "comment": "Malware payload (Vidar)", "value": "23dc90479d50e131de6f46f03615640c3efeb47bd470b56d9a98c600a7a69f4aeeff1c0a83e20f82960d8aab2e01e7a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772745989, "uuid": "3ed185ec-1682-49af-bc72-9b8669f5bfa3", "value": "T125D6096B66E34E69C13D813AC0A2CB07A4F370B91F32C6E7B39103681E555D74E7A927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772745989, "uuid": "b80593bd-1c35-4485-ace0-52fb3e25f353", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772745989, "uuid": "e39027a4-9645-4ca0-a190-6119e3a5cc12", "value": "49152:ptD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUo:ixGLEUp9VDFtwdOTAoujuddQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772745989, "uuid": "8b6d8430-bd88-464c-8259-cdf722b8cd97", "value": 13841408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772745989, "uuid": "33b6da24-3ffc-468d-a842-29e3249cd1ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772745989, "uuid": "689c5836-11ac-4210-9647-b9312a73c600", "value": "SecuriteInfo.com.Win64.Evo-gen.29177265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98173be6-18c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772736377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736377, "uuid": "53998923-1315-420c-b2a1-84db3baea1b7", "comment": "Malware payload", "value": "1bb6d21c5200e2084a5864171b4fb522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736377, "uuid": "120ad7ff-6f1e-4a62-889b-cad5fe41034d", "comment": "Malware payload", "value": "56ef58e355e591a2e9766c64af6f0d3fe4f33194c138e04b9cdbb6507b5be3fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736377, "uuid": "368ff5dc-99f6-48d6-b539-112dcdb22577", "comment": "Malware payload", "value": "5fb9b50d6161958b1e3fdfe17be94ea1db16abd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736377, "uuid": "78457744-9118-4730-bd78-ca5ddb1be8ff", "comment": "Malware payload", "value": "48bff5109daa5b75565350da2c1dc28334c4a64ea1e3d0421b65550d58a2079b3cc4898ff40dacb5bddd442ba0524f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736377, "uuid": "09b655dd-6f01-4b46-b760-2b9a43ba2901", "value": "T1E1D48EA6B7634E20D1481337C08BDA8197E59746A9A3F74F718423E614023EFDE4A7E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736377, "uuid": "59eab79f-0be7-496d-b2c7-c9beddff8871", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736377, "uuid": "2e31277c-eb9c-49d1-9851-97e305d1be21", "value": "12288:E/7ajwRvRaHWH7RUk2jmKXSS8E3hf1j1ygaJfGhiGiwg:E/W4RqulU5jmhEZ1j1/aQAeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736377, "uuid": "15754a60-5e9e-48c4-8d5d-b2fd80927d3a", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736377, "uuid": "3f720590-1fc6-4640-b624-82d7d0678a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736377, "uuid": "bb093241-93ec-415b-be5b-95b9e6f49c61", "value": "1bb6d21c5200e2084a5864171b4fb522.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbac61c8-1862-11f1-a769-42010a9c0008", "comment": "Malware payload (Emotet)", "timestamp": 1772694775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694775, "uuid": "dc2143c8-a635-49ce-bfcc-cce514e7ebc8", "comment": "Malware payload (Emotet)", "value": "0ad99d6ee05634ef71fa11020accffe6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694775, "uuid": "632c5b1f-7033-4d26-a53d-cf44fb5c847a", "comment": "Malware payload (Emotet)", "value": "5726b610b8df672e55f1368d32327b9c93fbe4734c3ded8307a4b4d3b927b9b1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694775, "uuid": "32cc11ad-364d-4221-a0fe-0116104b577a", "comment": "Malware payload (Emotet)", "value": "f6483bf86c7e55b0db1aed5dcf2b083c6797961b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694775, "uuid": "59a109e1-b1a5-47cd-a1bc-193e2d98ae81", "comment": "Malware payload (Emotet)", "value": "0ecfef00268a0a35b4c60500ada7300b8728f4a692122b3d309622321d88876fe6e264577ccab18cda60b7a2fc31d8ca", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694775, "uuid": "032ed1b3-e01b-406a-ac0f-f92ededf4045", "value": "T164B6BE97F16A2FC6E227007ADD721687E12428A44F05DBA7B09DE632F7135A02FB570D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694775, "uuid": "49060607-54c6-4f03-b98c-1e76ee8fb73e", "value": "23612bb4e22cb0d3ce43e1f4bcba3008", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694775, "uuid": "7e572191-8761-46a9-94e7-1578cd653248", "value": "98304:6IP1CAjCrmT3uG6+oQODLBhKlt66gVw85IuEbx0/LaIMXYEut7U5bc9sF1dn+Gg+:tP1CDC3zxmLCgVDrf6uabc2DdCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772694775, "uuid": "e9eccf2f-1f14-433d-addb-3919a854c7b8", "value": 10880512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772694775, "uuid": "19e90c03-3b2e-4806-b07e-e6000bbbecd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694775, "uuid": "a7fb6112-caf1-4058-9d29-cef10483fa25", "value": "0ad99d6ee05634ef71fa11020accffe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710d9cfe-1875-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772702811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702811, "uuid": "c1ea4462-2cdf-4665-94bd-2df679b46b38", "comment": "Malware payload (Vidar)", "value": "9a110bed6adf3268a8d93126295cd66e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702811, "uuid": "9a6540e7-46ca-4402-a6db-b6cb71564b17", "comment": "Malware payload (Vidar)", "value": "57afc48ff9ac50e393ddac96b914fec560eb0854787262d35a003abdeb913784", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702811, "uuid": "c2fba6b8-ec5c-46f6-9a77-e7919ec42e9d", "comment": "Malware payload (Vidar)", "value": "37945b7e6898c5890b1dbd7723d19203bbc10ecd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702811, "uuid": "5edb0fd0-eadd-48a0-bd6c-0f607c4396c7", "comment": "Malware payload (Vidar)", "value": "d2b8bf234d1f1568caae9e8743326098d41d497caf1e2d284ba1d2746f895822bba7506f89e6944a664f02f9d68d23ac", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702811, "uuid": "96ff2f44-adda-4d6c-ae0c-d2b67807ee98", "value": "T1C4A6F5AB26E58168C019813AC05E8B01D7FF75F4CF2E82D3CE53072B9A615C55D3AA6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702811, "uuid": "6f0d1568-4c2f-46cd-93f7-63976bb8ad41", "value": "c777c0958f1392e5aefc182510e58608", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702811, "uuid": "4049d559-94e7-4898-ae24-d422c281443c", "value": "49152:0sx2id0vJ038GaE05/uzdQ/7KzsSwFYlPZPyen1qFxIjPpSCoeoqHkRAPKsiO+FX:LDqMPNoeoqERHsirF1C295mR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772702811, "uuid": "a7a720e5-5db6-4e6e-afea-a975a32193d5", "value": 9854976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772702811, "uuid": "e1b564f3-9e46-4e41-b075-0809d5b529f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702811, "uuid": "1fa5a5f3-14f4-4e50-b479-f4fd238b3f3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8beae285-18da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772746235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772746235, "uuid": "5db6f2e3-2623-4bef-b45b-2fa55e260149", "comment": "Malware payload", "value": "0ca1ab4a6816463733a0b6e634503eec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772746235, "uuid": "421d49dc-b1a0-48cd-9884-6e9f73506afe", "comment": "Malware payload", "value": "58a84e7f892cdf58116e79555debf2e2a30daff8158594ca770ddab845237576", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772746235, "uuid": "0e20f7e0-946a-4675-813b-1cc346d4ad36", "comment": "Malware payload", "value": "6e4605f2e35f0bcf3033afe2548e433012fa5bd9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772746235, "uuid": "699e4853-d260-427b-9e5c-77219e6c9c09", "comment": "Malware payload", "value": "9cb9b1febdde1a29e0384215c250c10f039fa138a1bca5a9cea8cbbef1b9cbcb1565499bc65b3694441a35666009793d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772746235, "uuid": "625e63a7-022f-4864-8837-0d5ee738bf59", "value": "T1FC925CB512896C79FBD0CE399F3C6F4DADE882C42124E3ACBA0F39215A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772746235, "uuid": "ac42662c-f273-4467-94d9-fe893da315a7", "value": "384:PscuQpWx+BL0SWL0gAzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:Ps8i+BL0SI0bzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772746235, "uuid": "8629a57b-512e-4400-be0c-291fa7317a4d", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772746235, "uuid": "eaffa4d1-1efc-40c7-ab2f-d4c2781f66ef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772746235, "uuid": "e1baa337-9d14-452c-9b22-2bc01c912eaf", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dbf984-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703441, "uuid": "be56671b-f496-4d20-bd98-f416b988fdad", "comment": "Malware payload", "value": "747c1c5c9b5bce9752965de12b5a1e97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703441, "uuid": "6b8107cf-bd26-4cfd-9167-08257d30d6cd", "comment": "Malware payload", "value": "5a0ad9c6e04897fff74fc9c0a2cabcd62115335c315d3c9b64c82641867f43c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703441, "uuid": "6fca58dc-ade2-4a53-9df3-e32afb48b632", "comment": "Malware payload", "value": "4fd9a5f1992b401970dafee65a9375c16aa9996b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703441, "uuid": "b7e29bcc-5dd4-4b2a-98fa-aab28174b094", "comment": "Malware payload", "value": "6002bcd9b35b6509e1cefab310a5e646cee10b249ded9a22a67b5f4f5630de80a9bff08e796634746446796c0454e8ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703441, "uuid": "20281fbb-09c5-41d6-ba11-b40cd436da8d", "value": "T158B5F857E49590E4C0EEE174C726A213BEA13499073837E36FA197F11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703441, "uuid": "7d28c95c-5a0b-4efb-8bf4-795f56df0f59", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyB:cqYUQuVDt0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703441, "uuid": "10c274c2-2e43-45a7-aef1-9cb3284e22af", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703441, "uuid": "f478f2d8-ac29-45f8-b269-7430d13d4449", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703441, "uuid": "56c9396f-4e0d-48af-aa78-bba1b3625395", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262b018e-186c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1772698820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698820, "uuid": "ab2259f0-311b-456e-ad7c-db3f028c0581", "comment": "Malware payload (Vjw0rm)", "value": "43a0374d5b68eb49b4554029bf820ad9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698820, "uuid": "10050a80-19c2-4d14-af4b-7d26bdad85d5", "comment": "Malware payload (Vjw0rm)", "value": "5ad379d86b6b5b8fce3af992801510e9e30cf6c38002e6985f4e39e76c2964a7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698820, "uuid": "619a7de8-0cc1-41e6-9f83-95d00c2c6d25", "comment": "Malware payload (Vjw0rm)", "value": "006513b31063f766f6b2cbdd06e0047a20d16f54", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698820, "uuid": "6ccd64c6-074f-4aa3-a642-8e5548d9deaa", "comment": "Malware payload (Vjw0rm)", "value": "875ca9f7c6c252f00ea9c05f738a9827053047034d9fb950e47d9991dcd87f335ac3d560c78d42fc62c58b029e771335", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698820, "uuid": "e4dd68b0-ed67-4f26-8316-df59a5956955", "value": "T14B85733EB7E1AD69A4B4375FE4FA64C640B35320C85522DCBA7F2007639EC196536C8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698820, "uuid": "51d2338a-405d-4cc9-8ffe-b984ee8c4983", "value": "12288:/Jld+GT0msGJSjAm/REbqiVkJCWh3Iln6za+qQU/KF6HYEfZCI7BZ:/oJGK/REbVkJNq6zt9uRdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698820, "uuid": "ff947ee0-7be7-4ef8-becf-aa5ebd818fea", "value": 1712967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698820, "uuid": "dc385ed8-d1e2-4134-b153-dc07d78b36f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698820, "uuid": "110be3a6-b21d-4d67-b516-427479ea7816", "value": "6rfdc7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04f835a-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697843, "uuid": "e5f2a5fd-b926-4e7e-abb4-44bb1a92c2b0", "comment": "Malware payload", "value": "3e5ef4d89f6d4bd1f52b0d9db9d1e86c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697843, "uuid": "086460d2-b7c8-40a8-8bff-dc1091c6178b", "comment": "Malware payload", "value": "5c170429f4535c2b9f217fc5a6df53bd9d6dc4e6c8e5e01596f7304a81b242f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697843, "uuid": "08652f23-8580-4f9b-a45c-070a3f79885f", "comment": "Malware payload", "value": "da09894e1bdbd5bfe0e375120ce5d6a197bfd534", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697843, "uuid": "10d763e7-cedd-4367-a191-0ebfcc7d81a0", "comment": "Malware payload", "value": "0ae06d179c918f87c2c889ff8be489855248f5d1134f0e5db164d8c637958d62f909c1f56cc9bd8490f4a48d23053049", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697843, "uuid": "359f0964-3972-470c-9fbf-4edad20436b0", "value": "T12135B8717067C69B170207F9AFD3AA3CAEB771175906C84E9C478AD5FA30D688ACDB10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697843, "uuid": "1b965e7c-c2bf-41a1-9aa4-b8b55c486660", "value": "384:APIYlbkQrrfu7SZ5qcRwh4N/uqWVx30l4Rruq8NSOzGrDmO3+yGYW2ekA:iF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697843, "uuid": "0a462e76-66c6-4fde-9afa-addf51e82a0d", "value": 1160125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697843, "uuid": "94d24d7a-1d57-490a-9840-f10a7ce6e4b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697843, "uuid": "f38ab470-317d-416c-9a9f-93f42f922d68", "value": "3e5ef4d89f6d4bd1f52b0d9db9d1e86c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dc2d81-18bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772734821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734821, "uuid": "55b1da28-f47d-417f-9999-4bcb11b2f112", "comment": "Malware payload (Mirai)", "value": "324f097f698b363ccc599275115d958c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734821, "uuid": "240e2100-2aac-4e65-8e8d-f24ac67b5351", "comment": "Malware payload (Mirai)", "value": "5cdd4aed0e360a981f25b0971bcdaba7297250b7a7f32f7764a69f400f88b323", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734821, "uuid": "317351bc-d401-4707-bfbb-db409c5df7f1", "comment": "Malware payload (Mirai)", "value": "ae86509789c8620372932f064b59f23bb18cd336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734821, "uuid": "71273bd5-2d7e-4347-9303-277685c715eb", "comment": "Malware payload (Mirai)", "value": "c423b7cd7d1d79448e174e1c255fbfdf216df7e0b744921340e4d3aada6a07ea56c20deb1686bef07ecf3fcf2f7d9d1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734821, "uuid": "19d3f056-b355-44a5-9843-bb1daea1720e", "value": "T1F1234A032592D1FCCD6FC3F4176AB972E13B713D0135A64A5BECFE211F4AD601A6A648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734821, "uuid": "46a9ea38-2590-4d34-bcc8-3e2bfec286fd", "value": "768:5gplhuslrXelfl66UBsnCixj8BJMj8eu299I3rXSL1XI2OJi3UnUkYIlV:klhuslrXelfl66UBsnCixj8Bpeu88jSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772734821, "uuid": "ead23da7-b55a-4b8e-8e13-a208e3bd9a27", "value": 47328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772734821, "uuid": "f7a55eae-23cb-45ef-a8b3-009322fe0789", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734821, "uuid": "f3492f39-7d6e-49ad-9c74-249ec956ab7a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acef632-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726745, "uuid": "bdd2e846-d351-452a-b3c3-6ccce61a5748", "comment": "Malware payload (Mirai)", "value": "6f0ff10387d6ccd5f61cb1091b861f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726745, "uuid": "07a6075c-b593-4e50-86de-b4d8f9f0bbd4", "comment": "Malware payload (Mirai)", "value": "5d533aa3de15f79fa47cedccd2ae7e82741580671f4f9a4409422ee095de605b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726745, "uuid": "1d71f57d-aa8d-4681-8f01-f87fab9a5953", "comment": "Malware payload (Mirai)", "value": "55ebaff69fc81b213773ba1fc388df112c9bffbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726745, "uuid": "652c6e0b-4545-409b-b59a-038187ae2fde", "comment": "Malware payload (Mirai)", "value": "07c1f82f65383d55a685508edd2af77476b54767dcdfb59a4b80ed09b510a1111b60988e930da6c763313364939f7d1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726745, "uuid": "d99539d4-d5d9-4888-92e1-a9ff30cc90d5", "value": "T15F931782BC81EA12C7D01777FA6F108E3311A7D9E1DA32429D251FA07BDE81B0D6BB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726745, "uuid": "76da99a4-001e-40e2-aecd-7438cc28d12c", "value": "1536:m0rO2jEVkf7fmP92GbEEtrjQHvb7Qdg2L8MjB5g46NHB8t469t92NNJHRoab:m0rfjEVAAbcArR5nYh84utINJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726745, "uuid": "24ecdc40-9774-460f-82fb-8e72e609078a", "value": 91752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726745, "uuid": "f59fef3e-c182-41ec-883e-7dc14c5ff3db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726745, "uuid": "36514a61-563c-48a9-b71b-6355d7d61a0e", "value": "MMaaRRiiOisecTanee.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f12956-18c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772737529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737529, "uuid": "80525b01-86a1-4875-9516-53639f3fadb5", "comment": "Malware payload", "value": "a07f40d42527b0be89d40d15b24ac84f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737529, "uuid": "484f5a85-a58f-492d-8b15-4748f1b33afa", "comment": "Malware payload", "value": "5df2f35be04bc465366f6e064f75783a033c35dc49c0f6bcaf91a965587337b8", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737529, "uuid": "fffe7b01-d41f-4bbb-bbc2-22a05c326733", "comment": "Malware payload", "value": "493df4e270ddbc04f4f9afef3b26fe578b78ca06", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737529, "uuid": "ac20dac3-bae3-43d6-bde9-c732f343f95f", "comment": "Malware payload", "value": "d1095a7a92af1d48660ce75777989dfe59feb695bfbf74ba7180383685957819a58c221786e438c81913ef8f24aa9f84", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737529, "uuid": "a0b1ffa1-f92b-4b55-ab9f-618bf429bd32", "value": "T154050103EB91BDAFE4065B311D8B0842913B2C63725E4B271F47B29A25763E7F16726C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737529, "uuid": "82d30188-0722-4e9e-84f4-e5fc703305fa", "value": "24576:O5wJPRgp5wJPRgTYMciPu3m6E5oLzeEKV:4URIURWP6qoW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772737529, "uuid": "326e76a4-df75-441e-9ce5-e110eaf789d2", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772737529, "uuid": "32f11890-3165-460d-a36e-4afd4e326033", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737529, "uuid": "244bcfb0-68cb-4935-83cc-27f8661443c7", "value": "a07f40d42527b0be89d40d15b24ac84f.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd457df-18c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772736893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736893, "uuid": "fa2333e2-e5de-4639-a3b1-5236e3b509c9", "comment": "Malware payload (Vidar)", "value": "c7806eed04288b3699bf4658a70fc344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736893, "uuid": "2708ea56-c8e1-4782-ae03-2d336dbdbfa7", "comment": "Malware payload (Vidar)", "value": "5e31eee8370fa389fc7425a6df38c8d4a80e463f526ea292286b5ad406ab96a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736893, "uuid": "ad063cea-6603-48ad-a87e-cba05659056b", "comment": "Malware payload (Vidar)", "value": "66fe231345f2fae68758a40a556f323e40c2e4a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736893, "uuid": "07edea1f-8fe8-4f25-8da3-25d7b7cd1ec1", "comment": "Malware payload (Vidar)", "value": "ae0b3004e802dfa6fcd091cb52c829aa5c6f81b64ab1e5ddd588b59a723f12443f3c3920aa852fa2664bcffebf8c0bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736893, "uuid": "d7609ab4-314e-4139-aaa5-620f612ec3e3", "value": "T118C57C43F9904AB6D0A9D2358DB542A17731B85C0B3673C32E63A6B42FF23E49E39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736893, "uuid": "c7ed0449-6924-4122-b97f-7ff5f930572b", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736893, "uuid": "97f784b1-ac8d-44a6-8fb4-91c1d4106090", "value": "49152:4VU5EgjtI2WOpK1TNWZZa3ArMIPW00Ygt87F/:RVWPAZw9iD7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736893, "uuid": "ced53bfb-c840-4c6f-b2f9-47b97d403080", "value": 2645803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736893, "uuid": "8cbc4f8d-6376-490d-bcf9-defa573ea43b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736893, "uuid": "bb845633-17ca-4446-9a2c-1d2bf7503329", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51a9418-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681557, "uuid": "45cbcb73-b8a1-4396-bc34-695beaec4516", "comment": "Malware payload (Mirai)", "value": "4c57908af13827ab70b6b8e852deaef7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681557, "uuid": "89ecbfa1-d051-4f2a-a07d-e5ac34ff19ad", "comment": "Malware payload (Mirai)", "value": "5f7ed544ee649d8c3cd09bf6416dcdce79b4453aa5d3821c8a7507afbca144f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681557, "uuid": "717643aa-cab9-45ed-9a64-d3499d371af1", "comment": "Malware payload (Mirai)", "value": "0ba5aa40fe5517007d714fe6d91d29fffde9c1c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681557, "uuid": "edf8d942-7755-433b-b7c9-8a02ae5ab80c", "comment": "Malware payload (Mirai)", "value": "6325a24cb9ed6e9d0a2bf1532b32b205fd6114af15196ad10b07d12762e3750149838f3263990445f7adfc4027b41e3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681557, "uuid": "ecadb2b1-499c-4548-bc06-2213c9867684", "value": "T12B143B45F8818F22C6D012BEFE1D118E33272BB8E1EE72129D245F65778B86B0E77546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681557, "uuid": "2b0a8dc6-9970-4f22-a7cc-47bfde18861b", "value": "3072:2mLgMgP7sx3cNLvqbKTk2+0LjG+/X2+Ko3ami+PuNTESN9YSMuS:2+BeNWA9LSaX/KSaioTEOYSMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681557, "uuid": "b6288241-80cb-42ff-b4ff-31f0e5e1250f", "value": 203644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681557, "uuid": "2b379a04-9d02-47ef-b13a-d494dbea4707", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681557, "uuid": "d2b31ac7-e2ca-4fc8-b022-715c7c8120cf", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48dd3a32-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697589, "uuid": "817eecf0-f1a5-47e6-8b0a-ce4c8acd992a", "comment": "Malware payload (PhantomStealer)", "value": "86c7458825a74586e091601b703fdfc3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697589, "uuid": "7e779865-57ce-49f8-9a97-194895d78d01", "comment": "Malware payload (PhantomStealer)", "value": "60691f92743d179fb8da47681696c43728123e2094f7c69269b4c09f03b0e5b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697589, "uuid": "12f84c9f-6acd-4a46-814c-109723825adf", "comment": "Malware payload (PhantomStealer)", "value": "528c9e00e356d40cfcc2f49916fbccf437f87b32", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697589, "uuid": "428a4b70-e4b1-4213-a273-f247f8fb80b8", "comment": "Malware payload (PhantomStealer)", "value": "4510f34d132b3137e80cd714de2c1848fa154dc19bdfe9a7f522e2ee2c25b5fface28685503ecd776cf685d914143df7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697589, "uuid": "6d18892f-8e3f-4f0b-928e-c079a67d04f1", "value": "T1FD26C080464D1FBE868C5F50896F1B8796E2A16D9E4B3F871DA37F0F3E7C74822121A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697589, "uuid": "964e2110-8a70-4e53-8f1e-18880f924d16", "value": "49152:9rGZvsbYlDgk3YJEl0Z1L4wZxx3qqPAmPc72P/MSQjcPAhwBCG7WUSpfxScBkuww:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697589, "uuid": "0607d419-8e97-404e-94a8-28c9c3ae1fc5", "value": 4643715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697589, "uuid": "a8a5c790-c2f2-4fc8-9214-a58bd713ada1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697589, "uuid": "454d20f5-2add-4ef5-b55f-58c40382ee56", "value": "86c7458825a74586e091601b703fdfc3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f533e3-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726730, "uuid": "d53278c5-fe2b-4d4d-92b0-5bd5b9383819", "comment": "Malware payload (Mirai)", "value": "87c2007f19f08d0701805cc348970260", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726730, "uuid": "1559dc9d-7302-4eaa-82c2-245908e2e8fe", "comment": "Malware payload (Mirai)", "value": "612d87ca1399b8e21eafd58ecfc0b2766dd3fa126b3a7535501257308add5bec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726730, "uuid": "901f0c7a-0163-4221-840e-131978d0a815", "comment": "Malware payload (Mirai)", "value": "7ed870d2d94c7cd048d43db40418afb2b0651130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726730, "uuid": "7c3692fa-4ea5-4ad0-8e13-67f57aee805e", "comment": "Malware payload (Mirai)", "value": "7a86132f43479d79a9bb070721974b0579aca95bdcbd02a763e8a41c4bc2b5c3229839a1d0485d9228a0dad394325077", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726730, "uuid": "4c179161-5715-48fd-9f9c-dbddb04e2578", "value": "T1C7934A14A8392E07C0E8A23E11B7C751F2E6374F24B4866E7D7A1F8EFF54780A446272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726730, "uuid": "422b80af-aa36-4592-9acb-a36bb2d8b76d", "value": "1536:B1nDnEC0Xa0aL6eOSgdGLOuotGxfkz0AkfqVPB8haHDeiZbztW:rD0aX3ggbooRc6qVPB8YSiZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726730, "uuid": "8fb2bf6d-2b1e-4a84-8376-648ed59074e9", "value": 94352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726730, "uuid": "6327882c-c5be-42b1-adf8-668ae8c557f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726730, "uuid": "0da3d57d-9602-4aeb-87da-9cdaa3a8005b", "value": "MMaaRRiiOisecTanee.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb2cd76-1887-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772710513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710513, "uuid": "453f894c-f908-49c4-91df-bf408ac498f4", "comment": "Malware payload", "value": "b4f980f7398cd0dd33f95008ea44d96a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710513, "uuid": "3ab5c1b3-d131-4b38-9c9b-75ba5c24d9e4", "comment": "Malware payload", "value": "61882e8813e03a91adb06a282118ac522d7f8490a9995a57ca37bb71abc2a716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710513, "uuid": "e8ab78f2-fe9c-463b-83f4-750533cb2a63", "comment": "Malware payload", "value": "7e9206234b0e8728e80ec8d4a4e8842a81bab4e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710513, "uuid": "539a8806-92c2-4292-a3ce-58232d3eeaa1", "comment": "Malware payload", "value": "87e6042b40892b075e90516d35ec12959f4bbd7383d0a3054dbc53b50dc65399f06c5e2c5cbbca55b9c4188115e9871d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710513, "uuid": "e7bf7f86-86d0-474b-abdf-06eecee41435", "value": "T1A4F733488141BE70E97C8D7564D79AEE0227E3D88DB8748DFBE2C22B47E4660F244B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710513, "uuid": "7a91d857-6ffd-40c7-a0cf-ba475c569269", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710513, "uuid": "e3a1e09f-9689-4d25-9275-47d6998c3c3c", "value": "1572864:+V4K2CfQxytWpxClbn/iDvudxumQogjzMw1Hag1VtKhMAyNszZl0EJ:+OBctWPqbn/ixVjzMA91Vtq+3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772710513, "uuid": "8dcdcfe4-6d8b-4920-aa69-fc3d4cfcae9e", "value": 71384056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772710513, "uuid": "8f26eece-2813-4b76-b734-e69d46459e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710513, "uuid": "f21d30d0-c89c-4358-8f2a-db21582bca93", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebdab98-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703344, "uuid": "a95a925b-ecab-487a-b982-44e7fa7510fd", "comment": "Malware payload", "value": "d547c3f9d8097fd7ae540b6a18fc05ab", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703344, "uuid": "e3e2e56f-1050-44b9-9cb9-20bbd0b7cdd5", "comment": "Malware payload", "value": "621baddcf3f2d11858ef6b7e11d6846c2340ab05e1507b7a86a25cbd3abe1fb2", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703344, "uuid": "a4444a85-5974-4a3d-9a70-4601e8d1bbfb", "comment": "Malware payload", "value": "5700da15699742d5b3cbfe1fa3fec60f424adb28", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703344, "uuid": "3395fd59-e6dc-4ef3-85eb-97e7abb9c3f4", "comment": "Malware payload", "value": "7eb1ceddc2ac6eb1d74fb1a955aea29bf1586241bd987a83fd564d9cbff5d93f946aeb466c05587633ff6728056f54ad", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703344, "uuid": "18ede476-3635-41c9-9131-764bf76b545c", "value": "T15D967C09B3D88A55C626E538CB27D333C771BD955223824F15EEE70E2E777418B3AA12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703344, "uuid": "057e7865-e077-437c-bb79-f0c6a7cc1b14", "value": "98304:pzlyGzlyPEKnOkZrZd2la/R7KnWmnFh/sErL+40oMC7163hrx5MTPrei+mwd5FeC:Ln81nOArzaa/RS7n/rS5oH7Q7wewIzeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703344, "uuid": "f1904c3d-a9da-4f42-86b1-a91189fb970c", "value": 9404416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703344, "uuid": "0b45f3e8-9250-454d-98b4-a998f77f8fa5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703344, "uuid": "a1968d12-2205-42eb-821d-0a9cb56b533b", "value": "Szkennelt_fot\u00f3_2026011223.jpeg.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b28d430-1871-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772701083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701083, "uuid": "1c661042-e8b5-49ed-bb71-8e56aacfc000", "comment": "Malware payload (Mirai)", "value": "da28724f9847250a33af699c009ab829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701083, "uuid": "de52cc43-433f-424c-8222-ecffb1a09fed", "comment": "Malware payload (Mirai)", "value": "626386c29261af2648107d2f440f1b1b51c0a3598e27555547f7b649e874d2b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701083, "uuid": "98dbeccb-8b17-40ef-98e5-2744b669c715", "comment": "Malware payload (Mirai)", "value": "156525a9f85c20aa2793e4c6fd975af3080afbf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701083, "uuid": "15500004-e689-4ab5-a202-e4d03936aa4f", "comment": "Malware payload (Mirai)", "value": "c62ba45a9b5fedb2ee32c954ea6ddb30180639c40224b8e21f3385b3221bdca9a7352482eae0c19abb09248f75145389", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701083, "uuid": "b537e8e2-100b-4bfe-8a7d-043a83c5075e", "value": "T18E23F1A742D6BA76C5A58CB80B1845C03ED31840535BAEBF94DA31ADFD25FC98F60AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701083, "uuid": "2d9db6da-76be-4891-a8a0-e6230035f1a2", "value": "768:BBkxardrSnJhuw7hhSsz5B9sa5sPsuEuRuvjeWxYhIhinCAJNKP4T+8wg+4B:IYZxwVht5zsa5IRgrlh0CAagnwgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772701083, "uuid": "ca8b0dd3-379e-4dfa-afd6-d89d8713b4e2", "value": 47776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772701083, "uuid": "753398de-35fd-45ea-a46d-0110be16b9a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701083, "uuid": "9406b3d6-a9c3-4f48-8b37-e2f19069d132", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f845f2-187a-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772705049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705049, "uuid": "c6eba7f2-d998-4a91-9b01-f36851c22817", "comment": "Malware payload (CountLoader)", "value": "c3d34503b9ccde0c3cd8ba9180f7fe67", "object_relation": "md5", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705049, "uuid": "faff6ce7-ab99-4920-b471-230ae8b4742b", "comment": "Malware payload (CountLoader)", "value": "62c958b8b8e2d237cd0bed956507859148ae0befb33e60650aaf90edd0fb6c73", "object_relation": "sha256", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705049, "uuid": "1ef7415b-266c-4b33-ac0e-c93c317ab5fd", "comment": "Malware payload (CountLoader)", "value": "c1f25fd17f8b19d2678de51d2d0362aea8dc1e3d", "object_relation": "sha1", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705049, "uuid": "ee7f2186-0c8a-4f66-aeb7-8acfbcaf439a", "comment": "Malware payload (CountLoader)", "value": "cfd110a8ac0058732761776e3c9fb24e29b0e2925b940095526794a143427e2f02462afcfda85c91bd8cf6834c3bb011", "object_relation": "sha3-384", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705049, "uuid": "b41708c0-af19-41a6-a60e-a185583795e5", "value": "T1B3E523869BC890F6E87847BD98814C731BB2F87AD7663AAF1D8851740953C873835F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705049, "uuid": "aa14329c-7669-4a34-add5-05cec08cf7db", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705049, "uuid": "865b48f5-1a9f-4fa4-8086-8a090f5e7826", "value": "49152:R2cTmUOfS6DcLQCZEO4nLnIq1UJ0O9PeplWKHWrmenxNO:R2cTmXdQvEOYIq1U+WehHcxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705049, "uuid": "5ed2b427-cd78-4e93-95cb-9e031a5dea7e", "value": 3142654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705049, "uuid": "f3e18d68-af3e-4fbf-955a-62ec41ac173f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705049, "uuid": "3ed9bff9-0c9b-4fd7-9bf3-4470b097a273", "value": "Setup_Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c9258d-183a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772677504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677504, "uuid": "3f431f43-be76-40fb-a5c1-a191f456d558", "comment": "Malware payload (Mirai)", "value": "802626c8c28a1c58b10d39fab41bd239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677504, "uuid": "c12be786-647b-4e20-a75b-49b601ccb937", "comment": "Malware payload (Mirai)", "value": "62d1251fee6e306ac7b26b47a7971b5ae75d4b40b97c435237312da581d6820a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677504, "uuid": "c38af245-fbd0-4772-a3c0-ee1f73baea3b", "comment": "Malware payload (Mirai)", "value": "281d0e4fc5a28f2a257ba0dd157b57b7ee533745", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677504, "uuid": "0a45da8e-92e3-428c-b5df-cb69cef4934c", "comment": "Malware payload (Mirai)", "value": "f5e46d126089f0ad4578ecb7698471be4546dd584f507deaf4438498092dc92e362c5682d451093ceec2b2ee711837b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677504, "uuid": "50336c05-1c16-4424-84e7-a024b6985ed0", "value": "T1566301FD4E01420DD97CC1F482342BF62E5C560760B2A546EC37F74AADC80BAA847AAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677504, "uuid": "3c52cd7e-457a-483f-9445-29e29c9773c1", "value": "1536:P/gh1JzxiUOx28hK+TEQ1Jvgg0N4SrXCMYVa3zz/VJub:P87zxi308hK+DgTN4SrXCXaDbVQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772677504, "uuid": "7dfd5f31-fa0e-436e-ac33-82a14fa26086", "value": 71252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772677504, "uuid": "4eaf0c6b-aabb-47e0-aa77-6cbdcffef447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677504, "uuid": "47db8ff7-5cc1-4f08-8b64-00e76174a325", "value": "Polar.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974517c0-18c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772736805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736805, "uuid": "c0a8fa7a-de8c-4da9-af80-2e640e81668d", "comment": "Malware payload", "value": "e815097024bc7e15b9b8aea38c4da9bf", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736805, "uuid": "63c65272-a644-4c15-a071-64084f624cd4", "comment": "Malware payload", "value": "635de83f1d8a0c46ea8463199cfc7c5a6e49ea2bc18ae61d8b3e5225db118928", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736805, "uuid": "fa109327-cda3-4fbb-826d-1df737d2eb20", "comment": "Malware payload", "value": "fb12fb330ebf45e6b0c245f6a772c74ccf654333", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736805, "uuid": "6847e436-c618-4161-91d1-02b1c376e398", "comment": "Malware payload", "value": "d451853783c449cc9b304235d3798ed68d012e3824d0d51494ee41936575a7fc09ec3e925f50605e3612d4e720e621eb", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736805, "uuid": "906058e3-0023-45de-91ca-dd9596141021", "value": "T173187D03B3A705D5E8FBDA7196E652136932BC066F3095DF324C07262F73AE05A76B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736805, "uuid": "f9802381-9c6f-408c-aa40-2a8270208563", "value": "359e649ab913e838011b9d61180c7f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736805, "uuid": "fb240ec4-2edb-47d5-9c1e-9a00698716ad", "value": "786432:efgXTwWcQDgFFo5+6eYJL7b9VpgPVlcm6:6GTwUDgFFoB7bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736805, "uuid": "6aad9ce8-3ed3-42c2-b7e5-5e0b9485ddfc", "value": 89345536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736805, "uuid": "928d9937-9e9b-475c-baf6-1c17cb72d48d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736805, "uuid": "cedb9b69-bd56-4d4b-9971-848f0ac4202b", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef94a5aa-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772695292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695292, "uuid": "dba5fc9b-c61a-4b21-907d-780c2a930d4d", "comment": "Malware payload (Mirai)", "value": "9f4b24cf5d4a7a7ba9e03f7feb78cc53", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695292, "uuid": "5bf9b622-dd36-48b3-8d39-df09a832bda9", "comment": "Malware payload (Mirai)", "value": "6367a37d8615fe72a76d867a9dbafa80d71cbae04a996a0191fd287fbad52e2d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695292, "uuid": "47c762af-22b1-4ed3-a992-9fe4bc3939bc", "comment": "Malware payload (Mirai)", "value": "4682e1d5090b0c258e36018308d7f8367d6e1dbc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695292, "uuid": "dea60fff-b5a5-4685-97dc-24da12a8e3ef", "comment": "Malware payload (Mirai)", "value": "e8ea7dd9517237cdcfcf7caa8e02282b10e3cfedcdafed6d7304ca5fda143017d3c60cbde740c623ca32e54adae3be54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695292, "uuid": "1c446940-545a-408e-9dd0-681964e18d5b", "value": "T1FFB185C921A24D707DFA9C7366A98819B8C4B543AEC14F1594ECF4F658CCF087B85AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695292, "uuid": "499f32ba-1bf8-46d6-a109-0ea9e2cea4f3", "value": "96:2RKhEcfEnsTE11U/CU/kNxvHXfF53/JtvH3V:2MG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695292, "uuid": "788f5372-7949-44e2-8a77-131bfa547a37", "value": 5101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695292, "uuid": "f15d0d18-9fe2-40e1-bfcb-6abf24d5c336", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695292, "uuid": "ddec2c96-e2a5-4589-9915-114e2e6437e4", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0d013a-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707632, "uuid": "914beab6-fe36-43f7-9962-a1650d5e3729", "comment": "Malware payload (Mirai)", "value": "469f8d0606533775f3740fdea8c16bf9", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707632, "uuid": "bce9c054-c95e-433a-b7fb-b26b3192b602", "comment": "Malware payload (Mirai)", "value": "63aa3c7da908bef3a5d580ea68c7b40a27df367e2bbb7a858313ec3326ef2aef", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707632, "uuid": "1a6fa684-4c70-4da1-8c43-2f7e60574299", "comment": "Malware payload (Mirai)", "value": "a776b5db577a17f96361ec23ef5463f1d8f84378", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707632, "uuid": "44f1ae73-6937-457c-9434-50217a3e9098", "comment": "Malware payload (Mirai)", "value": "6d923e9b6a50a394bd5f10bfb3c2ce6eabdb34186c2c831360985cd7491120c38e9643b58eefa34fe8bdc26f06420f36", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707632, "uuid": "563333f1-da74-42c0-967b-2c22ab0576e1", "value": "T14823F13E45F2E182C37A012B9B35AE01A7416BFB83D2B08D51196EBDFEC3C84C579566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707632, "uuid": "4be78f16-9b42-4dfb-812e-136c0143b06c", "value": "768:0OUlNUIhsOvQy9gzlmgBgX+16W4QhY/jQzqrNW7GetT4onTeOJgq3UIwa:KlKRUQyo7WOX4AasOpW94WlJ31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707632, "uuid": "901a3a18-362d-42d5-a2bb-ad8986f839a5", "value": 45640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707632, "uuid": "f1f707bc-2854-4971-848f-37f341b80a49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707632, "uuid": "135eea72-2286-46f6-8d00-cfc4ab9d0795", "value": "5r3fqt67ew531has4231.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a1abda-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772707630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707630, "uuid": "6c234037-eefc-4624-b15e-db5d11fc8cc5", "comment": "Malware payload (Gafgyt)", "value": "7ec22d8ba57a78f31f9c9f60c264f906", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707630, "uuid": "dc056dcc-e443-476a-8d32-660cd0d7a858", "comment": "Malware payload (Gafgyt)", "value": "64139e7075d4504d3488d02f050e8ea5cd3d67e2ef086f8301fe8a382335fd82", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707630, "uuid": "8a1630e5-7f1d-4d07-a26b-b026f3af6989", "comment": "Malware payload (Gafgyt)", "value": "cdc1c7718ca6221d63dca96a7d1bb1eb14505ccb", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707630, "uuid": "b7c6ee97-cd68-461f-bff9-678f819eb3c3", "comment": "Malware payload (Gafgyt)", "value": "ad7069b674a575f0178ae2675049014e5757c492aed250a180477c616faae541b899ee533cf8b6879a558f658c0cf3f7", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707630, "uuid": "333ff155-ea28-46d4-a32a-195e6d6fa835", "value": "T1AD03F075EA6102F795F078B3E5AA4121031022A486EF63777C612A37DBC34E936F5D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707630, "uuid": "6790cd11-467c-4a10-af6f-fa028376f98d", "value": "768:8H8MsMTBL2RGXYqyNNrOAj8XmTD/BPz0aeyoK+7MurdV3U/:8H8MsMLcrn8X2ZfeZQWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707630, "uuid": "843bb883-8703-46d2-b65f-c64778f5907a", "value": 41072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707630, "uuid": "1b24ed03-a799-42ac-88a3-43153ecdda1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707630, "uuid": "808093fc-7d4e-463a-a91b-9f3e3da788bb", "value": "5r3fqt67ew531has4231.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2ff5f8-1897-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772717300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717300, "uuid": "110e9ba2-9014-4d0d-ad60-72638ef83ed7", "comment": "Malware payload (Mirai)", "value": "e9912f983ec74059eec5aff9058b6507", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717300, "uuid": "ffa62e0e-b57e-4096-bbf2-8ad5db4fb850", "comment": "Malware payload (Mirai)", "value": "64685aeb986549bd7d5a96d5c295715624322416dcf1cf9121c3cbb8f3813903", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717300, "uuid": "9284dfcf-84b5-4750-adb6-61ace41e9b6e", "comment": "Malware payload (Mirai)", "value": "e6eca08cfd8322ca326e798e43d1bfedf1f52bd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717300, "uuid": "57795445-4519-4e13-a42f-5902407ec2f7", "comment": "Malware payload (Mirai)", "value": "e52fe26b92d3003299dda771a35207a22ea3b4306180509ff6acfc6d0d951a0c97b1330d61b6f087cad62077e86b297b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717300, "uuid": "fab94f63-9bbc-4807-a22f-7a9a205d2b30", "value": "T1C4C32902F98584FCC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717300, "uuid": "cfbe9fc7-cad4-434c-a4c0-2ec2a6877f8b", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7BeyPBupmzQUAdojgaR/kN:eH3TghM/1weZbcnITeyosFAIxnJdhgJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772717300, "uuid": "264e0094-e985-4c45-acd0-4cccf52bcae3", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772717300, "uuid": "e63d3b7b-023a-4b14-85f3-4fd3120cb7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717300, "uuid": "428152f2-67b3-474c-b998-8206af4c688b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1754dbff-1842-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772680756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772680756, "uuid": "d97a2dc4-d0ad-44d4-8246-9b4f0fd6e3de", "comment": "Malware payload", "value": "842f946dc490ff0d69bf83b8ea3d9876", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772680756, "uuid": "c4cbd050-b656-49e8-ac9b-3e8a3c7aadad", "comment": "Malware payload", "value": "655951046a93f4669ec5a4822c0185a238f404897b4019f4d356e4791ba959b6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772680756, "uuid": "eadf8c8a-3393-445b-a964-d5d147cbf673", "comment": "Malware payload", "value": "fefaf9b5dc4f88901eeb78752b742f770e2de1e1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772680756, "uuid": "afbcd73c-dd9c-4711-a72e-b25e699fc432", "comment": "Malware payload", "value": "6e6facdd40f53f682d07acdd672cf39e9e7a8309dabb5a38c58977321499c3a28cbba542c60719537af761e6a5fa3806", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772680756, "uuid": "37fb35a9-f51f-4a6f-8bd0-a2c7f6898546", "value": "T15B924CB506497C79BBC0CE799F3C7F0CAEE582C42128E39DBA1F3A705A2065DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772680756, "uuid": "1b4ef680-8f8b-47cc-82cc-ca91dbd8d460", "value": "384:lsncuxOLnVYMSGzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:lnuQL+GzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772680756, "uuid": "587967c5-1041-45ba-a9d5-c73eaa03d886", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772680756, "uuid": "f6f99ddb-35e1-4b32-ba6b-030ac3a25b83", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772680756, "uuid": "73de2c30-8e79-4179-9fce-f98bef0ba4cc", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0b8de7-1893-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1772715608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715608, "uuid": "46c5e5b2-59ec-48fa-8fd2-fe629d857a3e", "comment": "Malware payload (STRRAT)", "value": "91e14973fdc357ab9e39f170fcb680a0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715608, "uuid": "bc5b5324-4b00-4619-b315-0dbff5499fee", "comment": "Malware payload (STRRAT)", "value": "65ea61a85e46bb44cb1576dbfd08783268adea26a4251d50cf85a922043d6c97", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715608, "uuid": "57d921b6-24ba-4d2d-b0d1-c59921bbf4e8", "comment": "Malware payload (STRRAT)", "value": "9441d6fcfc0d7a0605cc3b86f6789ddd1ac1d7ad", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715608, "uuid": "98b7a214-6c3a-4e81-98ba-06e1ee13e9bf", "comment": "Malware payload (STRRAT)", "value": "8af7d94d6392aa3f8e4f1817b2b4459590b67577899a2dc946cf68fd05d3647f61e152715d5c9e60cf2e1c7229316b68", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715608, "uuid": "9a68de96-99e2-4bc0-b4dc-2dd5b201f2da", "value": "T199A309547B44D0B2E7A3B073095CA25AAD74E4EFD25461C70EF2AC9DDCEA9400F52F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715608, "uuid": "d9d7b9b1-c22b-4b08-aa74-e00acc09b2de", "value": "1536:4BPy3kI8QZz3jjFR+eH7OZJJsKvGvAWXq+UoJhTl:4ZZIfldgs7uJqA2/vJhTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772715608, "uuid": "548d1b04-beb8-4c94-a263-c8cf1ba312fb", "value": 98442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772715608, "uuid": "a8a56c9e-197c-49c3-bd9c-1d6926f92370", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715608, "uuid": "902397d3-696f-4313-8515-6fc029744b31", "value": "nCotizacion.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26ef591-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772727053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772727053, "uuid": "df169df6-e53a-4e09-990e-49cb2cfa3d12", "comment": "Malware payload (AmateraStealer)", "value": "cfc9d81b959961b271623139118c1801", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772727053, "uuid": "838351c4-936d-496d-91d6-4768d185e4e1", "comment": "Malware payload (AmateraStealer)", "value": "65ee7d1c4b625e7540c2e0cd7ab5e0c582197ba3e9dac14144c0d57685e0cb04", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772727053, "uuid": "45fa8d47-7653-422d-90d3-c03ce9fe2964", "comment": "Malware payload (AmateraStealer)", "value": "8976dedfcdfc39de4db22ec8f5421d87c8f6648c", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772727053, "uuid": "9b9f2761-5390-4eb5-b97a-4d365236696e", "comment": "Malware payload (AmateraStealer)", "value": "2f3caf6db43df1d9ba066eed3a3203a88bababdb99ad44a3bffc3af0b14583c9c6702ea31b939e873b105b849b4445ca", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772727053, "uuid": "0d376e41-bb35-4a0d-923e-6c942b026fe3", "value": "T1DE353980A3F655ACFAAFCF77ED26675F4B3977801E20CA848160194F6C32A5194BCE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772727053, "uuid": "f3ff309c-d44b-4502-b766-e1ff3a6fd579", "value": "84ef172a2d937794bd7e454438f961d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772727053, "uuid": "d5d23a73-a272-4926-a804-7e75e5af9cb8", "value": "12288:aIyg40xwFv+KvyqsHsVvZqDwWdr1plHUQK6PuKGwlbLYuS:2g4wwFvTvyqQsBZqDLdrZg62KRbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772727053, "uuid": "b1e11144-0e15-473e-8ab7-133db67f8223", "value": 1094552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772727053, "uuid": "f636311d-c522-4133-be49-6083df7d86b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772727053, "uuid": "b7c69d8a-c8a5-489c-9ea2-a60a4bde75bf", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05c3e17-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681549, "uuid": "50305112-ca02-45d4-8459-6f672e74950a", "comment": "Malware payload (Mirai)", "value": "6db326d1cb19dfdd8a018159b0524eee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681549, "uuid": "b478d8cc-54b1-4dcb-a176-a9261e18b80e", "comment": "Malware payload (Mirai)", "value": "665151a762454ae029d05b338e4ad61b60050e2d7ab6ef36c3f4d817f480443e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681549, "uuid": "8c779ac5-d26e-476a-8dd3-83817756dff0", "comment": "Malware payload (Mirai)", "value": "5d25e18ae19ae87161007c32aeaf2b582d6e9a10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681549, "uuid": "1171b8b5-8ede-4069-a781-51427d886f6e", "comment": "Malware payload (Mirai)", "value": "8453dfe6b6d2fb3300e0acf85a8d0e3c1114ca30937543f6c66afa3c2a60d5e6f55788406cfb0fdf5b6b0efed9813499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681549, "uuid": "6011b750-5b67-4344-adf9-543999764b38", "value": "T19FD34BC1A643D4F5E95602752133F7378B36A036052EED87C7A8DF23AC92961E61B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681549, "uuid": "bcdea433-064b-4b35-8b23-205ee7179b2a", "value": "3072:Fuf7wFaRjHyGSyFw7Gsl+fwAWwKFXxrR+LcQ7n8DgXVEmj77Wx:Af8gVHyGS2aGC+fwAWwKFXxrZgF/HCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681549, "uuid": "9fa0d873-cd1b-4805-be6f-cb187061dfc0", "value": 141672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681549, "uuid": "428603ee-f1ee-4e23-84d4-8f148014ab10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681549, "uuid": "b8fdc747-58a6-4c0e-9751-d255a331c178", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202d95fa-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726727, "uuid": "37eaef23-044c-47f1-8b8a-7e39628adc12", "comment": "Malware payload (Mirai)", "value": "076e09292783846484dd81d6a2181d46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726727, "uuid": "6b4628de-0ab4-4906-bd4a-3ef9401affdf", "comment": "Malware payload (Mirai)", "value": "671f355d801efeafc1a0b85640fc0206f7632254c23c1d1a3b314803e4f574b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726727, "uuid": "a41400b0-03e5-4631-9f6e-50ae9c7f028d", "comment": "Malware payload (Mirai)", "value": "2cfc3e01164f95c7ec98aa7ccdc4b7090c3845bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726727, "uuid": "a0438164-2d34-474d-bc09-22937f68c423", "comment": "Malware payload (Mirai)", "value": "e7af715308db19f48ae85ca61b37ada040dc976ceed5cda7e62280133cd5074dc60c24d91ed6617ea1175d2b6cc9d1a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726727, "uuid": "7d2ccf37-cf4b-4963-90c0-db3df3cae443", "value": "T19B834B46B98085FDC189E13843BF7636C425F5BD1239B2D737D0BF1B2809E601B2E96A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726727, "uuid": "e995cc2e-547a-4b22-8b93-1d6f5f4e4c55", "value": "1536:mQ1hTamhg1LN9ML3fbRiJ63r5g3T02FwNbYUNVLTQ9JGrbDzAJbQWEURzWssp:7hRiLNaLPFiJ63r5g3TXFmbYUNPrbDI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726727, "uuid": "f174f7ac-d135-48b5-8925-eb2834c190b6", "value": 86272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726727, "uuid": "67811929-4e58-4b03-b885-de4e2478dc78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726727, "uuid": "305c3817-f87a-426c-9cf4-1597caf8e034", "value": "MMaaRRiiOisecTanee.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f116a5b1-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772695295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695295, "uuid": "daae5541-fa8b-4719-997b-b3e86179299c", "comment": "Malware payload (Mirai)", "value": "e08331971b4e9905c9bd101926c13c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695295, "uuid": "433d5824-ddf8-4eea-bef9-c22d0f578be2", "comment": "Malware payload (Mirai)", "value": "67c403e2e095a3a8fe0c07ebf4bf39814f0ae8651bab8bfe249e8cacd3dc16fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695295, "uuid": "f46dce33-69e6-459b-a625-a126fce5b3b5", "comment": "Malware payload (Mirai)", "value": "ee567a18328c9787dc1da48e87da6e01b5823070", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695295, "uuid": "90cba194-ce6e-4da3-8f5d-e9ca791d3d68", "comment": "Malware payload (Mirai)", "value": "7a4d4cf82c383e8e7d83cc02225782870a35285b75d084576da51546809f9cd64e0de3e2274e4885c466517d0a87745c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695295, "uuid": "baae3ddf-5618-4327-9c0b-3dbbe5f7d401", "value": "T149F39E32D8787ED8C5609074B0B19E781B93B1A441571FFF69E6C179408BE88FA097F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695295, "uuid": "81ca5442-beea-4244-b014-f27e297cea49", "value": "3072:Y/wErzxnvb6kJuIcpKRAGLLUqhL1tmOJIWsRmZEdZ:Y/w6j6yeGLLUqhJ5RsWEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695295, "uuid": "bd797b1a-07b4-48c6-873b-6e556e343c93", "value": 172488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695295, "uuid": "4c0f7ce9-9e57-464a-9d00-867ed70359c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695295, "uuid": "7f2320c8-dfbc-4ab8-870c-0832f9b08ea5", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c8553f-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707642, "uuid": "4de52e58-a994-4377-843f-ff8a27461e8a", "comment": "Malware payload (Mirai)", "value": "bfb2855d281498c922afda9c5a5eee76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707642, "uuid": "6bad787a-3d61-4c6c-8346-25492aee7f7a", "comment": "Malware payload (Mirai)", "value": "6902bfad54bae67fa6162107bac419a5f7d961508007ff3b75efd288a3f880ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707642, "uuid": "efe09e5a-566c-40c3-b396-2dc12bea748f", "comment": "Malware payload (Mirai)", "value": "68fd49f87c912f9ad1e27df9d411e1ce6f1ead88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707642, "uuid": "9092609b-5713-4988-8da8-5f53cf26eb1a", "comment": "Malware payload (Mirai)", "value": "1b5dd235f54f6d08788c1101e2b606aefcc9c30735098306099f7e2e69aab8bbb931dbf12f625c4216958cc93dc4296e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707642, "uuid": "7cf5f009-d2f9-4482-8760-5c74c0323608", "value": "T19E13E21E428535EEEAEF6D7C403821A25D68B5C5794FAB0FE350CC84877ED13D58C1A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707642, "uuid": "76387f6f-0a75-4785-9740-83de76386cfc", "value": "768:3JCCaaS/85B/dTgtJBJAIK+BVp0pL+nXJ2EXb92hUByiRsav1kWMzZ:33aakMYHuI7VpRcgp2ayCsag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707642, "uuid": "9f9a5664-ef39-47de-8b55-bdda4ed431d1", "value": 45548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707642, "uuid": "1c9fee85-600c-43da-88a1-893159d2d493", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707642, "uuid": "f64b435e-f4b4-42c5-abf2-6f1c6134cb0b", "value": "5r3fqt67ew531has4231.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef7ed25-1870-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772700901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700901, "uuid": "ae6dbcd1-60d8-4ca4-9df3-81799b01f235", "comment": "Malware payload (Vidar)", "value": "3569bb22ecae7f75c4ff6d612e090687", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700901, "uuid": "b40c09e3-11a9-4eb4-a0ec-2d6457764f05", "comment": "Malware payload (Vidar)", "value": "69c7b3654300bd7f94ba603da9be8f743442dc2e07504685a07f79f1cc318b4c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700901, "uuid": "0a095ba4-43e7-4235-b56c-bd08d39d8c67", "comment": "Malware payload (Vidar)", "value": "3f6fdbe8d43fa8a57ef96398095bbcfe6500aa3c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700901, "uuid": "9cd7e57f-fe6d-4592-ab31-6f01a00b4401", "comment": "Malware payload (Vidar)", "value": "b0fde430c28017352d1a8e2897305c663803b93fe9252db91b3ba984e1d38fec08085e926522c9d570e0c98fe84de3ad", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700901, "uuid": "98ea4524-d328-4d43-97cd-55bf8956c4f7", "value": "T18AF4129B71F430E9E267427B85514601DB76B8708BB2ABEF479C83582F176D08F39B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700901, "uuid": "1fa10d43-9817-49f9-8ec6-6d23bf46b8a0", "value": "469e59bd592f93ae01ff61cd0d813e4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700901, "uuid": "703cb483-9e53-4a22-8ea7-d3fb71f5e60e", "value": "12288:Ir8VpxdYrFgkaW2MGCYhp3VRZIBLV6sCU11VosGfVUV9QdB0KKha+Qq:28VCLcMGfhp3VRyn61U11Vo5f+V9gIfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772700901, "uuid": "31408207-ce84-4079-8a5b-784c65f7e0bd", "value": 769362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772700901, "uuid": "b2953e14-6c3a-4ffd-8928-68956c5f619e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700901, "uuid": "9ffb05bf-cba4-4424-a34f-de458107e0c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32fcede-187e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772706841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706841, "uuid": "eff6e1cb-a37e-4d21-ad2e-d4644c2a806f", "comment": "Malware payload (Mirai)", "value": "0ea7f1e2384a30b6a5e8a434e98c3cc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706841, "uuid": "4b845099-0d8d-465d-a9da-c13cd6ff827a", "comment": "Malware payload (Mirai)", "value": "6a8cff50e11336e71a6ca4b1327759438ee952b0ed9fde6e0840d24c97c216e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706841, "uuid": "ff1d07fc-7552-4e7c-8fbb-4cfd4fd3be68", "comment": "Malware payload (Mirai)", "value": "3bb65147a567a9ae31b25057f108a7bd9271edd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706841, "uuid": "eee80ec3-5b7d-454a-9eff-7efadb33af75", "comment": "Malware payload (Mirai)", "value": "1052d7f7eb33fa302079f1801ad6cc1890b0a761e845f4197c1597d92aaed5c0a732ea6cba9dc110764682ac1d2ac76d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706841, "uuid": "e486694b-5ef3-4be7-8d81-60679cc23cac", "value": "T136B339C1BA43D4F5EC1641307177F73B9A32F0791239DA87E7A89E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706841, "uuid": "6bb0c0b7-ba0e-4a4c-a8ba-21e101913262", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2w4zSr9bMFflw:Pbj4doYGFB0/45gdQ9ulw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706841, "uuid": "eb2ebd12-0d4c-4652-8627-a2335d7a9e14", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706841, "uuid": "07b0f4b2-b9be-4bc9-8973-02f3991f4a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706841, "uuid": "43fa4bd5-068b-4dd1-9fbc-6529f866fc53", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f721a17a-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703465, "uuid": "01cff64a-cf94-48f8-a23c-a44309c52467", "comment": "Malware payload", "value": "b06ff444901a76fa2b3a928753f69f0f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703465, "uuid": "2f6af1c2-f172-44ac-bc5c-4d4d73fc5b50", "comment": "Malware payload", "value": "6b81f1a88ce7308e3ed648251aeda069d4496d975f8721dc7c5b05d732f709e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703465, "uuid": "286b7afe-3d00-4954-b5ce-0a4761a10ddd", "comment": "Malware payload", "value": "5b2540556fa0d07dd780b0f50e06edfc9353ae8e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703465, "uuid": "e93ccc7b-2e57-4707-b97b-428e101a60bf", "comment": "Malware payload", "value": "a077ed3a13de8dec87741621203096f5569cec6cc28f30da804a24fd79ab89a104b47520ed469d7adbf2d8130598951e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703465, "uuid": "a429e249-24b6-4cb8-bd7b-065b8401a525", "value": "T1564179D7109507F72C94E87B32698480F5D89196A4EA5F0A2EEC3CE448BFEEC6545AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703465, "uuid": "aabb0007-5c01-40c9-9625-1db9e17283ea", "value": "48:vNd8jcttQdMLY0RI7hT6RCjISLL185NjIexfT:vNd8jcttQdMLY0RI7hT6RCjI2B85NjIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703465, "uuid": "fc8be3d8-b83c-4527-82f1-bdc0085d0a45", "value": 2098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703465, "uuid": "3be733fd-3520-4681-8280-8efde10babef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703465, "uuid": "6c43610b-eab7-4d8f-92b8-7ef0060e6418", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6df7f8-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772697520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697520, "uuid": "69fe275c-aefb-4681-87e6-5c1b1ecb3031", "comment": "Malware payload (XWorm)", "value": "cb0504336b4a0750bac0e259cf57590d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697520, "uuid": "fbe71792-5548-449c-a903-8b4405635cf4", "comment": "Malware payload (XWorm)", "value": "6c3c5cd5b76fbb25f63902bc5d1cd032c1d3b72694b9ef17583fac1310f4f99c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697520, "uuid": "98d319ce-922e-42fd-b1e2-393e9dbfb2e6", "comment": "Malware payload (XWorm)", "value": "1b479af87739cd51fe9c68d286903dd77663139b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697520, "uuid": "721ec8fd-66ac-4a8d-98ca-95238aea00b3", "comment": "Malware payload (XWorm)", "value": "eb586ac83b389bb046e0d8b2bca17c68abad2a7108f84643d5ea5a8a930ef986be28bc4cdcaa573f83797ec8088856a8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697520, "uuid": "3957e168-c844-4169-89a3-77e224bf01cc", "value": "T12E82763AF509EFF40B2E51E1018B6C06605447A6A53A4AFCB8CDC5587F26B508EE74EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697520, "uuid": "17e94e4d-ed06-4caa-b45c-523336d7e3d1", "value": "192:vjiwDII5Kh2fSsbR75GK29lz9pozyDmEqOGJf72ZSlcswmZ3dHYkjZ/xre6:vuwN5KNsbRYxylOGJfiShj3drK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697520, "uuid": "672a20c6-e768-45fe-bca8-8b1fe81cedf7", "value": 17604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697520, "uuid": "5028e390-bcd5-4d5e-a39d-4bfe1f921901", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697520, "uuid": "c7bd1c85-e559-4c82-815f-c3c319757e7f", "value": "cb0504336b4a0750bac0e259cf57590d.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75eb861-18bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772734711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734711, "uuid": "9821e534-c23a-4507-bc31-1ed2cf0667f3", "comment": "Malware payload", "value": "aee95030ae19b95614c77b3e60a22f90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734711, "uuid": "926326c3-6efb-43d5-a966-eddf835e1cef", "comment": "Malware payload", "value": "6cbcb57442e6df476be26eb0f14430432b53d88b5f50354fe80cfff626817ec7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734711, "uuid": "86240f14-87b6-4026-806e-0c11f2a9755e", "comment": "Malware payload", "value": "d43787d004ab0fc23459ee8b5fe0aebbfe02c9e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734711, "uuid": "faf39fcf-ace6-4e12-956a-a3c23ce4a447", "comment": "Malware payload", "value": "cc6dddbce38682f034d5a8b57bb53f6da7e7257fb346c6a0a4117ccba149c343ca49cf18dc775840214412be63647e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734711, "uuid": "f4bea281-5fc6-46ea-909c-0ad9ea5f8715", "value": "T1A43329A7B404ED7CF82DE77F4467040EB131B36054C20A6573A6A9D7AD7B2990C6EF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734711, "uuid": "8a0ae678-2466-4c38-8fc2-e4227d9decde", "value": "1536:30t3EAtEw0EwsEAqEAeJEwsiWqKd5j8S+wZNsoTtnfaarso75Z:Et3EAtEw0EwsEAqEAeJEwsiS5n+loRfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772734711, "uuid": "5f306626-f1c2-4302-934f-fd2abd2910b1", "value": 52724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772734711, "uuid": "35c18dd4-e3fe-47ba-a2bd-5cf2bd66ce1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734711, "uuid": "4a7414bc-ec4b-4316-92df-bbd01ea7e60f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaeef4fa-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697754, "uuid": "22b7a73e-0363-4332-9523-0e50458796d3", "comment": "Malware payload", "value": "f9bb0cf23733184ac31a88fbe3836a2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697754, "uuid": "b992178c-58cc-4a60-ab9b-2c3354a06706", "comment": "Malware payload", "value": "6e23e9f76764c2e23b5318a6e78de55b07f5820f5f41e0e6c7eabfc797844c55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697754, "uuid": "19e35379-1128-40ee-b369-077769ad399f", "comment": "Malware payload", "value": "ba864565d70b56821c8880bcfc87b3dc0e1ea94a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697754, "uuid": "1e40b86f-fa82-48f1-86a2-815506407b2f", "comment": "Malware payload", "value": "a3c2d3c2082c327a01d99ffd43c1e3f212fcbc76751446e8fbeb1f3b2d23d8731933e8f6d2eeacc593cfdc91a3e89b56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697754, "uuid": "085bf8ec-48bc-427e-8a63-f1d923591768", "value": "T1D1C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697754, "uuid": "bbdd567e-7cae-43d8-8358-2d9bf5e358f5", "value": "1536:6mB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dyJ:60B4exMF7oZKJnCNYaYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697754, "uuid": "d47bf809-5b00-4328-a56f-765250229ea5", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697754, "uuid": "66a29bf8-3d9f-4be5-8536-05dfbb91b93c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697754, "uuid": "292495ef-9cf4-43a0-9b00-64567d9fccca", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4296b6b-1854-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772688857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772688857, "uuid": "551c41fe-1c6b-4451-b6b0-e6653f3c4e6e", "comment": "Malware payload", "value": "4b7731b802165f8d6b79c21c789bb366", "object_relation": "md5", "Tag": [ { "name": "filebulldogs-com", "colour": "#CE9CE9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772688857, "uuid": "2e0a3405-57f6-412d-b5d1-3f8f4dfb362c", "comment": "Malware payload", "value": "6e66e33a6f37866af589abe6d8b1d7259b371929fe34fdcc3c79a8c5d0b7307d", "object_relation": "sha256", "Tag": [ { "name": "filebulldogs-com", "colour": "#CE9CE9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772688857, "uuid": "7d4eb77f-1b4e-40a3-8142-4c5d3ae316b5", "comment": "Malware payload", "value": "0f8916bfa8f4e91426226bcc83280efc5d9d080c", "object_relation": "sha1", "Tag": [ { "name": "filebulldogs-com", "colour": "#CE9CE9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772688857, "uuid": "f54d8272-720c-4ccf-92e8-f0476b4adc36", "comment": "Malware payload", "value": "3c072308567e29d2fb0728fea8fc246ce12dbb81a32c987680955a0f1f0a172a22792eb39524cc1c649e3f78ba0ce7ff", "object_relation": "sha3-384", "Tag": [ { "name": "filebulldogs-com", "colour": "#CE9CE9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772688857, "uuid": "720d7274-2b01-48a4-b741-f405c6d1d726", "value": "T199D1F7216DE720DE72375BA15BC8B5FF0A96E8F5282DB1F420418A4547719D4CCB2F78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772688857, "uuid": "54db2ff0-4456-4267-bc8e-27174d3bb424", "value": "192:SZRbhSI/bhD9vTcOtcg2arwmpeO42uwcQRciVCF6GncMZ:+ZtDFTcOtcgvZVuwcQReF6GncMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772688857, "uuid": "4410b28f-96b7-42d8-a29d-28a07f26d034", "value": 6160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772688857, "uuid": "d03c2130-ad48-440d-94d6-d9670fc43eab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772688857, "uuid": "88b58b52-5d0a-4198-a3a4-7ca44c1c5baa", "value": "f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c3dfc1-1858-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772690194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772690194, "uuid": "7d47b637-279a-4e74-b338-406b700fad2c", "comment": "Malware payload", "value": "2fd34ea519568a4011620ac5fe8cf590", "object_relation": "md5", "Tag": [ { "name": "1poz-my", "colour": "#B74F75", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772690194, "uuid": "bc399333-0147-4238-8b43-ef156c89ab45", "comment": "Malware payload", "value": "6e73a72a3fa7c12a29342d1ecd84b2a50e08df382bc73c0f27478bb467c1077e", "object_relation": "sha256", "Tag": [ { "name": "1poz-my", "colour": "#B74F75", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772690194, "uuid": "1e157a96-bf16-47c7-8229-f2d6dd4feb0a", "comment": "Malware payload", "value": "3a278f3b90e0f101213ec020083364a810e492ae", "object_relation": "sha1", "Tag": [ { "name": "1poz-my", "colour": "#B74F75", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772690194, "uuid": "803d1594-3640-4ef5-b6da-54873953f8d1", "comment": "Malware payload", "value": "07c96dfa942e20ed8b0d611531a1e3f108618ad3d730504080a610518ee01408c2c40cae64f7ce75f7afed97e299a004", "object_relation": "sha3-384", "Tag": [ { "name": "1poz-my", "colour": "#B74F75", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772690194, "uuid": "ba1939b8-81db-4da8-b504-351e31a289b6", "value": "T10685336109733040C5966FB3ADB32F52EEEE6DDBF117988309398A9F4CD43279963285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772690194, "uuid": "1117926e-17e9-4fb1-b9ea-3c903e63ebff", "value": "49152:/OkgxwYaxSrc3Ymfn6hg3Sh4gkRkegrGQ7yu8A9C:/Onxwr4w6hgiCp9grVmYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772690194, "uuid": "e06f7d7a-4cb8-4bfd-b7ce-1fc5db8e88a7", "value": 1866458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772690194, "uuid": "078f6e44-c43e-4122-baf4-59d5d595901e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772690194, "uuid": "179166bd-c986-4ae6-9266-b84e5aca51a6", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5328e66a-189c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772719511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719511, "uuid": "367dc742-05cc-4fec-8afa-db68f6f9af23", "comment": "Malware payload (Vidar)", "value": "3345905a2de31e839902bd8e668c738c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719511, "uuid": "a30f822d-8560-46ae-b050-54bd2fbd6640", "comment": "Malware payload (Vidar)", "value": "71da13c0fedf781713410f2fd482397497301315b3184707740dd4070c4059fd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719511, "uuid": "c923aac4-b2e0-43e8-9955-0bf7b7fe88a2", "comment": "Malware payload (Vidar)", "value": "348ad88cf6f54826800254817b68e84e7e936647", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719511, "uuid": "a94ca636-b2d2-4ac9-8e41-be935acf1bf3", "comment": "Malware payload (Vidar)", "value": "6b9e417808f388f66819d61b424b8c545eeb84b13191971861c5aa54425a772be76882d7db6915d5ef5ad108a6986233", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719511, "uuid": "b2f802e6-01c6-4d03-93db-8c7076d8dbd7", "value": "T127E6186B665D46E9C1DF81FACCA28F04AFF370F90732C2EF829003645A465D55E7A62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719511, "uuid": "6b783b5a-13c1-435c-839e-1d0b8c955fd0", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719511, "uuid": "53b5a3ce-7745-4e67-94f9-38d7939398cf", "value": "49152:9tD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUv:uxGLEUp9VDFtmdOTAHZHdXwmBdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772719511, "uuid": "35d39dca-48f6-4996-b25d-8c5e76dfa502", "value": 13914112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772719511, "uuid": "3c5011de-d88a-499f-a79d-4def78b2e7b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719511, "uuid": "b2653b69-445d-49b0-af49-ba4f0f1d929c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6390b5d0-1863-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772695057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695057, "uuid": "66f2ed53-e304-44a4-9cae-b038ddb2e49c", "comment": "Malware payload", "value": "4e00025e9e7314409f396b92d4293438", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695057, "uuid": "6606c674-3d57-4e5e-abab-81e7c2929502", "comment": "Malware payload", "value": "7558458b8c87d45007299a8a1e1af9c31627f20a7cc6b5d49e083c42249b1cc2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695057, "uuid": "c4bb876d-4112-4e22-a5c0-5a44ebd0cd6a", "comment": "Malware payload", "value": "4d8e1f2a6d7e54948fda5f48a48d771d5dedea7a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695057, "uuid": "4ac1c751-2456-4f74-bfea-6a56dfa02966", "comment": "Malware payload", "value": "15fc8bd37961c32fa825ad1b3b011e6e4751e292ff932b480ebcf79bdd32f876921713ce1ccc0f39f2468b986e4854b2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695057, "uuid": "7a7f5ce8-e8ee-4e56-9f51-dfcc257d5618", "value": "T14DE4121267A67DDFF807873E4C840556A10F2DA14B1D846F3882736A5E7B2E3E66732C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695057, "uuid": "ba8aeaa0-fefc-46fa-a896-2587c847be26", "value": "12288:lX3Ghd3Jvo7gZGvaX3Ghd3/EZccGjw+nWoehz0tre07yxJYBGQW:lXS3JSgTXS3kcUu4jYBGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695057, "uuid": "f5b58408-bc87-4454-9fd3-50d59fa7dbe0", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695057, "uuid": "da3cf510-4aa9-4c12-910b-eb7f23d03a63", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695057, "uuid": "874ae1ec-5ea4-4e38-b8c7-ba887bb72c3d", "value": "4e00025e9e7314409f396b92d4293438.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b500320-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1772697567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697567, "uuid": "12de3b0b-f017-425c-9b28-6c09cbd6f163", "comment": "Malware payload (SimpleHelp)", "value": "c36910c4c8d23ec93f6ae7d7a2496ce5", "object_relation": "md5", "Tag": [ { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697567, "uuid": "afa0f97e-81bc-404f-a4de-f33969d63e45", "comment": "Malware payload (SimpleHelp)", "value": "7577ae95e892eda34e00304308715c65a197216854a85cecfbfd402a3a8964e0", "object_relation": "sha256", "Tag": [ { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697567, "uuid": "8b2469c6-995e-4d45-a1cf-e640e2409f54", "comment": "Malware payload (SimpleHelp)", "value": "8c645913e0755ed00c5260440916096aa89aed8c", "object_relation": "sha1", "Tag": [ { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697567, "uuid": "aadd4dd3-35cb-40b0-9662-9f3381b04c72", "comment": "Malware payload (SimpleHelp)", "value": "691435c5b5366c8f6939e3248aa711d89095fea956577834628965e0b547fcabc9469ac87e35f01b81ea4c35f9bfcd11", "object_relation": "sha3-384", "Tag": [ { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697567, "uuid": "2076b0d5-144f-46d2-9b5d-46c10ebb0400", "value": "T1436229DCAFB6F01532FBD3D78AA299114D1BBC0BB1157A8B1E4E0A14112D9C86E764F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697567, "uuid": "d86f3eed-43eb-42a1-adcf-b93eb4fe07bc", "value": "192:VomhAt1rxGDnlNl/vHORYPYYOYYMLnGvWYYhb3chDvUs0prhLUcX:qmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697567, "uuid": "b00d8499-b555-42f1-a917-4631265b2775", "value": 14763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697567, "uuid": "bd7b92a5-4fa0-4f6b-b245-f4c9a12f6b45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697567, "uuid": "55f49d92-a69a-4d9c-8eb7-94d4b55d75ce", "value": "c36910c4c8d23ec93f6ae7d7a2496ce5.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e73810-187f-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772707335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707335, "uuid": "479cb838-9239-4c9a-bc49-6f2223f2e91d", "comment": "Malware payload (Joker)", "value": "ddb4685319deec027071ba38f0e0752a", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707335, "uuid": "e5f2f71c-0a82-42dc-a922-8db7524afb44", "comment": "Malware payload (Joker)", "value": "758fc5fa27bb0d6d4ce7cc7c0fc32bd734b310c7cd4a1c617af873ee11f16fd1", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707335, "uuid": "67379da2-257f-4391-997c-586d9a9f48a9", "comment": "Malware payload (Joker)", "value": "ef5fb3d8230e0a33b291f1ba06425bd6ffeece5f", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707335, "uuid": "9f5b6d1a-4be4-4782-b22f-a3f723a1a058", "comment": "Malware payload (Joker)", "value": "60bce772fe2329d216c0bf1e9988c6b0912d789d23eeab3bc4a5d8e64d5b8d804ebfb2cc65bc62a5e38880647263f552", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707335, "uuid": "790084e0-df30-4b52-a00e-e80f64a75e58", "value": "T152E63313E315A02FD83B90326EEB41640046BE87C645872BD5B9349C25FB6D48F9AFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707335, "uuid": "894d07fb-dce5-419c-bf5e-c4f6349031da", "value": "393216:YrRIrb2EyIICHWjmI/aYPYvZ5TgYrwBH+aQwsql1FEsvYp:2Ra5yjjmI/aYibTnwBH+M5lQsvYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707335, "uuid": "97e9e0dc-160f-4182-a467-a0a14cc28be5", "value": 15152465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707335, "uuid": "f1481fe5-a6c4-444f-bd46-34cd7cd7ae6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707335, "uuid": "8e1db29a-b413-470e-a2b5-752295bf8bcd", "value": "Smart+Phone+Cleaner_4.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c74555e-1897-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772717299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717299, "uuid": "9a17e949-c5fe-44a8-9cd9-eb7b6eb012ec", "comment": "Malware payload (Mirai)", "value": "b6e73eb3f6c9549aa1b6a58610eafe2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717299, "uuid": "980432d3-4ff7-4225-a145-70fde45b32a8", "comment": "Malware payload (Mirai)", "value": "759e8f85feb4c5e7c979d826841057f25666aa33f52a63d95a879dccaea67352", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717299, "uuid": "1fd7ba5c-b17b-4286-acf0-ac5a4618a73d", "comment": "Malware payload (Mirai)", "value": "be2e4c5cf840a31a292618e4713dba8d68bb96df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717299, "uuid": "13911fcb-34c7-4010-a252-31ed3d4460ec", "comment": "Malware payload (Mirai)", "value": "b63229133a6a8ddd0c06b4b9e5221dbec0f85064f4987fc51ba1a6e1027a5b88d917ada24aa41cf15929527abe42ae0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717299, "uuid": "de32ac64-3f2e-4258-8478-123d067d342a", "value": "T1D0041905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717299, "uuid": "573d2dde-5708-4d98-8035-5f5b90a6cd5a", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2wonacrI40fCtZ1SD39rsJj/s9fx49SY2+:t3nEr5dfHPq7UToac8uF9X0V6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772717299, "uuid": "2338d996-30d1-40e8-9d2f-98a6c5e0eac3", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772717299, "uuid": "487be216-d7e1-47c2-9c66-5a9b2187ff6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717299, "uuid": "8cb1eecd-5a75-4950-8a46-45646b9b5fdd", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f716fe51-18bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772734818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734818, "uuid": "c71199f8-3716-4a37-9466-1fdbecf7a081", "comment": "Malware payload (Mirai)", "value": "f22556874728cdb29313d33f8fc6b0ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734818, "uuid": "1a5f5a35-d5fa-4a49-9020-013e18450e50", "comment": "Malware payload (Mirai)", "value": "75b32681bdf7f9a8adc3e459887f5d3578ce11988214cd2990bd3a0bbd7a3869", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734818, "uuid": "f2b5c200-f0d5-4c22-8a00-2af491311ab8", "comment": "Malware payload (Mirai)", "value": "2bc99a9fcdffc2712aca831793e11ae0cff48665", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734818, "uuid": "ae19844a-a695-46cf-b030-267d57091827", "comment": "Malware payload (Mirai)", "value": "839e3455d57c1c226d1dd016bd90b1eb421d5de8c593a46df2b299c77a8bd8a2cc72320739a028632e76d5bad009b5dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734818, "uuid": "d75d8982-63b1-4f5c-80d2-1627645dfe12", "value": "T10A331795F9816663C1E415B7FB4E418C7B2603F8E1DE7303D915AB303BDB8AA0EBA451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734818, "uuid": "b68d88e8-47eb-4f66-bb4f-1dae04de130b", "value": "1536:ZAzdY7GFiw8Ex/QHFMwNR+crHXmBJfOOWvFn7vSqW6:ZAz67GFiw8Ex/QHFMwNR+UHWB4dbSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772734818, "uuid": "b93a2a81-a814-4ab0-a92a-97d55fff3f36", "value": 50896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772734818, "uuid": "1bb30a79-18e2-4e6c-ad9d-cf7bb87ce0bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734818, "uuid": "4c797bf1-d238-4b83-86e2-6603fcdf642c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c00bb32-1881-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707903, "uuid": "b99a7b34-607f-40b4-b3c6-86ec5cebfbe8", "comment": "Malware payload", "value": "90e7108a98db9a64d0a6b95403781bde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707903, "uuid": "3ca655a4-0b75-4fc6-90a1-6d1a579d6835", "comment": "Malware payload", "value": "75fc431ce030047e6dafc6c5d787ef5d8a4a23c9da3ba8fb239d869d46784dc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707903, "uuid": "57d79a1d-4dff-4cf3-b6a6-0438fd763dc5", "comment": "Malware payload", "value": "b11d0a0657fe1a9aadba407af8c8a8244a9df969", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707903, "uuid": "9cabc991-034c-4ff5-92c9-7369dbf2e6f5", "comment": "Malware payload", "value": "2e48c38b8b1ecb24a98bc9240eec6e05f4c8921467dd86b9e5123fd2898c0df9991a56c5ed1a47689e27e876e0d200a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707903, "uuid": "60afe309-d9f1-46ba-bb95-7174b0708005", "value": "T14D963A47ECA545A9C1EDD2708A729263BB717C484B3027D32B50F7382F76BD0AA7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707903, "uuid": "3526079e-985b-443d-9b6e-98f558c2d1c3", "value": "98304:W9xfRkMV/rPn55hSjvLJIEWQNRt5uO/N9f:yOMV/rPIjJhP5Fl9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707903, "uuid": "19aa91e4-c646-4689-93a7-42cebd2346a6", "value": 8654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707903, "uuid": "0f7a1d69-eb54-4fb8-a515-f1bb19e37074", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707903, "uuid": "cc08e56d-4b1e-47e4-a15a-41dfc074fddc", "value": "chisel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aedde6a-1864-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772695392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695392, "uuid": "895283d1-7e67-48bd-8b06-8e2f9686f555", "comment": "Malware payload", "value": "709ac0112367ca8661e71b747b3a6963", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695392, "uuid": "01ac02eb-1781-4b9e-9127-881b0076803c", "comment": "Malware payload", "value": "7714bff255c82003a9555ee2ce759a4dade2ee9c18b5244bfb77c267638b25b3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695392, "uuid": "66e9d307-7012-46b1-aef6-5dbf8e0385fd", "comment": "Malware payload", "value": "c0061932fcfd71ee1e143bddc5f758c3e4ba9d32", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695392, "uuid": "8cecb1b9-aa2e-49dc-be94-104fdd1f9fac", "comment": "Malware payload", "value": "23a6c18ab1458a75be82e1b7f589f4615a8a2dd836f438fe2ded936a00058b9c73c4f5e50a25ff422d30c8ae0b7ea0ed", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695392, "uuid": "4783198f-afb8-4f56-9366-b26e657c86d3", "value": "T1A2567668F20B60436F584326FBA5E5122C0473A91F118B2F019E9FF257479CFBA1E96D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695392, "uuid": "a7c81ecc-851a-4ade-88b8-b64b9a892c40", "value": "24576:oZ4i9NZ4i9NZ4i9pPQ3LqY+UxKPn9H+VF1S4OyB13DGC9EMRZenioMl0b6mZUHe1:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695392, "uuid": "1a04676b-87fc-4415-b484-01cba64acf98", "value": 5996589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695392, "uuid": "318b1f4f-5ac7-4041-84d0-f10634d99f96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695392, "uuid": "b5871c77-7e10-49e3-9a7d-1d510ea536b8", "value": "sys.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b64800-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697530, "uuid": "37fcddfa-86f4-40f6-9b8d-86ab14ea7654", "comment": "Malware payload", "value": "ab8d1650eef0fc2407909031a7a0865a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697530, "uuid": "550d6364-794e-4825-9741-b57dff23fbd5", "comment": "Malware payload", "value": "773a7da92e27c2f9116dd9acbee2c7c85ba784f49f702a760ff1a708e11d73fa", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697530, "uuid": "d042842f-8a0e-4fd7-9810-f0e48816492d", "comment": "Malware payload", "value": "a518dd1d2a4ae7a54b917d40f870447cdd0b0542", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697530, "uuid": "e5d06aeb-1b4b-49ba-bfe9-c37986772a56", "comment": "Malware payload", "value": "06f89c8ff3e7810a9a20c729451b7788f5655f1c51f769b71f5e85e10c8099195ab42280d89af468627a6f09713c56dc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697530, "uuid": "94187d44-46c1-4927-b665-df4f9768b84b", "value": "T19345C692F263480E831EE9B790A14395929803F39F592DD74F34A1F514A8B74E983FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697530, "uuid": "932d615a-aae6-417b-bb19-777ce8afccc5", "value": "384:yHvP7FqKkLs1LXL5DNxEllfiFMjw9z3EWtCGVsTS8p1c5xv9qtpXUAZv9a23CY0E:yHvP7FqKkLs1LXL5DNxEllfiFwpSS24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697530, "uuid": "a893a641-165e-4f49-86cc-2bd0132d6c37", "value": 1212382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697530, "uuid": "8c35acad-f9c6-4baf-9610-771b6b6ef660", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697530, "uuid": "78ce829a-a87c-4f28-82a9-82d41ee13cd4", "value": "ab8d1650eef0fc2407909031a7a0865a.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cfce49-18c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772737534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737534, "uuid": "8735f321-cb9c-4c77-99e0-9316af54219a", "comment": "Malware payload", "value": "3224e0cf580c22321d33c60d4509b54b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737534, "uuid": "8edea913-8c62-44a1-b8a0-04d485853994", "comment": "Malware payload", "value": "77639acdae5c36538c41425e29d4fb993990a0f309cddffbde4fcdf261ea1507", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737534, "uuid": "d9d2375a-628c-4e5a-9b41-6ed7fc61da04", "comment": "Malware payload", "value": "e8ac478127b79967dfb10ebd0106e95e07d23784", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737534, "uuid": "689f93f5-8fd7-4a0e-bbae-3348878cd56b", "comment": "Malware payload", "value": "a7c9a4fbb8ff716fa844e2bdf6fbc616b7bfdcd5e41fcb099a52f8499c74aa41c23f6ae91ff2156901b48a4b4f769900", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737534, "uuid": "570f06b3-efba-49b1-a413-74575ec1ca5d", "value": "T1B6C412F352D2BDBFE66C15F72043B0B4B2A85D438AB0726969131BCC6E6241E86511FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737534, "uuid": "851ed389-b479-4e69-8b4b-a6fa22386927", "value": "12288:fjktl/NXlQBkUK1DvgdeVP+y+XzgeIB39sc6BBCF7O9KFUr:f2x6k71D4IP+yIzgJts7CF7OICr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772737534, "uuid": "c7239da4-a5a3-436d-ac6f-b17a49a28ae2", "value": 550962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772737534, "uuid": "d7436a20-2a44-42c9-ba83-31f069703e56", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737534, "uuid": "6cf9fff8-ec69-46e8-9c0b-750e0b625bdd", "value": "Payment Summary 46353.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb766a70-18b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772729135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729135, "uuid": "63bbf857-9083-444e-8ec3-d226071e2fa4", "comment": "Malware payload (Mirai)", "value": "6d16eb158fd084f80ef5c3dcd738582d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729135, "uuid": "47b17400-373b-4c31-a946-66d32da538f9", "comment": "Malware payload (Mirai)", "value": "77d307a4a967581d9958c8f8e078c8cc98fa3e3f6d42d544001a00b6a070edc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729135, "uuid": "05782877-1a1e-4af9-866a-b87cc9bb483d", "comment": "Malware payload (Mirai)", "value": "18475229581ba0a2b07f2ae23967d984446fcab8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729135, "uuid": "1c0174c4-bfda-43b3-baa6-5d60d3936dad", "comment": "Malware payload (Mirai)", "value": "7eb8501cd28dafe003e347a83cfd08bc76e6d37d9bf3d3dce8299e245fc4b072324f7a36aa27e429727e0b2b10f08dd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729135, "uuid": "bdad6ab2-30fe-4f62-bcb5-be47c39d77f8", "value": "T12F131742B3180547D1631EB0353F47E1E7ABAE8122E4F288760F9B4DC171E77A946E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729135, "uuid": "dab8463a-457d-4558-998a-ad51b6e07f54", "value": "768:TuZQBal6xzFogyxBvDMaccDP1UqI9XFPTM1y6/janpyvsM73V+Otauo:T0UFogW5DMa3DyqWPw1y3nYx73V+uaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772729135, "uuid": "c00356fb-c797-4362-b13c-dc4feecaaa24", "value": 44168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772729135, "uuid": "b5d6eec4-11f0-4d47-bfc5-b14cec1fb35b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729135, "uuid": "337a1614-d899-4818-9b5f-6671e88079ea", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93465780-188d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772713176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713176, "uuid": "42d0ccc2-e9a9-4547-a7b2-b95e231bfa0e", "comment": "Malware payload", "value": "b6109b26f08fb19782c5c1657339f4d2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713176, "uuid": "d45a777e-f5e9-42a7-b19e-3fa808e1a4e6", "comment": "Malware payload", "value": "781c95ee87e5d9f5ab670a3164894a9e78796a2563ee076770eac467ea8b377b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713176, "uuid": "ae27cf2c-f23f-490d-9edd-f4e8a517b03c", "comment": "Malware payload", "value": "044d19a856e04e56fba53c8d90f13642d1a76395", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713176, "uuid": "d0e5e8e9-cd58-49e6-b755-e0d54317ec6c", "comment": "Malware payload", "value": "5052ccc0a8d41e8c575bc74499f34b5748f34b4919e73dcc60b464137f0e1b2260f28ccc8909ca114006c343d71a6432", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713176, "uuid": "37ed400c-f052-439c-b5a7-9fe0885f3c59", "value": "T12A96337ADF8E20F2E01369FB50ED75A844753DB29683AE155638B89245D82B1F3CB343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713176, "uuid": "c169752a-3eeb-4a12-96df-10ece185c95f", "value": "196608:PQyCa8w+zMS3zz+sXJAZSbYruSoAmzSmC39QvblC:YyP8NdZAYbYrvVpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772713176, "uuid": "633c54cc-2e67-46b3-811b-489045daa1d5", "value": 9420914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772713176, "uuid": "14e968ac-310f-44ef-8ed1-18649d70e92b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713176, "uuid": "e5811efd-4d19-4276-956a-c903ac56f7af", "value": "download.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5d2eb9-1880-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707479, "uuid": "8591612f-e3df-45a3-a062-8d9c10d3bddf", "comment": "Malware payload", "value": "7a67eff251584005131117f62b1e3a09", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707479, "uuid": "fec33c3b-61fd-4e90-84fc-15c4f05aa633", "comment": "Malware payload", "value": "7ad0ae4494675c5412b1abc00a527d8b568debc01b148d2d16e7a55367e28eb8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707479, "uuid": "e0f92ab3-8841-4cc8-b985-2c3b493e87fa", "comment": "Malware payload", "value": "d7d42b554a2cc198f52643cbb00b3be9e4d04ccf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707479, "uuid": "fd55af82-ba4b-486b-89f7-85a9d4780e07", "comment": "Malware payload", "value": "5deb69ac7ee2ae621ac7a1baaab8f9b6b286e3bfa480c148cef1bcc19c0fd6084e9af2bbfa33e49e37925d371d628fc7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707479, "uuid": "3d9070fd-4b45-4cc2-89b8-3d677afb0e7d", "value": "T10085F186F356A81BD5F7CA3A82B54BAA1B428D144797D7530A55B13C0DBF9C08F88FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707479, "uuid": "8997222c-64d5-477c-8956-6467877e3f9a", "value": "49152:eTOK0pALLYDjdXWv5dnQZhfKdyURrNRrnRrDRrOIRrMu13B:eTOxpALEVXWPSfS7rfrRrNrOWrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707479, "uuid": "cc80cdaa-27b2-40a5-b7bd-a3503d0136fe", "value": 1803472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707479, "uuid": "024ebe74-bfba-41db-9a54-dc97bbe01026", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707479, "uuid": "4915e8b5-3410-494d-ace4-0bdd453d9f36", "value": "2511.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cba58b8-1880-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707474, "uuid": "df139544-cc67-4a3f-a0d7-699f549f4bfc", "comment": "Malware payload", "value": "95ebbdb091a65581dbc3755764b3e679", "object_relation": "md5", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707474, "uuid": "2163a8d5-d389-43ce-9c6d-7ebfc787a5c0", "comment": "Malware payload", "value": "7b440d8a4734e7ccb94b8279970beaf03583c763afe81fb3d1099f69c046955a", "object_relation": "sha256", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707474, "uuid": "49c6639e-a2dc-4c57-9906-6c63aeb393a3", "comment": "Malware payload", "value": "26994536144c75aab19aaa152addc34728035ef3", "object_relation": "sha1", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707474, "uuid": "f36db04a-fb1c-4b1e-86c0-f6d4b9ddcf48", "comment": "Malware payload", "value": "7e0ec61ed552de6d8e920ab9898b3a20401bfc60d071a195a9422523d17c9b1d4bdd2df7070286be285bda081d29f240", "object_relation": "sha3-384", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707474, "uuid": "296d8528-df27-44da-98f7-6f70ca934a9e", "value": "T127D1662A5148141055B3A278BBA2E658EF655503A207825C7ECC128ADFFEE84C9B3BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707474, "uuid": "f033ccff-79f1-4641-9374-551b7892388c", "value": "96:6ua2nMBdDzPg6syfACHelq0boLlZllpECAMvYWQFDf4MJdWvalb:6ZzBdPPg6swLH2ElrlpEp+M+yV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707474, "uuid": "ed8a03d1-93eb-4209-8a04-259bf180d6df", "value": 6745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707474, "uuid": "faca7420-b9dc-4db3-b22f-1e5132a0e06e", "value": "image/svg+xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707474, "uuid": "9c9ae101-6132-42f5-bf3f-676f19548821", "value": "mcasset3.svg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472e88bb-187c-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772705747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705747, "uuid": "146ebb59-925b-4540-a0a6-8c36fcf187ce", "comment": "Malware payload (Stealc)", "value": "6e958b60a78f5ce646e0b8c8b87db2b6", "object_relation": "md5", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705747, "uuid": "41794def-e3ca-4ff0-a2bf-f51d4d948f1d", "comment": "Malware payload (Stealc)", "value": "7b4bf304b4ec3ebf6318f753dc2e1b5cc8dc0aa44c3d374af57f68bfc18cf51f", "object_relation": "sha256", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705747, "uuid": "27fffe85-3c72-459d-8a51-2a4a58374d5c", "comment": "Malware payload (Stealc)", "value": "029b6054f234bca3fb1f02be6081294a69a6d5f7", "object_relation": "sha1", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705747, "uuid": "96332a6c-aa2b-4211-a2d9-b6e45bd5b8ca", "comment": "Malware payload (Stealc)", "value": "805b880f0b0312f80e63899f5a501fc5d380feb8571913e59fb78b6ca69d6dd460e8353a73f091c69045f57c47d9d773", "object_relation": "sha3-384", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705747, "uuid": "7650f602-25a5-4428-bd0f-28be02e6d09f", "value": "T1B2145D3079422EFB5BB8208248C9811C552C32B9DA282CE57ECF5C962F5D7791BF79B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705747, "uuid": "282fe833-174f-4d3f-ae1c-03cbb5812e72", "value": "3072:+4XclPiJd3bKUCgor6b+eBjIg7Ds6cdYCmA3FGon7hOxlxFeWbw0Li23dapkf:3dPrdBjIKDs6GYjAvn7hOxluWk0Liwdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705747, "uuid": "f6ffa66e-f43e-44ba-ba29-9b5ef3e9f05d", "value": 192959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705747, "uuid": "268963af-7a93-473c-8660-f8c3023eef7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705747, "uuid": "c340a961-cb9c-4d63-9cdf-8c46e51c7984", "value": "_pr.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c72614-189f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772720968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720968, "uuid": "1d7ee463-649c-41c4-9fef-5621beae0a45", "comment": "Malware payload (Vidar)", "value": "0392ef283018bf07b02960d3ebc3ed4e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720968, "uuid": "ca3aa22a-7501-48ee-8f46-a7b474e0a259", "comment": "Malware payload (Vidar)", "value": "7bf84d68878a450e531cfb5998ce9582e6f8fbe3364f78a59f5088555a4b5705", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720968, "uuid": "41be0da7-0633-49f8-91ef-fef004721f95", "comment": "Malware payload (Vidar)", "value": "520ed03bcb8746fe420202178a357442f5ee4517", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720968, "uuid": "6d161a39-b567-47f1-a707-50bd48ef97fa", "comment": "Malware payload (Vidar)", "value": "f876e5f756c6a4f518be62429ed30fcd2960fb14a920fd218ea27ef277b9e300deaa6071045dc721fde955e8c250719b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772720968, "uuid": "2ef564ea-a0e9-4846-b9f8-b6854570b658", "value": "T1A7D6182B766D4528FE1DC13AC0A2BB47E4F371B90732C6E786A103681EC65D74E7E624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772720968, "uuid": "f58f02a5-2891-45ae-8035-2c5e2b75178c", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772720968, "uuid": "3b3971e9-681b-44c2-a9bb-32dbb9f77086", "value": "98304:HxGLEUp9VDFt8dOTAl4xKkt+jWkw/6tgdQI:HxGLEUDYmA+xKktYWj/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772720968, "uuid": "349f4bd8-3bd6-47f4-b450-cb7858bc1a88", "value": 13856768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772720968, "uuid": "32b1d395-022a-4497-9f0f-756f5ea0661c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772720968, "uuid": "2964af52-3dfc-422b-a1cb-559460517f7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e2cfd9-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726731, "uuid": "d5a7e4e1-b86a-484a-8543-f95b69dd625d", "comment": "Malware payload (Mirai)", "value": "958de6029809d879a276455c7ad8e8fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726731, "uuid": "0007da73-bd1e-48be-9675-babcbde2df01", "comment": "Malware payload (Mirai)", "value": "7f43e78fe0813dd3d53aa40067f9aaa4e9404cfc8c4998061299a6761b7fd8ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726731, "uuid": "06a062f6-fc33-4c99-a802-45ff76f74b72", "comment": "Malware payload (Mirai)", "value": "e066bd0d19abd274382d419aa6c1c06a52af4df7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726731, "uuid": "854ff3da-4c79-498a-ae8a-e6c6b8b0044e", "comment": "Malware payload (Mirai)", "value": "ccd1443d4327bcb983cd25766ce1a9cbe7c5ff8b6a03baef875a446694c81d39929f206bc003b915429cdb3172213605", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726731, "uuid": "6d2a0141-4a13-4400-9171-9421819cacaf", "value": "T1A9835C46D6D7F9F0DD4209B8126BFB359633B8322130EFE3E7C9BB1759A1242944229D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726731, "uuid": "2b998346-a5df-4773-8793-0a5a50ed5c03", "value": "1536:8lfnfvzqnqYDm1fOwZvLEo8hHWsGiDTyfdkjFOFvSbrpHp3S:afOnngOPokXEgA6br3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726731, "uuid": "6dde6126-6321-44ec-9b67-9ea7ac699eb5", "value": 87228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726731, "uuid": "23fbf9a9-afe0-4299-a2eb-7eea2f080757", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726731, "uuid": "51023c0b-b5e8-4326-bbea-389510126073", "value": "MMaaRRiiOisecTanee.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb24d29-187e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772706835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706835, "uuid": "aca29f5f-b490-4b49-926c-527307c27112", "comment": "Malware payload (Mirai)", "value": "612227be09242f7475ff5fbf6ef65019", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706835, "uuid": "c3f35f2c-0d89-4cd7-a4ee-87a8deb89945", "comment": "Malware payload (Mirai)", "value": "8060b9f0ba18183673ba05322b3046892752632ff6833586f54bc3061b6a93ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706835, "uuid": "cce7ab2d-9cb2-438c-ba10-86079d12a808", "comment": "Malware payload (Mirai)", "value": "c422ff98b567760e56599ed3929cbb8c5ec3ad37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706835, "uuid": "9568fbe3-c5be-443d-9db1-9466ea4bb7cf", "comment": "Malware payload (Mirai)", "value": "c9c7932d57526dbbe7ec46ab0b3a85f60270bbf50e4469f726d550d30e3398e48c4d95b582736002a8c9d45337f37924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706835, "uuid": "9e8962cc-67ad-4516-92fe-b7803692a88d", "value": "T1F893E551BC82562BC6E423BAF6BE668D336577E5C2CF722BC8214B117B8551F0D63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706835, "uuid": "008c0157-a5b4-4c48-8283-18c3797c8c8f", "value": "1536:PWrd+dC++zBz/dPXQL0u4WaJuLaVlW04brj9uYpMNGY2LYghE:PO+d8zBWLac0yMNGFlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706835, "uuid": "5d641cd4-b1db-4c6d-8d89-fe526621f5d1", "value": 93804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706835, "uuid": "a778823d-ed7c-4e8a-b9f0-5722a9e2e0cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706835, "uuid": "d05e2ce7-57b6-47a9-b680-ecea3c2b33a6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f85a14-1881-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707968, "uuid": "ab956d02-bc23-4c93-b210-b10cdc4d62c3", "comment": "Malware payload", "value": "2c83c1cafbc60d38fb791013a91fee12", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707968, "uuid": "02fec163-47e9-497e-a93e-fb20bfc5dba5", "comment": "Malware payload", "value": "80b141db2973f6ad5c76790fa38368ba676e6c42fc854a919e4a6ec09a883ff0", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707968, "uuid": "6918897b-f5c1-4524-9885-cb732a803d6d", "comment": "Malware payload", "value": "b86a6546a564fd0504ebdb8bbd30ff649af4e640", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707968, "uuid": "cc7b8644-64f7-4a75-8927-046f8539d789", "comment": "Malware payload", "value": "c55e3a9f7ae20ec0cd16b76600449ef74ae940a331f783432807b5d2e7be0a71903a6326c35bb8754c9e293b243acdb2", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707968, "uuid": "84d46661-b6a9-49ec-ab96-263ac3bfb19b", "value": "T1C7414206486C74E34BC3129CC95C8F44823A2F0322C1B876B56CAAC6BF19276C5669FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707968, "uuid": "41c5fe3c-af2b-42f2-ae7b-634545a0e0af", "value": "48:fHLfBMVkPww4k18JDih/fibphU4lmK6DtEdbvPt:DGkIBJvbY6mdO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707968, "uuid": "d6367460-2871-4805-afd6-58d7a0d58875", "value": 2075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707968, "uuid": "546910b0-0434-444e-88b0-a41c9a471f04", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707968, "uuid": "ee2f3627-9878-4ab3-9f00-8a72f372bca9", "value": "CVE-2025-60021.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa08174b-183f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772679848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772679848, "uuid": "e5288624-4f87-4cf7-a2b3-abfcd578c3c2", "comment": "Malware payload", "value": "2fdeb9e7fedad2b038acdaeb2d11294c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fsysna", "colour": "#15F844", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772679848, "uuid": "707557a7-bac2-42aa-97d8-6ef3d13dd52e", "comment": "Malware payload", "value": "80dfc97ba057cce74b7cac5e71a545624a0d59a3a8605640ab2f3434e0111468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fsysna", "colour": "#15F844", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772679848, "uuid": "d78b6cc2-459b-4e21-a14a-518453597af7", "comment": "Malware payload", "value": "2cfe7996a7f3384f73f777bce28fc1e00aa79605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fsysna", "colour": "#15F844", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772679848, "uuid": "55fd4231-3141-4885-9a2c-8d2f8b65537c", "comment": "Malware payload", "value": "5e799bd4f84e9d6a306c0a8937bc37f0cb2ed80516331855df777e58e0fbb678f52bd7c137cd544426842c6ccfec3801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fsysna", "colour": "#15F844", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772679848, "uuid": "5a9e510d-cbab-44de-a4dc-de6cfb3426e4", "value": "T19E75DF26B39541F5E686153048DB6B36D7B6BE020B51DBCB4360EE591E332F0ED3A239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772679848, "uuid": "ff10a0de-27d0-4ca2-92cb-e2680b6ab048", "value": "245788be5f7374c2353736518c2959b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772679848, "uuid": "edc57814-dfd4-467d-adaf-fba121d2a606", "value": "24576:0EE9kGUY5iVB0U7Ftqh6OpOj/kPuAced49taKNKLp4F+/jObf0o7du7:ck9VBjDqnpE/4xcedrK64cipE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772679848, "uuid": "0a50e99d-4b0e-423b-a030-b9fde9aa2d7b", "value": 1597440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772679848, "uuid": "7f8905ea-ba50-4b4f-a411-d4a8ca535c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772679848, "uuid": "9bb8c84a-8637-41b6-96b0-2df4defe7357", "value": "SteamLogin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a5ca5f-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681510, "uuid": "67f1ae53-fc30-42c3-baa0-677bc4cc45ec", "comment": "Malware payload (Mirai)", "value": "507aede42bbc717fafb49cc0bc071692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681510, "uuid": "9a341749-bf59-4c8d-8b6f-a3a6350008ba", "comment": "Malware payload (Mirai)", "value": "80f187a926dd3d9d54e28b65fb8ff6f97f6757a10840780219c7c632fe7d72fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681510, "uuid": "43fe63f2-be91-46df-ae71-f3b5ad3645f6", "comment": "Malware payload (Mirai)", "value": "c3d2ada0a98e0b6f22953d56e34a7e28f94792ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681510, "uuid": "2aad9257-b605-4367-b940-4713dba051d6", "comment": "Malware payload (Mirai)", "value": "bcc0f1cef49f4865b99d366925dab0ca755010911e860c3502c4c12d44941e872cffa9a4039fa60351d35628aa528f73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681510, "uuid": "3991ba64-4557-4044-a596-3cb16578677b", "value": "T1D6F2E17DAAE3CCEFC13384B1FCBE050641130775F8A9363919860A1C9AD9E0B167B223", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681510, "uuid": "c6cf9c27-0038-43bb-ab63-afe51eb547af", "value": "768:0tG1RwVp4JYdVBw/MdIBVfzqAWupmJeT0Xs3Uoz2F:88RcXc/17qAWupmJeTxzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681510, "uuid": "ce915c3d-e9f0-4af2-84ca-0feb7b296d3e", "value": 34808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681510, "uuid": "40728ba8-010a-440e-8ccc-891857c2c0d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681510, "uuid": "e8337c1f-cc49-4a5d-8805-a01888d2055b", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc970bce-18db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772746746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772746746, "uuid": "8850aa16-ef62-4cd9-98f1-01958b7e7576", "comment": "Malware payload", "value": "014623f6f39501eb1afc07f608036e3a", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772746746, "uuid": "b2fedc50-9004-41a6-aa05-94502ac621dc", "comment": "Malware payload", "value": "8150b2b39fa62fa2de177ed8526c621a3581c0eb481dd9740fc5894ce2b7c13b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772746746, "uuid": "14ecbb5c-ee03-48ec-b3c4-64b96db04a6b", "comment": "Malware payload", "value": "9509ea87cf739f1cb8d63b5343175bf6210f4037", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772746746, "uuid": "ae300a50-2255-42a9-a3a2-adb0d0f9e228", "comment": "Malware payload", "value": "ac401278330d98b184558b6758a19cf7e8d8b2207377ddf1aee82accf415e9f11c6d23069c8d582f4231c5c3081aec64", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772746746, "uuid": "97367d7f-0893-43ec-836b-ebcb0d97494f", "value": "T12C15339FA199D447E7F62CFD84C8B5BD1817AB38D37089070B51B25AD8CBEE44398B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772746746, "uuid": "0976f6aa-2700-4663-ab86-640b20f284af", "value": "24576:JMHMGZQpKrEldWOtqaJm/SpF1FOEwRTGUqbmdSm:JMHPV4cfSpF1F/w9Gpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772746746, "uuid": "95962a79-1c45-46a5-b194-c349eadcb2d8", "value": 896474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772746746, "uuid": "b6cf5e0e-561e-4f67-8c6a-5b8048f11e58", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772746746, "uuid": "443e525d-cb53-4418-8f7e-dbc8532ae8b3", "value": "\u0420\u043e\u0442\u0430 \u0437\u0430\u0431\u0435\u0437\u043f\u0435\u0447\u0435\u043d\u043d\u044f.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6034f162-18a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772721251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772721251, "uuid": "206a9dc6-0919-41fb-ac26-dee96f6154a1", "comment": "Malware payload (Vidar)", "value": "e8de740ef9276830a0208b43bc842977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772721251, "uuid": "a48c6b2e-ec0d-44f1-b81f-6fc6edfa4135", "comment": "Malware payload (Vidar)", "value": "81b505e4916e556a1e89d16b4e842e8c906c069b11e6c66e4302bb68229ebbc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772721251, "uuid": "d8687fdf-ff3b-4187-a9bd-1c764531ecfb", "comment": "Malware payload (Vidar)", "value": "ddb3a0245f886bbf05b936ffabd743fb7b42a8fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772721251, "uuid": "adebed56-6c01-4a27-ada1-c0ba40903701", "comment": "Malware payload (Vidar)", "value": "d3175f3f3fabe099ede31effeb05e990189ef2cff6bd449b9487107bd815c105500d9a8a7927c9f9739b4797766a9b06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772721251, "uuid": "211d8591-5b51-4b0b-9f63-40b6a7bcba08", "value": "T148D6286B76A18668C21D813AC0E68F05FDF370BD0773C6EF86A0036C1E5E9D45E7A625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772721251, "uuid": "20788005-e84e-49f0-b92a-10cb18f7397a", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772721251, "uuid": "c4158eb5-1b6a-4397-88bc-161ec0cd9711", "value": "49152:TtD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUB:YxGLEUp9VDFtNdOTA24zP5ygIdQIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772721251, "uuid": "e4a2b09a-e1c1-4093-a008-ab74392399aa", "value": 13872128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772721251, "uuid": "f2d22afe-4bbc-4b57-bc8f-bb73151f158c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772721251, "uuid": "42d26694-4a99-44a1-8261-3570834b4e62", "value": "SecuriteInfo.com.Win64.Evo-gen.94855135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8a354c-18d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772742993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772742993, "uuid": "26bc3fbc-f5d6-4356-9db1-b661d69af050", "comment": "Malware payload (Vidar)", "value": "3d9536f6f3020d532d30ee55029861f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772742993, "uuid": "c922eafc-265b-4a27-92ba-c7cf8444ea8e", "comment": "Malware payload (Vidar)", "value": "829fb4af3d264a5b35fdc45b4420d6c94fc833fa5323cb4b958f40753bb62d62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772742993, "uuid": "f6813c64-0fee-4af9-902b-34bcf07b12d7", "comment": "Malware payload (Vidar)", "value": "31abbadbd672eee2ef06d96ae3714b76035ec153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772742993, "uuid": "c7af7154-d935-4587-bb37-4c80d5daba9d", "comment": "Malware payload (Vidar)", "value": "27b28d7dd6d514874bc83c7c9e964ad442b95088add4b03337cc875d6c7ee93c90e144a024c1cd4d1cf72770bd2d7ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772742993, "uuid": "34b9acc8-6703-4913-8fcb-3651aa225ad6", "value": "T14BE6F72B66517538C33DB13AF0A68B05A4FF6CB90732C6E7869003645E779D4CEFA624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772742993, "uuid": "213dbc2d-4523-4d2b-ab58-ef18c805b8d2", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772742993, "uuid": "6a076b82-6992-482e-8fa9-8edb4194d37c", "value": "49152:4tD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUx:FxGLEUp9VDFtcdOTAzUKUV8tdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772742993, "uuid": "e6e799d6-270a-4760-b30d-c28cf36ee666", "value": 14000128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772742993, "uuid": "960df4f4-259d-460b-b4f0-30acfa57b9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772742993, "uuid": "2cf81af4-5055-4914-ac88-0da2ff1a04b8", "value": "SecuriteInfo.com.Win64.Evo-gen.24414153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302c8962-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697977, "uuid": "5d7f9abb-ef16-4141-bfab-b22cf5280f59", "comment": "Malware payload", "value": "590632b2f108176958de444e8bcbb170", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697977, "uuid": "e7e6a1ec-2865-4af3-987f-375a07c19f4a", "comment": "Malware payload", "value": "831f6171ccbbd3d2489fa36ded4dc9f6c89917ddcb3acc1c01a3d5a6aa68a737", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697977, "uuid": "483f362b-28a8-4938-9d36-e99149830649", "comment": "Malware payload", "value": "67c6cbf92d4df9b65db781599a68cabc4f363596", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697977, "uuid": "8db8b2fb-9e9d-4626-8523-1d46eba1b48e", "comment": "Malware payload", "value": "88bcbaea9870e20e8b3b832783401a4b1f7b228ccc1bb3eaba5ea7e747e2e0605dbf3f01eace1a75a2b51723390555cf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697977, "uuid": "172c740f-3909-4477-a196-0d9d2507e769", "value": "T1C7522A980E23F8F48A6936905CDE0B62CCD50A14C116D125B9AFF39A3711F54E6B8EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697977, "uuid": "510dadcb-3a21-4b9a-beb4-7efc05bc739a", "value": "384:rSsgYWVXoe6jWUntHMiEV9VTEm9sduVd6v4UvPIK7QA4xVLYu4RP:rSswmqUtMi+VA4UvPIKX4xVLB4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697977, "uuid": "b1355e22-d4ff-4aa2-862e-306f5efc1c78", "value": 14498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697977, "uuid": "d8e8aa8c-967f-4f71-ab8e-91cc99b19db8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697977, "uuid": "d0b08349-cb42-4d55-91d1-f11ed51139ff", "value": "590632b2f108176958de444e8bcbb170.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56facfff-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698043, "uuid": "ff4e96e7-6336-43fc-a9de-cb419c4729e1", "comment": "Malware payload", "value": "db9e9dbe2afcd3c4189db00f66084a53", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698043, "uuid": "1a4765e3-7525-4fb4-a1b0-c2eb6af07785", "comment": "Malware payload", "value": "8419f23e5d412ee55b559525b8fe211d8d33eb4572beb249ab78f1334bcb13a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698043, "uuid": "6a26e420-62a7-4375-82e1-652bf2f4e3f1", "comment": "Malware payload", "value": "c361eca1ff04aeddf13c3a59eea2f9c48db8571f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698043, "uuid": "1e6331e6-e28c-49dc-a488-600cb1637a91", "comment": "Malware payload", "value": "745a9682348564ffc3e663e8839d89716b59b48dd23713e87b1015489db4fda44d40223d1c7e35cfb0bf5022301e1e2d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698043, "uuid": "c51f9f84-2edf-4e72-887b-a95d6e8acfca", "value": "T101A240CE3AC6F17C02C734763B7FA43AF57F8E542889A054C2563588F865B18D67EA18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698043, "uuid": "ef514e95-c2f0-4677-af99-e90036166e84", "value": "384:x3wH7zxpG0DEvp8wHIL3vZ+K8acKzxcY3Uztd3kmY7k98Ovum:xgH7zxF4oLBqacskztZW7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698043, "uuid": "85d58c19-97f4-4c07-ac12-877d2c4c86e5", "value": 21310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698043, "uuid": "d7986755-2ddc-499d-b17f-9254732a7be4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698043, "uuid": "46049f73-ce66-4925-a528-77bd183a7244", "value": "db9e9dbe2afcd3c4189db00f66084a53.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1f0ac2-1890-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772714640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714640, "uuid": "2aff06a2-7504-4453-9159-528622330e60", "comment": "Malware payload", "value": "4858a6b972350ea1fed6c365f46bed87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714640, "uuid": "9444dcde-3f8f-4413-9b37-6c15a1253259", "comment": "Malware payload", "value": "848507853b02e04494a7a3086a9cd01da038f4cea8ae1729cc6ed1297cbd1a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714640, "uuid": "02e92220-538e-48cd-ad69-78f876cba323", "comment": "Malware payload", "value": "3093c8de5e1ca06126553ea863dc97c0c53ad397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714640, "uuid": "60bc8328-0567-482e-9f2c-3703a2784491", "comment": "Malware payload", "value": "489d11c17a9a13b26fdd8bf95c33e223b0f945a619165101150530b15885fa4673014f6944faad75650ac09ad11d594b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714640, "uuid": "56b66542-a439-4419-91a2-870ea5fcb9e8", "value": "T15F541915135C7D07D59EAA73E4F1210D63B8A4B5E9C7CB0A1844DF690FE1390AE32BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714640, "uuid": "f6ba14f6-c256-4ffc-9618-382601d46d94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714640, "uuid": "4741abff-b6f5-4b25-a50f-e3fba49f68d6", "value": "6144:Ol4yl5iXmGNQHayhWc7F+byYuESGUCrnnd11jVn:q3o2GNQD50ZuE8q1jVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772714640, "uuid": "190beac0-6380-4940-9e17-4c2a45a4beff", "value": 306424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772714640, "uuid": "bc54eb45-1681-4d6d-8123-281be57643f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714640, "uuid": "1bbe7fd0-b22e-4f47-9661-5478264e9321", "value": "Fuet Corp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08edcdc8-187d-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1772706072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706072, "uuid": "029e4758-8995-4f9d-92c4-feb120d818e2", "comment": "Malware payload (Efimer)", "value": "b19487fae58e23111e324e3068249be3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706072, "uuid": "d63d0fad-b23f-4ac4-a590-1ef448f19500", "comment": "Malware payload (Efimer)", "value": "85121674bef601cb9d8fc254312fa841b9c46f5f622595ec6210482732886413", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706072, "uuid": "0aa5862b-a739-4ad8-a05c-01a2b7f1af66", "comment": "Malware payload (Efimer)", "value": "f1df5643a08a37c6913e353edbb5efdfe3e150e0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706072, "uuid": "d45ed2f9-18b9-4e11-884c-0031c57eda93", "comment": "Malware payload (Efimer)", "value": "77546e2811df9e7bab0760cf87df8cbc5ee22c058466b1e5e1f3a9b7254819e9edc5e17bb665a2b52ddb83b080852be0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706072, "uuid": "1ca106fc-26ce-43d9-af31-7cc56a80651c", "value": "T12ED6331849C9F1AED36280347FE389F4F4B8B8A011398C7FB6A4E7745D2B970566C593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706072, "uuid": "2d122541-822f-4ba1-941f-cfe3e56da854", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706072, "uuid": "cbec2195-ded6-4568-a55d-493b7147a10e", "value": "196608:2MQCn81wlLf3sgVddwARkBjJKFvsbzXMCHGLLc54i1wN+MCOIPIcu9KYK39sI3PJ:2HM3V00GKF0vXMCHWUjX4cuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706072, "uuid": "ba007ce9-0a02-41ad-8cbd-630a347540c4", "value": 12620201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706072, "uuid": "7416713a-a05b-4cf7-a24f-bf1826182318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706072, "uuid": "6a251b8b-ab56-483d-8a65-adaf620dc677", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5096113d-1893-11f1-a769-42010a9c0008", "comment": "Malware payload (ResolverRAT)", "timestamp": 1772715641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715641, "uuid": "4deae979-e3d1-45fb-8d2c-9d499e1ec9a6", "comment": "Malware payload (ResolverRAT)", "value": "43bfb580c664206153734859442ead26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715641, "uuid": "1362a404-06af-4819-8942-f8c79136fbf1", "comment": "Malware payload (ResolverRAT)", "value": "87053d0ad81ac3367ef5e6305f4cf4eec11776e94971f3f54bc66eaddf756eb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715641, "uuid": "76d7aa56-874c-46d2-b7b9-edd932914d6a", "comment": "Malware payload (ResolverRAT)", "value": "70188c653e409b08f1591f5c7fd95e4716edf649", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715641, "uuid": "2b21ccfc-8795-4a33-aa30-caf3f3e04683", "comment": "Malware payload (ResolverRAT)", "value": "9a8ab78d274714fbc118982c6a530b9596a9416a85ee0b1d6b8fd8f2a870ed481c009f1a74b10fc7a618eea8f221c8eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715641, "uuid": "78c84c9f-c0b8-4383-9ef0-fcc7e552b388", "value": "T101D49E7776934E21C2890373C5DB4E4693B8A682B6E7F70E7145239614063EFEE0B267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715641, "uuid": "f3722714-221d-49db-b033-344e25d08aca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715641, "uuid": "a8e7ae74-4e35-4d65-9706-cbfcd30d750d", "value": "12288:x0PRNYLhJdkEefw+AAf3BEODSPGepldpbGhp:wNe/kThfRFDSPrpld5G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772715641, "uuid": "11efac5e-3411-4b78-8203-4fa15beafe33", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772715641, "uuid": "bc87aa61-9de6-4028-b66f-25da8a1318ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715641, "uuid": "5459a497-20fa-46b9-a5c0-97bd376fa841", "value": "donut_decrypted_netexe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae993896-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697760, "uuid": "f9ba7bd0-132b-4829-ae40-35716bccd0bd", "comment": "Malware payload (PhantomStealer)", "value": "375314632c77821f2fc806ef6874c02c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697760, "uuid": "8bfac46f-f765-4021-858a-abc94376c231", "comment": "Malware payload (PhantomStealer)", "value": "874b26b75848f66d92d180a7ca623deea0d93b004766ad7426302bd11ea0dc63", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697760, "uuid": "49fe55b0-f9cd-432b-af8c-0f5ffcb5720d", "comment": "Malware payload (PhantomStealer)", "value": "3f76fcd8eba920435fb6e6b1a667856ef949a235", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697760, "uuid": "f5597930-5e0f-4c7b-8d5b-f4a01c4f0b66", "comment": "Malware payload (PhantomStealer)", "value": "c5e237e9cdd19c956423e31aa2e235f782752d664c9d6058236ceaa7de7ccd7763fac48a4ee83decf238e720748d7245", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697760, "uuid": "85fe9b68-c6ca-476c-a34c-35b07e746ffa", "value": "T1EE7342CC36C7F2A4C2552477252B75A6FE7E0C8470689B84CE8528BCF97C704AEB55B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697760, "uuid": "6f0a5c71-eb3d-47ff-a4c0-5adfe610b127", "value": "1536:DRpVyQD+579sPDo3BoHVy+FrSWF3wobsuxdyXZ:Bw5y8+4W/bsuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697760, "uuid": "d80add4c-03ff-4225-9156-50c07d4360c0", "value": 78379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697760, "uuid": "3c9496e1-5d45-4cbf-960c-bc7569451289", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697760, "uuid": "c4ff53da-0a0c-4e58-91c9-c1c2675f56e0", "value": "Technical Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bac547-18a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772723790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723790, "uuid": "92c1b4ff-6154-4055-acb0-76a577f0974a", "comment": "Malware payload (Smoke Loader)", "value": "1f159bce6405239f7fcd11fc2ad866cc", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723790, "uuid": "0da63d02-2545-421f-b45a-5dd2975769be", "comment": "Malware payload (Smoke Loader)", "value": "874f222694fc355fcf570b3bb9c69f85ea1a6f5ea4a02d7eb847b9b38b56bbfa", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723790, "uuid": "4baa373d-8f51-4010-95fe-1523285a4cd6", "comment": "Malware payload (Smoke Loader)", "value": "2fad361d9cd50b27957dd6ca5abb16b104d02b69", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723790, "uuid": "b830f3a1-5d8f-4c8d-8c90-5b4e81aa46ba", "comment": "Malware payload (Smoke Loader)", "value": "897f43c6da383ed6516f1fab4c83ca3c7b330d943fc6e8c19bd819412f6763a2d1f0b582cc24dcab01db74f967cd4dbc", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723790, "uuid": "3f14ddfe-fc47-4907-b8ba-176e7b2ba9c9", "value": "T1EF86AD03BAD84079E4BB92348ABB4252E771BC150730A7CB2654B6BD2F777D05E39722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723790, "uuid": "a7fb4b26-aaa0-4944-8b36-46d8e0372d35", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723790, "uuid": "3e3098b7-949f-4d36-81cd-31bd856b3eea", "value": "49152:VDSWGtcSsPB2Ay/LMYgt29K1K4VavIEB1D2Fik5avWk0AvbMCSO8SJWDVFx5XjKT:zPYAW4oXbMCWxBKppqH07eJ1hJuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772723790, "uuid": "4a5c6cd0-210c-4491-8d37-54de0390398f", "value": 8496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772723790, "uuid": "d9ab7533-07a0-4c4e-9067-2901fcb46cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723790, "uuid": "ea9e31f0-c0f1-479f-95ad-64b6105f9f7a", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega]_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd717af-187c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772705808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705808, "uuid": "68ab879a-fdcf-421b-97eb-bc73872cfca5", "comment": "Malware payload (SalatStealer)", "value": "83787e6441be7a650b4bce888fb1da2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705808, "uuid": "000dc355-c27d-4cdb-9ec5-f21e8b6a41dd", "comment": "Malware payload (SalatStealer)", "value": "875f94128f8f75a5e7bd3b6ef457a5513350f8688bd64e7c2e3ed2289f99cabd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705808, "uuid": "bfe16c4d-e46a-43c3-8c3b-82201560f616", "comment": "Malware payload (SalatStealer)", "value": "249bc76159a127c1c7d8b846c534d8b6b25850b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705808, "uuid": "789ddd5b-4a50-47c5-a969-af093bfa70e6", "comment": "Malware payload (SalatStealer)", "value": "291fd7503f91182e82b3f0c9992e604bf37616626c6f38829b7087255b94dfd253d3b2a83f0ef372a1148bbcc60d8a45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705808, "uuid": "5707a455-6869-43fb-b23f-0f20910f21ed", "value": "T1BB8633226B7700F4D477E0B1DB8352B0DE3A383A4A66FED7053AEAB14D24DD64739246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705808, "uuid": "1c4ca482-9085-4e35-91f8-85cb0bda3635", "value": "6ff44c999c6141823bc0f613fe7a6be3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705808, "uuid": "26732373-141e-4294-ba0c-3230ceea1601", "value": "196608:nXJV3aAVPCFOybWiAB1MQoN8755Xg6MOLmyo2Ae:nXJVbQWioSQoN8HXPJo2Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705808, "uuid": "aafb75a2-5b5c-4fc1-acfc-e84faa885868", "value": 8120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705808, "uuid": "9dd23c5d-db0c-4002-b753-4ae26d3e9efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705808, "uuid": "67eaee30-1e87-43d8-889f-1c323bb4785e", "value": "ZcaLoader 4.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa104a00-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703470, "uuid": "951df70d-418d-4261-9048-f09847df4252", "comment": "Malware payload", "value": "05eac77511d892cce22ec23c894c84fd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703470, "uuid": "e4ed4fc4-1460-479d-854d-f37ea0e8efc9", "comment": "Malware payload", "value": "87672aaf0e126452f9175587d1def21ff47b3dd4e8af8121281841287be58006", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703470, "uuid": "eb244efd-e489-4a44-adcb-25dd4340ee2a", "comment": "Malware payload", "value": "8efa0e78d70883502e4cbf687ba67e7801135e16", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703470, "uuid": "7cc3584f-c162-4676-ba25-b9fb6bb7b06f", "comment": "Malware payload", "value": "0187a905b3023a95a1005f707e7b7791bb51076742e28ae9a7f89ceeb6ef212f2ec0ac72a4c0799f9527e3ec11cd1fa8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703470, "uuid": "9556456e-9be2-448c-b2f1-34376bdad837", "value": "T1415197EDB4348475BAE8DD3F329E828429DB5CAF19D03B44C8E67CA2409DC186DC9D76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703470, "uuid": "7374de04-309c-40e1-854b-4c0c9fda4c03", "value": "48:BMIoRMo+a3SroKdrOo4ooh8o08oXYoj2o7G2zo/GoCwL:BO9+KS8KlSlGD577E1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703470, "uuid": "2f3c41ba-6c7e-4354-8dee-e07e79d475cd", "value": 2910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703470, "uuid": "7f3c8e49-492b-4926-9047-15fc9c2087c6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703470, "uuid": "4b113e63-6ff8-495e-ae6d-ab8b729521ed", "value": "cnd.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2942ae8-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772697874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697874, "uuid": "452afac7-62ee-4705-91a9-53bd58a17b97", "comment": "Malware payload (AgentTesla)", "value": "dcdb79f793d7ac04be0776a006a09b74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697874, "uuid": "6c7f1436-7d01-4072-bdec-ce08521be24f", "comment": "Malware payload (AgentTesla)", "value": "87c1e37e1b037a033c057b09deab5235c1ff15ff4ad4dfea750de165d1637d33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697874, "uuid": "32274c1b-c5a7-4d14-9111-a103b559c1b5", "comment": "Malware payload (AgentTesla)", "value": "ecadf5a11b676cc47c9a608f39ae8defe3b2dfab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697874, "uuid": "e38ff810-0178-4513-a5cc-670a79b00305", "comment": "Malware payload (AgentTesla)", "value": "5e3d35892a5afe6beb84d022e2b0c4fd1812015e443c12761ae30333201dfdb7d5c9c2e8d657659c57c0b8f440d8e420", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697874, "uuid": "cc0968e6-c9c3-4d9d-9c00-2536bcfee1a2", "value": "T15D55D0D4CD04BFE4CEAC4E4F6C5D448EB2518E5D23C83E8A8F26ABF6CD1E5811817969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697874, "uuid": "ac1beb71-2185-466b-86b5-cdc847bee6fc", "value": "24576:H3wJwfJKDjdjjCyFQDPpLJfshDHgBO62oVb2qblikDvWqbES3ioXLq:H3UwBKDjdjWyFQDP91stHgBO62oVbgma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697874, "uuid": "b88542b3-ed7f-4767-8ebd-108ecd8a336a", "value": 1403955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697874, "uuid": "2457e4d4-0467-4d9f-83ee-273ea10d1c44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697874, "uuid": "2cc3cafd-2de8-48e7-bf8a-5159ef9d4805", "value": "dcdb79f793d7ac04be0776a006a09b74.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cd5f97-186d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772699599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772699599, "uuid": "6a339286-0bf6-4cdb-bc43-0f8d074f23a7", "comment": "Malware payload (Mirai)", "value": "30e466d7897fd98fff1bbe59ba4b0a6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772699599, "uuid": "ccf6ea60-ec2d-4afc-94b9-5a40d1660567", "comment": "Malware payload (Mirai)", "value": "8857939ea63369b0ba33395a9ab3fde0ee42d0603c106f7c65de0c2824834183", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772699599, "uuid": "3cea784b-cf33-4ff0-8783-b5fad1a22952", "comment": "Malware payload (Mirai)", "value": "bcff15f8aa18c353127f3d21d72b0020ce85c709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772699599, "uuid": "9d90b588-3d5f-4ce1-95d4-19d58bc38185", "comment": "Malware payload (Mirai)", "value": "a13447ad6150a1e02900c4937621a5e822a2d548566bfc5ab1e138d9c772a519f8e044ac9fdde4ae28bc30bf2fba9604", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772699599, "uuid": "556863cb-bf42-4e4d-9cb4-3d3078a52240", "value": "T1C7333C4DF783E0F0DD4B0571115BF77E96349E025124DE7EEB98BE62AE32A02711B618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772699599, "uuid": "86fe5c36-71b7-4fba-9658-10acf6d16997", "value": "768:zwheNR1eCZWUJ2S7pRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98EN+s:zwOt37pOzwLMU431ANA0BLBCIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772699599, "uuid": "9d341952-a941-46a4-a9fb-61a64721895f", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772699599, "uuid": "fa15c6c7-28dc-40a6-b83e-e9916e2998ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772699599, "uuid": "6045972f-16f7-47a0-9aec-00c0f31667fb", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b538ad-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772697930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697930, "uuid": "02b2f5da-5305-4f6d-a4c2-42c488c893fd", "comment": "Malware payload (VIPKeylogger)", "value": "c5f41e07d7087035bba4d229621ada4e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697930, "uuid": "194f7260-89b7-42b1-9798-b14e8f95a6b6", "comment": "Malware payload (VIPKeylogger)", "value": "89120aa528929acdfb1def01b3934f578bd45a9c6dbc2f2291a136bd92145bf1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697930, "uuid": "817c6a37-76ea-49b1-b475-cdfa377bc181", "comment": "Malware payload (VIPKeylogger)", "value": "e1ad5c2d2d6eb8a75552da011672d181462a359f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697930, "uuid": "e1bce7c4-cf01-4cc5-a2be-2b7036332dc5", "comment": "Malware payload (VIPKeylogger)", "value": "e5587d5ae5e0c6080e96d3c6f644bc5abcf3ec0cfc395128e6232fe3eff2ef65e318a8816f1e2a2e3ba12c68e0c88922", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697930, "uuid": "11398dd3-83e9-4167-a12a-4dde6647ad72", "value": "T1966229994E17D8F09A9936605CEF0B61CCD24520C026C165B1DFEBB13314BA8E9F89DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697930, "uuid": "7a16a1d1-46f5-47dc-882f-777529b52196", "value": "384:JSsgYWVXowVlusmD04wpIfVlEm9sduVByv4QP7BGlwG6xN0hYkD:JSswmwCsUfVm4QP2Mr8YkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697930, "uuid": "23c0ec7a-26ac-433e-ad46-4cbcccbb553d", "value": 14788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697930, "uuid": "fc21332e-d563-45eb-88b0-3276e5ae42c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697930, "uuid": "f3c11d55-4a3f-49aa-bc38-8caace0d0917", "value": "c5f41e07d7087035bba4d229621ada4e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6afa00-18b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772729138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729138, "uuid": "07f8483b-5b75-427a-b569-3b06ade567d4", "comment": "Malware payload (Mirai)", "value": "793bcd2a20bb790f5b2763f8fd00184e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729138, "uuid": "a5ce41d1-812f-42ab-8560-7c5648c978a4", "comment": "Malware payload (Mirai)", "value": "89cb34cec88e4e198358ab7869d95015e886ad8285caf6d8eb892f05e23f5ac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729138, "uuid": "909a4220-ca28-407a-be1e-1f6a487e06bc", "comment": "Malware payload (Mirai)", "value": "0db950a859f1495326d36bd2b91772d60429462c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729138, "uuid": "24347e9a-3d23-443e-b10d-c437cf0e989d", "comment": "Malware payload (Mirai)", "value": "215a5ded5b97ff1cc1fa9431f215a9bd022b21e36a0ecda339a36b9cef8a920f9608319aaad24b245c44b726329301e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729138, "uuid": "4ec4cd99-46fa-42d0-a7f0-45e46e044bd2", "value": "T16E231894B9819A16CAD0437BFE0E42DD3725A398E2DE3313DD225F6137CB92B0EA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729138, "uuid": "e47d9fda-1b07-4a3e-93c6-099e64499e58", "value": "768:UXYesyi5wPVQEkJVvOwxPFV4iRu6Jj3oSCR6gPj5+uB4Pl5Q1vL0xkbUFqBgEk9H:VZe4vrR476JdcPj5+uBaluOObUoBEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772729138, "uuid": "5ff0e397-5a8b-474b-bcda-f6553054391d", "value": 47940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772729138, "uuid": "7e083cd3-dc38-4c56-a4fc-566c9c003e8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729138, "uuid": "a2bb4bad-e0de-4f44-b8a7-e1742c92fcfe", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2235ab-1865-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772695852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695852, "uuid": "d322aa21-c357-41c6-817f-5a132d7b38ef", "comment": "Malware payload", "value": "964670dcb0a2813dc969a93e9f24b594", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695852, "uuid": "ce585f18-1f5e-40ed-8f98-8bf8db67ddb2", "comment": "Malware payload", "value": "8a8121b8aacd9275d6f52042acc3f4523c5578dcf8d23e335866a11c43c5be85", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695852, "uuid": "68836d7f-c4e2-4a53-9a8c-575908d82536", "comment": "Malware payload", "value": "cc913e3f0e8e82d76e78b6da40435db59ad04a79", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695852, "uuid": "9b4ae506-e662-4437-9238-845e6e578bb1", "comment": "Malware payload", "value": "566fdd21b6eb8913191c87dc770ea87b42b9b5244f04ec8c3e48f74d62ff9882bfb37c8f7c6377333e0d215437f2a21a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695852, "uuid": "66810bcf-fa5d-412d-ae6c-c5f84ec0b9cb", "value": "T172471282F7A0CAB6D4FE023A41B7421263174E15CB839B471A49FABC2D735E49F4DAC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695852, "uuid": "1c21cb1a-db4d-4c87-af6d-3ffad1855e7c", "value": "393216:fJHPzQOvtPw/kO7gSkVzsagmAHjJmCzi8kjQOHEuoxOkMy:xHPzQ4tYMOAzsa0HjJjijr+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695852, "uuid": "8ba1936d-d0df-4f81-aeca-7242796b581a", "value": 24927394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695852, "uuid": "cd42f4bc-7bbe-46d5-ae54-b9e0b14c60dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695852, "uuid": "f3dbe377-8312-46d3-a543-e6d4dd7bc6b9", "value": "SriLankan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff527ba-18d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772744067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744067, "uuid": "124560d1-1e01-4a5f-b59b-3650f2e9c7ae", "comment": "Malware payload", "value": "0f27c804793fcb1407de72e6700ff4aa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744067, "uuid": "44de204c-d022-4769-9c78-8f0e1db6faa4", "comment": "Malware payload", "value": "8ac2937526b3569cff78d995dabad41190c18917b2bb3879ce08649838396c05", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744067, "uuid": "2d218334-2394-4c97-8bd1-758c4771f172", "comment": "Malware payload", "value": "0a58135b9124cad25257d917beeae7984217c31e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744067, "uuid": "4ae74710-6099-4232-816f-20f4df343a75", "comment": "Malware payload", "value": "2cc1e90f5ab3ca7c40a4fce0329907316b5f94ceeb3d6e3b10605bdfe43b0206d7c4bcb144e5bd8b3a93b9681563c1e4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744067, "uuid": "13f838d9-d9bd-4240-8f35-b4d99a93ba09", "value": "T19236335CFA842983F64D26EDE7C08C3513094BA5485F6CDFF91A3A0D91B905E2F3E52A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744067, "uuid": "bc1155d3-d8f8-43aa-9a23-0a6af652a4f2", "value": "98304:OsMV/qBIjISpAqXgQE3yTdJIyYnjJKjsJiJo644sldePwEsZ35ncx:WljImAqX/cwJIPUjsL645oYTZJncx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772744067, "uuid": "7a9481ed-f476-46be-865e-7b70fd96ba96", "value": 5239305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772744067, "uuid": "c23fd430-1c59-4315-b5c9-dd532d7549f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744067, "uuid": "8212bd23-01ca-4d2a-a8a7-ceef45a0190e", "value": "RX120-DOC_CITACION_PERSONAL_REF_005-851-582-95-21-16-02_128-003_PDF_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11124429-1871-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772700932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700932, "uuid": "29a142d2-e811-4af4-bcbd-351c125dc577", "comment": "Malware payload (Mirai)", "value": "0319f040b4507aa76fc007e19fdc4f59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700932, "uuid": "cd0f75fd-d50d-40ba-823c-2d61622478c2", "comment": "Malware payload (Mirai)", "value": "8e0eec925f9ae9f297ef23528ad440d558d68adbc04c1d7b5a543f593826c239", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700932, "uuid": "de647084-68cd-48ce-9d74-7f7458d50c9b", "comment": "Malware payload (Mirai)", "value": "b06b2f8b0e17a8c4716aa59f1f60c70c770c90b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700932, "uuid": "c155984a-6f05-4528-b92f-a520ecba1f37", "comment": "Malware payload (Mirai)", "value": "e3f455a1ebdc6ad975e194060fde7a963aa3b1a834535a6a23dd5b43431b30ca0be85df435a0df7cc8f9b2276c756a39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700932, "uuid": "d876d113-9b65-46de-9aa1-ae9d59435fe0", "value": "T19D931244E4DB59ABAEF0185CE666718F943541FCD7CE3203A3740BB8A30A167AD9C462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700932, "uuid": "a81bb142-39da-414a-b467-6f3ce189272f", "value": "1536:IcYnjzOGu9SB+woQOZLag05FH5lxDDlcXts+JZmGGX3Fh7o+NLrV/UwPO/VODKSE:IXPFuooQOZmFxXx1cXhq3F1o+NLrVcWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772700932, "uuid": "e22f5154-8acc-46ee-94cc-441b79793bbe", "value": 90568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772700932, "uuid": "6b9226a1-010b-4f7b-87b4-23e52b32034c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700932, "uuid": "155ad6c0-a859-4939-9dd2-72bc263fb308", "value": "Polar.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd954cb3-18b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772729246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729246, "uuid": "bc8583f9-d161-4bed-ac8b-32100bfeafe8", "comment": "Malware payload (Mirai)", "value": "44f214ed3ccb79194ba8a3cc139369ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729246, "uuid": "9bce4bf3-c6c5-4934-aad8-000ca93820b1", "comment": "Malware payload (Mirai)", "value": "8ebb277cc8ba92223fea3377097a7767dc52ad5a94212dbb492d23ca494c55cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729246, "uuid": "b526181f-e12a-41af-814d-d3f9a4d4205f", "comment": "Malware payload (Mirai)", "value": "5092e674bf9529a1a0eff2437b41a61ac5b84a4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729246, "uuid": "3199233b-3588-4a81-9778-289f3682f4ef", "comment": "Malware payload (Mirai)", "value": "f71e16930a06525bf6afdefa1ab3d90adfc7cbca0cafbcf819fe6faf6e257549e1be2b1e22aa017cb9e3432a93dae5ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729246, "uuid": "763dd22d-a537-4ca6-acbb-213157263c71", "value": "T1CB1339C59A43C0F1EC1112F110779B519FB2A436AA79FB47E7A93A32FC02B1196173AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729246, "uuid": "52044475-c2bd-4d29-80a8-372cf3d4283e", "value": "768:x73jOIDzzrq7WiEu+RiUjrenEx63a7x2Vq1z7yvEdTpKMxn:FjOAzwvEuP4anEgwekWItKKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772729246, "uuid": "32409de3-c08d-4438-8eb6-8744af34159d", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772729246, "uuid": "86122576-e7f6-495f-adb1-bf04f6000246", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729246, "uuid": "c3bbaf02-ea8c-4076-a621-97794e730700", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc1f229-1861-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772694457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694457, "uuid": "ebec170b-4669-4d07-a801-094058b1845c", "comment": "Malware payload (AmateraStealer)", "value": "3b1646a664c69643460c8b53c566200a", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694457, "uuid": "64eeeca4-c074-4483-9a45-7f6a65bc6542", "comment": "Malware payload (AmateraStealer)", "value": "903e3b20852eb6b2981336d045befc77286299d461af10658b68b20912d00c00", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694457, "uuid": "2f96f26f-e10d-402f-bd67-492d1f8284fe", "comment": "Malware payload (AmateraStealer)", "value": "d838f28b59ce1762e15090f273e539e88c7a2c11", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694457, "uuid": "a139de7b-2eb0-404a-af30-a67eee98f720", "comment": "Malware payload (AmateraStealer)", "value": "ec9647a122e23b638ed0acb38c7bfabfdbb9d05e1203bd4ae5a26bbbf4cd5bbd6f599267486dc788bd1ff9f14b535c2d", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694457, "uuid": "137cc406-1e66-4901-9b6d-a450a837a21e", "value": "T148F52312BFDB19B3E312093AAD05D410CD62FAE111D1B1222CB8D78E1DFB8555ABAF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694457, "uuid": "8a6881e5-9c8f-48ca-b5fc-36848333cf2e", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694457, "uuid": "8dd1b5c8-b202-46a7-bcf2-822fcd77385c", "value": "49152:LUQf9mucJZCliSAbFXHrZy0HCxgdjmyZ3xoJt17kLz5P3mucJZCliSAbFXHrZy0j:3fQbClDC9Fj6jkLlP2bClDC9Fjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772694457, "uuid": "72685e22-b92e-4b0b-a75e-0baf8b14cfe4", "value": 3423120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772694457, "uuid": "a1b96ae1-aed1-471c-9bb0-dede204b8378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694457, "uuid": "3908af23-e08e-41e9-86e8-ba4a2c53bd6d", "value": "Win_Driver_SSL_support_v43.22.209.44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cfa044-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697510, "uuid": "205717fd-a445-43d9-9813-77160dc3e815", "comment": "Malware payload", "value": "b1ba42bb2d1a2a75dc4081217837e8b7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697510, "uuid": "1c58a4e9-ae7b-4ffa-b4e4-ece26a91ea5b", "comment": "Malware payload", "value": "920407e542ba23aeedb115652543d6641c301a2e394fd6d4b3860d58e8b97a5c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697510, "uuid": "32f2ff6b-dce0-4c08-8d78-07b5a1a61742", "comment": "Malware payload", "value": "f15fcfc93c89b988ee412cafba678bfb267ad3ff", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697510, "uuid": "94db2089-091e-4d37-8350-7d5c29f4e8ba", "comment": "Malware payload", "value": "45ebbbf6ded47d51d5a113bead7a718db89c48a952e0831cf8a1ba0f378ca691530548675483b4a0c6b34c064f855e3b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697510, "uuid": "e8450ccc-e39d-4f0f-af1c-1e8d49dbd663", "value": "T11783CAB5C521D42A04DB5509890CFEB0E8AAE0036F18D77A7A99E473D3BEBCE54B44C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697510, "uuid": "50850b5a-80da-480c-bbdb-aa080c937420", "value": "192:lWWWWWWWWWWWWWWWWWWWGyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy1:lWWWWWWWWWWWWWWWWWWWuAgY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697510, "uuid": "692cd26d-fa21-4abc-8e83-3e009c1d626c", "value": 87727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697510, "uuid": "5d82329b-8d5a-47d5-808c-8dc51f81642a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697510, "uuid": "cefa8b5b-fcbb-40e2-877a-9384887f101a", "value": "PL10-03-2026L.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95dd268-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681511, "uuid": "83e73102-c56c-4005-ae11-20a450389ca8", "comment": "Malware payload (Mirai)", "value": "aff5211bc2ac942be1a5669d2891000c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681511, "uuid": "fe344f5b-56e5-442b-b188-c2c9429cb366", "comment": "Malware payload (Mirai)", "value": "920ac1054baa05797944f7e50ac72c85f12a44b88216965426160065c310b22c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681511, "uuid": "f33f738a-6c46-4a27-94b7-f967a50c4cd4", "comment": "Malware payload (Mirai)", "value": "96374f1fb9b9e6db395df7b1061afcbc774e4eed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681511, "uuid": "37a9247c-c03f-4a77-88de-39ed468fc515", "comment": "Malware payload (Mirai)", "value": "e2e7ab314dc1fc85cb3614ac4085c760989ad93c1c98902034d7956371dbdb32aabd7ac43ff3b1c52f0ea5c7301bea76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681511, "uuid": "cc4d0057-71ef-44c0-a750-b7fe44ba768e", "value": "T17E6302752E45D0BB08F3E131874D84F331762F7272B263282DA38D5A1DAAD44A971F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681511, "uuid": "1163bd77-d7bb-400b-a62b-29dba3826a9d", "value": "1536:J0cXofJMTGPBpBwGADwdsZZBxsSwoefJoKHXnucrXzd:zbGPwDwiZUzf6M+crXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681511, "uuid": "24149d91-d74c-4b8d-ae58-a16f5b049f06", "value": 68656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681511, "uuid": "2d25f157-b0fa-408c-a3de-ea1fb4093c77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681511, "uuid": "726478df-9502-4ff1-9634-fc010d085f2c", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a02b9f-187e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772706845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706845, "uuid": "c7159b3d-e8ed-4868-bbad-55151d284c2e", "comment": "Malware payload (Mirai)", "value": "d473a3993547af293d70689f157cf7ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706845, "uuid": "18da1509-28dc-445a-9776-72f7a54578e7", "comment": "Malware payload (Mirai)", "value": "92649fb0942ae89f3315484c7b2bb209f66dc98244ab4558418a186a4d2dca86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706845, "uuid": "b71cbf70-e79d-4de9-99da-060a1ffcdba0", "comment": "Malware payload (Mirai)", "value": "e3ed56d64fda1d68c891ce0694d78382755019c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706845, "uuid": "e6af6320-4227-4ee1-bd35-774d6b64c1ab", "comment": "Malware payload (Mirai)", "value": "ba051d82c7a14ce2fafc7b0379a9531fb81708240672f41a46250df4d391d25cc2c615e1d276d2bd4c5ddce1e2823a3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706845, "uuid": "6726df36-c201-4d57-8e02-d8be7f18c5e5", "value": "T17DD35C0673180E17D5A349B02A3F1BE083FEE5D121F0BA89691F9B6A8676D371485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706845, "uuid": "8af04e89-227a-4ca8-9ed1-71d12983b5d3", "value": "3072:CV0zui1ZhMHJCIqWrpP7OUK3y0uMg9FkBH:LP1Yiwd7OUKC0uMg3kBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706845, "uuid": "2d021bcb-00f1-422a-aefa-4390b5f24d51", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706845, "uuid": "664ad545-6f88-4697-a206-9012230d4bf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706845, "uuid": "acc4bc1c-0335-4a21-b514-0fa4430b527a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ea8242-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697853, "uuid": "1bfc0e15-c742-46ca-bc4c-68f92e8e7f91", "comment": "Malware payload (PhantomStealer)", "value": "1200fbbb73fa6ed80cc94315acacabe5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697853, "uuid": "8944d614-1b95-4018-85b4-8140aafbe933", "comment": "Malware payload (PhantomStealer)", "value": "932d2427cd74009d79c812e8f681f64f8a1166e1298bd714e71274e33db57d09", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697853, "uuid": "3a950c91-2eab-4681-99ee-fdfafeaad476", "comment": "Malware payload (PhantomStealer)", "value": "09b4c70153465ed80e4e86a8199c7c60747c830a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697853, "uuid": "29f9edb9-09af-4532-8c17-1518523dbdf2", "comment": "Malware payload (PhantomStealer)", "value": "581b1378d48fcce606bcf96394875d1b73cbec2671e46989289b323875c150f054c27b8c504fbecf8706c1f001bf5878", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697853, "uuid": "a15ce58b-faec-45c4-82d7-0827381053de", "value": "T1B526BFB009A66F75C517570BE17A991CC3F0A46A723F3E74CE3E7622B66F100B56A09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697853, "uuid": "9808125f-27ae-4dbe-8310-457cbb0b3a0a", "value": "49152:ow+sjsUPtLEaTVkEJ7PLvriepRy3OaKetf6DTZ7ou5zllij1anzGS:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697853, "uuid": "8676afcb-a2d7-4e7d-8387-bf3685a008ed", "value": 4656105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697853, "uuid": "52656e2c-e732-4167-85d2-da98327a217b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697853, "uuid": "2fbf1b03-43ff-4b4d-a80e-47fe63bbebcc", "value": "1200fbbb73fa6ed80cc94315acacabe5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397a9f10-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772697564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697564, "uuid": "c589cde9-0b7d-443d-9bd9-ddb14eaad663", "comment": "Malware payload (XWorm)", "value": "cd47374a6f3a78dc8c4803b28b48f1d9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697564, "uuid": "82231622-0cef-4ea8-9a68-0f12e895a0b1", "comment": "Malware payload (XWorm)", "value": "933c8e5505db7db2c4b2c17b791ad133e35a38ec0ba7b02b9246e066f3fbe4f5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697564, "uuid": "4dfada11-2246-45c2-89f6-95a29b2e83ab", "comment": "Malware payload (XWorm)", "value": "c06a258596358585c66b619ffa9b43599b56cd35", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697564, "uuid": "5e6476f9-97e9-4e8d-a592-29d091a42f29", "comment": "Malware payload (XWorm)", "value": "fec12f10fb1f4a01d190230324d2bef821342b015e0a06c552d6bca2eec850f5c4c1410726890d741f9d9aecf5ee35bc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697564, "uuid": "ac0b2f10-e773-4559-a6e8-85ea4e1b8741", "value": "T1BD72733AE918DFF40B1E61E5118B7C06605457A7B53A49BDB48DC0687F27B108FEA8EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697564, "uuid": "540e8839-31c8-44b2-aaba-3331425c7259", "value": "192:ID378KFAPplHaAkqRyibhnnwAsMwsGsyHi7CTysroGdw8P5d4P+CTvMPvojW17J2:orCzrDQibNwAZGE7tscGq8xir1C/qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697564, "uuid": "a77a75ed-5435-4c3a-8d0a-f0f3369173fd", "value": 17005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697564, "uuid": "fe37d4b0-df3f-4b34-bbd1-6820a24776e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697564, "uuid": "47127a6f-585b-4422-bc5c-7c45ce9e7b91", "value": "cd47374a6f3a78dc8c4803b28b48f1d9.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf97814-1861-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772694107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694107, "uuid": "183e3f2a-646f-4ce1-af63-db8654404904", "comment": "Malware payload (QuasarRAT)", "value": "37a43b6b81e933fc6e19a93c443dfd84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694107, "uuid": "4cf93734-8935-4fbe-9760-c13e7cf02f28", "comment": "Malware payload (QuasarRAT)", "value": "9382df4bc0f53192bd444266bac725b836d3633942fbbf617648536e449cf39e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694107, "uuid": "e3d94231-7ca6-4790-b758-713e985eb0b7", "comment": "Malware payload (QuasarRAT)", "value": "fb457795bdc6e2b6b23666e026edeb97eb5d940f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694107, "uuid": "6bd2aa31-65dd-495c-8869-a12baa4297f6", "comment": "Malware payload (QuasarRAT)", "value": "24f2d2a2d4168626398237710a41d8e828a0996a8981d5554bf4ec8386a63144212525302f7cdeacbfa2587013b8de95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694107, "uuid": "94a72d88-250a-4d0e-9068-475cef38d29a", "value": "T15CA622EB64BE675C8B4B5C74BCE031CEAF874B37883E92D20693625C14385CB59129B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694107, "uuid": "cf79964c-4ddb-4fc9-9243-ca1d650da24e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694107, "uuid": "4477e65d-5606-46f8-8ee5-41120249119e", "value": "196608:WloFGZcr71flVCTgJpF2DFAKsmZUGKsSFLTUz8MecAdUodUT6ln1ep:Wlo427VCs2mKsmWGlQ48iAdp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772694107, "uuid": "eed9023a-1376-4846-9ef5-951883bd4c9e", "value": 9612288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772694107, "uuid": "33c2bc21-7afd-43bc-9be9-f7b0829ff433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694107, "uuid": "5f4fe00c-9dc3-48f2-b9f0-4972b227d0df", "value": "PradaNonvirus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1851e954-1895-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772716406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716406, "uuid": "846db3d2-bb67-4de3-8902-937c60add07c", "comment": "Malware payload (Mirai)", "value": "9943571eee105d111733547634b55a8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716406, "uuid": "7563daed-7862-4d0d-ad3a-c3dd1b447d89", "comment": "Malware payload (Mirai)", "value": "93b5833e77dd74c99f175fe3b94e21fd70c50a577f3499225dfb395fbf2f6ed9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716406, "uuid": "e6cdd5fd-5501-434c-8de2-3fe891e59de7", "comment": "Malware payload (Mirai)", "value": "a912ddef66d900363a3e5daaaa0e9f00e06e9c8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716406, "uuid": "65258f4b-73f5-4969-a67b-4b2487878cf9", "comment": "Malware payload (Mirai)", "value": "17663d74f5b9432f2d97df0c9f9755f156f1b068d35dfb8b1777545ee625603c3a05e628cfbbc79c1b961c51480225ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772716406, "uuid": "36227bc2-4917-411b-b0f2-ed20c9d61a56", "value": "T11904971E2F228F7EF668873147B34925A75C23DA27E1D644E1ACC2105E6439E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772716406, "uuid": "166dff86-9bf6-4119-a286-8c63332c3156", "value": "3072:BqaTaALoZli1JqT65VPhONhWD4KXOUjnH:7mAipiVAhxKX3jnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772716406, "uuid": "8f6e4ba8-9ed1-43ff-8eda-f2e81004fbdc", "value": 177756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772716406, "uuid": "dd12e335-319c-4c7c-bca8-25e088f9e98f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772716406, "uuid": "d0820b36-0b14-4c5c-96df-b4300513ff4d", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee33e776-188e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772713758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713758, "uuid": "9c2b70eb-c190-4b60-be9c-5d4fcfcf3a79", "comment": "Malware payload (AgentTesla)", "value": "814060a6838f12e05287e9a8468415ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713758, "uuid": "550feaf8-eefd-4e4c-bcd8-172b11c7390b", "comment": "Malware payload (AgentTesla)", "value": "93e182779e1f7297cc5239f79e12a70c532f3817eb325f8841957e27992facb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713758, "uuid": "00bdc697-9779-43b9-a663-3b872b867b90", "comment": "Malware payload (AgentTesla)", "value": "0a0a41524f63c4fdb172845fa1da7218be8dcfae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772713758, "uuid": "016094f0-0ac3-4579-bfb9-729013d63cac", "comment": "Malware payload (AgentTesla)", "value": "d7444c1933da58cfafafaa39891c5fe0979026cbb466650c2e98175e96c71e76b9dc9696c23d0f4deab9d7996653b6b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713758, "uuid": "0f512a58-f05b-4d5d-85cc-15e77c22e2d0", "value": "T1F075AE15E3E506B5E66BC638CB568733DAB1B842132099CF0765EA152F33AD1AB3F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713758, "uuid": "d045a207-6783-4ab8-b6aa-4d0ecf4a0ca0", "value": "f8f8f7f450d2e669ae095d1632795f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713758, "uuid": "a7834a4c-bf14-44e0-999a-0998f12aa668", "value": "24576:eOJUzNBAcJshxNVp2Xmv5jYrwutsQpl7CYshD8hvu3ZusjtLLF9rcErvqUjx1sof:eO+zHS+mFYFCYe8hvu3IsxbrcEr10Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772713758, "uuid": "158769bc-d1f6-4f93-a232-2d7a6616e8fe", "value": 1571320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772713758, "uuid": "7dfb3432-c815-46fe-904e-8e682a3be1de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772713758, "uuid": "a806c196-1a91-4616-b7d0-00501699b901", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7343d326-18c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772735027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772735027, "uuid": "d3fee7bf-db93-4f7b-bd2c-baa1fc0091cd", "comment": "Malware payload (Vidar)", "value": "d4b54bf3186a2b999c9defd64c85cda7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772735027, "uuid": "23c6b414-58d8-40be-ab2e-062fb53cd3c2", "comment": "Malware payload (Vidar)", "value": "94056a60904d7dd021e4c29b87e550b3d5f507c7f38ce5fcb2599d4104a11adc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772735027, "uuid": "3aaa64e9-4c88-4e2b-9435-02a3186ae76b", "comment": "Malware payload (Vidar)", "value": "69759bed7ec569821b4dc12ea9f40fc5c6762779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772735027, "uuid": "8e007c4e-df47-4404-b3f0-35a53e519aa2", "comment": "Malware payload (Vidar)", "value": "ebf225a5c1ce2e67d8ccfe258409e67a653bc7725523bbce3fd85446905107a8c1c89909cd4cfc0468884a1f8b590100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772735027, "uuid": "7ab4cd4d-b354-448b-a747-9875f80eec39", "value": "T154E6172B76638568C31D823AC4F28B04E5F371BCC776C6E792A0036BEE465D45E7E624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772735027, "uuid": "d9c068ac-e973-4cbe-a00e-941422c6fac2", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772735027, "uuid": "864485ad-32a8-4b9c-a89a-6cf8987a7f52", "value": "49152:OtD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUr:/xGLEUp9VDFtSdOTABlX5jChTMdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772735027, "uuid": "3ec2c689-6813-47c3-ac44-dd840e36a46a", "value": 13960192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772735027, "uuid": "6fbcfdbf-f2c3-47a9-a07b-b272795ed862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772735027, "uuid": "e1ad603e-8b42-46cf-a00e-f4f459b589fd", "value": "SecuriteInfo.com.Win64.MalwareX-gen.32234445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f262f4a-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726725, "uuid": "b344556c-efde-4733-a969-367d1ad241f0", "comment": "Malware payload (Mirai)", "value": "0c055f9e33e8dd9bcce3073c57975561", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726725, "uuid": "1e3e2d78-38c7-43d0-92f6-c2ad9b65861b", "comment": "Malware payload (Mirai)", "value": "948cc0e1c6e035e99dd7d80a055cb0c46aff988836059796cb91d5b21caa6e01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726725, "uuid": "98f4223a-a8d4-4484-bbe1-c32dee5f3b34", "comment": "Malware payload (Mirai)", "value": "2fd6d2b326562be21839b30f155ad70fda964276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726725, "uuid": "0d6a6b47-039d-46ff-b64a-2d60347b8cde", "comment": "Malware payload (Mirai)", "value": "9ea6e05ce4f34d4377bf02414536fcb519480961f1ddc3c195c5dbf51e935ad105e9c5fca3bc50c567ac99ff41b00954", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726725, "uuid": "20068359-b94c-4525-9cf1-534e4848be16", "value": "T12E832982BC81A629C7D0177BEA6F109E3310A7DDE1DA7246CC140F647ADE90F0D6BB59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726725, "uuid": "955d1a79-4863-43d5-9ded-05f3de289c34", "value": "1536:9J3EkjVsUR6GrUQyxcR8SE8UgUR/T6wOmEtMaViYB8t46d0aHvIab:n3rjVsURvV8QNhMaI484ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726725, "uuid": "87d4a594-0a04-4e0a-b589-9563e3571958", "value": 83180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726725, "uuid": "9d7ab515-bb41-40ce-a0ae-e669d035930d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726725, "uuid": "a63edf0d-5d23-4b2f-bd69-0c699f483ef1", "value": "MMaaRRiiOisecTanee.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4228ecf-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703460, "uuid": "f4716264-a8bd-4fbc-94aa-a5e98d6bd717", "comment": "Malware payload", "value": "9e4894de3c0a85a7ce1149eb23c8e3e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703460, "uuid": "5ebb60fa-aba1-4860-a5af-5787125e5efc", "comment": "Malware payload", "value": "94a3ed08ff65a649c87acae42d5e678c641b728ad022cd2d472a1d803a85dc22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703460, "uuid": "b26a6cea-d1cf-4fcf-9f9f-fe1fd5f63ae5", "comment": "Malware payload", "value": "8146c133a3549919cd68a842d2fb89b8036d76c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703460, "uuid": "0af21061-bde7-4589-b3a2-c5cf692dce44", "comment": "Malware payload", "value": "bd18549a737fc72b705437deaa0743a80b2675220cf1eb16b7eb07a2d06e6564fed749afd74220be2efdce93e96041b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703460, "uuid": "31fdfb9a-0213-42e3-a6f0-eb56da0311d6", "value": "T196F312003325267AE3F499FE04DCDA8CAEF4AD2C98195EE6C5F0D0BA12D95079D87E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703460, "uuid": "cb06add2-466a-4144-8cee-c6c4f3105427", "value": "3072:Qk2XkJZMtgy7w2+qYyDWveexVD7y8W/afm4FkYvzScEzhokHbOjWkV1gy:4Fq3qYcWvV7ljfTkYvzuzhokcfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703460, "uuid": "c95e3595-3798-4078-b34d-c5ae2f81332e", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703460, "uuid": "423b88d4-ea14-47b0-8dc1-dd12762ba478", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703460, "uuid": "cd6518bb-b437-4099-951e-60aab3fc8e59", "value": "nlgf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb815505-1834-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772675099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772675099, "uuid": "85184937-0cdb-41a7-83d3-5fa7d37b05d5", "comment": "Malware payload (Mirai)", "value": "b5dabe15cc0a1ea8b25d4eaddfb28551", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772675099, "uuid": "bc53ee5f-4d67-439e-ba6e-5733d0b9618a", "comment": "Malware payload (Mirai)", "value": "94fb404e546ec7ebd3609fe90ee926c0b0023ef9d9e812011892771c0a79049c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772675099, "uuid": "6fdc2e58-7efe-41ed-8a52-3dc613dc6e09", "comment": "Malware payload (Mirai)", "value": "12320c6d74d13b5a10353ab5dfa66285266edae7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772675099, "uuid": "d62845b5-d50a-4dbb-9ced-7760602d3924", "comment": "Malware payload (Mirai)", "value": "202c8822103dab3c939457f02da9310375e5a2740fcd49adb659eae349ab16a0ea48bc61f5a500fce32634fe704488a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772675099, "uuid": "4703ea1a-006b-436d-b8c0-ef4bf8092234", "value": "T1AE4302C683F9A78DDBA963B40CF6F6861071F47565ADCDEA9360A83EC401B1C262DDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772675099, "uuid": "3999a7cd-7b32-4f9c-adfc-73b567df982e", "value": "1536:6rkJrAVlUHvV1KlK3S4KBJTF4vxSeP4jCc7NU6Prnouy8rye:6rkJrAVlUt1YB5F4YK417NU6routR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772675099, "uuid": "fd333e9d-4897-45aa-ada3-f603a3e22110", "value": 58912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772675099, "uuid": "5b7ae6b5-9f7c-468a-b395-9ce9a69128af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772675099, "uuid": "406392f6-32f1-4936-a636-f909021c93d0", "value": "Polar.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e2dc57-187b-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772705453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705453, "uuid": "f867db04-a771-4c3c-958d-12b0b96b0fa8", "comment": "Malware payload (Stealc)", "value": "ca5d6bd56d33b7d56c62f4dad109349c", "object_relation": "md5", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705453, "uuid": "d731114c-56a7-48dc-ae0e-377579006f10", "comment": "Malware payload (Stealc)", "value": "9664aa64777f25cf03d5083cad63fe26eea86c38e2986c195a33b9c1b5fffda9", "object_relation": "sha256", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705453, "uuid": "601bf6b8-8d64-4c25-867f-f0df6d064989", "comment": "Malware payload (Stealc)", "value": "259119eca5574d9d6f6ca05a32387f1067ace75b", "object_relation": "sha1", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705453, "uuid": "13f60a28-a307-4252-8840-07c0d7bcc78c", "comment": "Malware payload (Stealc)", "value": "cf6444d30901e7c4074c663fc999e1eb9fb0fd63e53211bfca6db895a26bfa13cf4167cfd2aa84a8d1af9376ec393a96", "object_relation": "sha3-384", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705453, "uuid": "e10cb668-1be1-4e5b-94d6-c87269120bb3", "value": "T12D317968CEEC3209D0725A38DCBE2351C5797B5CDB1DC5CD0902C24A8861517E4BAB3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705453, "uuid": "a02834e5-f764-4411-8f20-57a7e4846055", "value": "24:8COlHy+lfyN3UibZU5/dUOfnahdn0M+ATsEm/m3WXmN/lvbnlok+/s:8COlS+lfi3pZwqdd0YAEh3ttv7lokx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705453, "uuid": "1e548926-7332-41f2-b9fd-b9decdafe412", "value": 1475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705453, "uuid": "416aa654-cc32-4f30-97ad-8da285126bfa", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705453, "uuid": "f85d475f-4819-48d1-a8c6-3c397cc0eb5e", "value": "Screenshot 04-03-2026.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3705a5-18a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772722964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772722964, "uuid": "99d46bcb-d207-4dc4-a203-a5dc004f313b", "comment": "Malware payload (Mirai)", "value": "a35c5836fd3eb1153995b6158dca3e44", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772722964, "uuid": "66066ee3-d9d2-46fb-ba1f-9d662b281bd8", "comment": "Malware payload (Mirai)", "value": "96c72fd22e137a29f64da8430b97f01ec996da5de86f80ccf404ea5e2bccf74c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772722964, "uuid": "170bb9ec-b532-4a33-9680-dc60b96dbed5", "comment": "Malware payload (Mirai)", "value": "48667e2662cf86237e062321251a2b3f6e9674c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772722964, "uuid": "857fca66-3d30-4f9d-b255-d4832dcf05ec", "comment": "Malware payload (Mirai)", "value": "2335ff814a9078a2736e360986403e6ec3fc98c0ab044f34f3755d920e7b8ca6ceaf1ee1b37505774820c491ad3f7abb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772722964, "uuid": "7c8eafce-9db7-42a9-9415-2a4ba941e90a", "value": "T14C81C94A718207A53F24FA22577DCA4C5F45D1DEE4C12F99F2DB6AE04D8CCC8ACA45E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772722964, "uuid": "fc4dea7f-1f1e-4da4-8718-0ababf5ce13b", "value": "96:vzMjUzt3UzGdUzQ3Uzb0EUzUVUz1fUzZ/UzGNUz9fUzeLUz6/UzLHUzf7Uz5vn:bMAtUGSQUb0tU61MZsGC9MeY6sLkfI5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772722964, "uuid": "387e634b-c779-4bbc-bdda-3e927decafa1", "value": 4020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772722964, "uuid": "c6e9a735-d1cf-4839-968e-42058897a917", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772722964, "uuid": "bcfc1484-23a4-42c6-a3f9-c5d8c65aee33", "value": "cache", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312927b7-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697550, "uuid": "cf5a2e8d-9c05-4922-b368-4e599450fd57", "comment": "Malware payload", "value": "bd60b673c02c5d57affb109ebe46a11c", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697550, "uuid": "bfd3f378-7436-4b7e-a0f5-c51c84381d87", "comment": "Malware payload", "value": "983eb1278032ec94ddfd55c6bdfe0b0d5ce6e8ef7fed9eaaf02c339311034551", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697550, "uuid": "21ed212b-fdd1-4371-ab42-c90fb305abdf", "comment": "Malware payload", "value": "0a81c86fd7bbbfe6055b139584437beb2353a62c", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697550, "uuid": "189a3e1f-c645-474c-be41-4b9baf9cff0c", "comment": "Malware payload", "value": "f0020b319d1757b37a93f940502e2c3d0de139d760eb2a9f39b3974a72ebeb3dd0501b2968c68cd74dcf2cd6e28e7f4b", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697550, "uuid": "5c690980-942a-42ba-b660-4f8417d60b5c", "value": "T11493B574194C45EF30D3EA74B084A7E3FE6C0A5C9FED6A4F915487DA163EA873483A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697550, "uuid": "e8ec5176-76b4-46fc-9814-39f6feaf36ab", "value": "768:u42AHdaFrOciyWsh95vevFfplBe2pFHaK+8nNLcgPfA:uDAHOFrhOW2uKrnJcgPfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697550, "uuid": "a85be79f-95ac-4f05-99f7-c0af9afff8aa", "value": 91111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697550, "uuid": "94148ad5-5346-4cc4-b8b9-06f460c1084d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697550, "uuid": "cd2ba545-ff10-4771-b0c7-e7e8e6e64b14", "value": "bd60b673c02c5d57affb109ebe46a11c.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd34714-1860-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772693677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772693677, "uuid": "2d016c54-8566-4a0a-8b52-9b8d311f3556", "comment": "Malware payload (RemcosRAT)", "value": "0d0ce8eb0e4a9908e00c8b4e1c47565e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772693677, "uuid": "4c56387a-bc42-406a-a047-7557a1c084e7", "comment": "Malware payload (RemcosRAT)", "value": "9853d69e9f10a52cb53c00f31aaca63f3998bda39cab3ce54a5a46f48555dd10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772693677, "uuid": "de57d1ce-cb41-4f58-b666-90c79d10e222", "comment": "Malware payload (RemcosRAT)", "value": "487cbee7e6efdd4ba8d7c50ed3ae709dae11f494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772693677, "uuid": "5b39856b-faa5-44c9-81d9-2683d8352e07", "comment": "Malware payload (RemcosRAT)", "value": "6f0803d685a218193da2b6a73f0a6c5c943975f873b7fff0f9abe231394798662c9c456d58122d621a2f1ea27c2736e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772693677, "uuid": "072e2b55-3450-4be1-910f-8397f7cf298f", "value": "T1A3861233B28A673EE07E1A3749B2D220593B7A61A45F8C1697E40C4CDF690A01E7F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772693677, "uuid": "b2cbf6d1-ce0f-4090-b256-c61031616579", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772693677, "uuid": "447de7fa-8621-476a-a3af-bf446337bfcf", "value": "98304:4N66wK0l3BeD3qVeuOfx1t/1MPTpAQZkaie65mwyrp6OLrNAC6ZqQ:84l3BFVeuM7OFATaF6tuPLrGC6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772693677, "uuid": "176e0763-39c1-4dff-8e88-4b588fbf3a00", "value": 8180639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772693677, "uuid": "01a99759-16fe-478d-a041-23bcd7fdd6fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772693677, "uuid": "f5fcccf2-995c-4bfc-acc6-105cd4fc4e85", "value": "0d0ce8eb0e4a9908e00c8b4e1c47565e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28eef1cf-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697536, "uuid": "be067f40-1f65-41c1-b83a-3c57cb875b36", "comment": "Malware payload", "value": "dbf75cdd9cadf4bc8e0fe5dacfd6d98a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697536, "uuid": "2b6bafd9-d3bd-499a-908f-72f27e1f5c10", "comment": "Malware payload", "value": "98666e07cdb4ec4a814caa537de7dd52189c4eee7e79912feb0be173984f8237", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697536, "uuid": "a9f5dbac-b220-44d7-b484-f30e7e98180d", "comment": "Malware payload", "value": "30e0fdffe8357d32b56b100f1bd6f30df5a240d7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697536, "uuid": "16fd8f3f-95d4-408f-8eca-6d36dd35f6cf", "comment": "Malware payload", "value": "e15da9996d573e4644461b15fb5d18d384d1d0ca9d4d68cba449181a2e4d28d4fa121d07ffabc83928f5f6b275293db7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697536, "uuid": "98828dbf-81a4-4df3-b149-47e20e0d39d4", "value": "T10A4512FD23E938D88ABFC45DC59BFA6624A09E8C5C560A7D81D586398F14D0CB4CEF60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697536, "uuid": "cdece359-78ec-4c77-9a98-cc6370549041", "value": "96:wOZSgWqZ9Fu6ekTZfEzfWVW8aCXMXhAEcg07xwgU8tyNjKixgfSwjINFsuJkpPZ4:1pQElu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697536, "uuid": "106a76bd-047a-49af-a7bb-4cd0ea017509", "value": 1170863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697536, "uuid": "e504a810-6952-4efa-ab36-5cf6b59853d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697536, "uuid": "ef216ddf-00ba-4ba1-8463-b95f536d1ebc", "value": "dbf75cdd9cadf4bc8e0fe5dacfd6d98a.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c6fb94-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698099, "uuid": "356c044d-cb11-4c6d-aa5f-15037a0d8761", "comment": "Malware payload", "value": "f14dee46d76c02654b8608603cbaa3e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698099, "uuid": "f5651185-e8ab-41bb-bc83-2a96c1201475", "comment": "Malware payload", "value": "988d9c9937914627d5ba5c204ecf2cef2a579fc13284b504735852135f984ae2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698099, "uuid": "921f5766-fb5f-44ee-abd3-898428a72b3b", "comment": "Malware payload", "value": "de2edd6cfa9250a61446cbd568860e19ed96b22a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698099, "uuid": "a7b691aa-d799-4a14-b3fc-5263d9006d2c", "comment": "Malware payload", "value": "77bd999406a2bf43853fbf8ea01c92336093a5b486561db76bc06a8237de52761478e455e4ce7ed4fc6362eb975a8986", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698099, "uuid": "050b3aa9-3649-458b-bc0b-299eb3f15710", "value": "T195B412F619E507F288A95C7EA3187A7EC9F4CBBBBA31CDE51908B5EF79504252123304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698099, "uuid": "7dd3c7cc-0ec8-4d9a-a32d-042cdc0e0fdc", "value": "96:N55555555555555555555555555555555555555555555555555555555555555h:IyE0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698099, "uuid": "8b538fba-1807-4952-941f-0ffe0f97737e", "value": 524925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698099, "uuid": "b52e4f36-37a0-4032-a41b-4d7b5b7890b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698099, "uuid": "5ff5ae27-77cb-4874-aa41-94d858eb632f", "value": "f14dee46d76c02654b8608603cbaa3e8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09cb5a9-189b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772719292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719292, "uuid": "1d1f451e-3cf9-4d87-a35d-5bb22f5b4df2", "comment": "Malware payload (Vidar)", "value": "e63ecbd1f39340143a77b4157b092681", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719292, "uuid": "216e54fd-01ab-4994-b920-1b1adc879567", "comment": "Malware payload (Vidar)", "value": "98b7a56a3f1b4691d3244fdcc4da8106b8b31caa2cf787e9e45b2b72aef0b05d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719292, "uuid": "02d31e0f-7acc-442a-a2cb-99f42f5091aa", "comment": "Malware payload (Vidar)", "value": "b9bd1f5f29ab9e4825004c6cd7a23e946b01c117", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719292, "uuid": "4fc4ae98-43d1-4b93-8c3e-5f3869b2f39f", "comment": "Malware payload (Vidar)", "value": "3ae582b7afbf9680b58e78e4307cdb23553f715e264f40904968177ddfa9472ebe17f16ba6bd1da63b5fd142e07434a9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719292, "uuid": "7017fbbf-ae9a-4821-9772-8b9502d67fb8", "value": "T13FE6F56BE7618668C15DC13AC0A28F0CE5F360F90732C6E796AC0368DF569D45EFE624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719292, "uuid": "4f3fbdb3-77a0-4a9f-b925-7b3b2ce51bbb", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719292, "uuid": "d6fdf71b-d100-4e1b-92d5-e1ea46e4d45d", "value": "49152:BtD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUm:qxGLEUp9VDFtcdOTAphfA2J+ndQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772719292, "uuid": "32b8cf5d-e92e-4501-9d22-252aaa03a62b", "value": 14055424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772719292, "uuid": "c77c87a2-0a98-4740-9376-a0c83e2a2be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719292, "uuid": "91303b26-4c1d-490e-91fb-3d25e6b6fa04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56efd6d-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697879, "uuid": "ab31981a-26f6-45c8-91c0-a233ba5126bf", "comment": "Malware payload (PhantomStealer)", "value": "a84547793aa7f6f9b8f1749e8427b5df", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697879, "uuid": "c1c46b3c-c07d-4b44-a814-954fc5471bc0", "comment": "Malware payload (PhantomStealer)", "value": "98dfa8f6b02807c6caac5ecd4171dcb3a7639c3063d2f8eb63302ffff026a3b7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697879, "uuid": "2c7ecd3b-de16-4374-ae59-25b2fca830a1", "comment": "Malware payload (PhantomStealer)", "value": "6eebbe524b8526d66288e2ac1ab294b5f178e63a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697879, "uuid": "d7d62426-5f18-4c3c-8806-e5cd4e028dbe", "comment": "Malware payload (PhantomStealer)", "value": "6c56af30db62c6585e457a2c3f91b359ec2d752e369efb484283fa926c53d869cb4064b6b4d594911bd8ac1e661cee96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697879, "uuid": "6922f2ac-69ad-457f-952c-40b11efb7897", "value": "T1C026AFBF70262EF006EE955850B36915CF2099F45BD2225A1333BEC298B7DC678D66CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697879, "uuid": "8b97b128-590e-44d4-b96a-2e4a618e9244", "value": "49152:6yZoMKm67KzdWNO1IhSo4OwomVy5NSNtfrBHLeheEcAGcdTac5QtgsBLiUdC2HsQ:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697879, "uuid": "a0d4bb5d-6928-4ec8-b6da-7a91c8f4260b", "value": 4650757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697879, "uuid": "ead22234-f998-4b0e-a7e2-bf7b63fa0c15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697879, "uuid": "a393f9aa-3e65-48c0-ad21-697f26c267f4", "value": "a84547793aa7f6f9b8f1749e8427b5df.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765be931-18ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1772732455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772732455, "uuid": "fbe9dc5d-390f-477d-839b-b8be6a460627", "comment": "Malware payload (Phorpiex)", "value": "087be025580edb09a6c65b2bd4a8ee93", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772732455, "uuid": "1c44fa82-5329-45e9-88d8-b942f8be3727", "comment": "Malware payload (Phorpiex)", "value": "98e5fdce85ab8e17472f95eecb4c22f08a28933828e0afd0b5db831fe222e373", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772732455, "uuid": "21b2cd85-7749-4fb7-8be6-3a16a1732c1f", "comment": "Malware payload (Phorpiex)", "value": "02610d7b7e746c7e3c19b0a1e72afc85fed66627", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772732455, "uuid": "20c434da-7f24-4fcc-b6e7-5a2384575f73", "comment": "Malware payload (Phorpiex)", "value": "a2a65bedb5b8f925ebe8abb97e91d837cd9d4fad8c1c867ef80c4ad6dfbb8f9695f4d4537804fe36e224e5381a11b8db", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772732455, "uuid": "9f13e899-d1c8-44b9-a1ef-80ad2599bd8a", "value": "T179933B02F590A47FF9EA85FA91F28D68542CBF74134848E3A290655B87247FEFC7502B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772732455, "uuid": "ca36c8ca-61c3-41b8-8906-f9438a7753fa", "value": "c958c201152dd5b63a8cf3a862f1f1d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772732455, "uuid": "59594e57-ed61-4f86-aeb7-f12662e4a19c", "value": "1536:aVv12JFmavM2ouZb6tITnhnpqkfrSIMcxHppnoq8:Q97Ogu88n5wkjSIMcdppnoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772732455, "uuid": "6e818e39-a8c2-4abb-bf6b-19e7fcb6b887", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772732455, "uuid": "ad5bbd9c-1919-4133-a9c1-8735760e7545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772732455, "uuid": "07ed1f06-ad31-49a6-9ab4-9b9b23b477af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d67952-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1772698019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698019, "uuid": "3921c524-6c56-423a-9a3e-a8dd62caed65", "comment": "Malware payload (STRRAT)", "value": "1f1a3e19a7fc556bcb0ef4a5d7b60fc2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698019, "uuid": "3b8f9819-8fba-4330-bb16-bf9e24e8e5c7", "comment": "Malware payload (STRRAT)", "value": "9923e1ff79df4ade073dcfd71ded89da14e749df0b4a6a25ac0af80c347fee84", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698019, "uuid": "5fd456b1-da9b-42c5-a612-1c2644cdbdb3", "comment": "Malware payload (STRRAT)", "value": "000f088eba910a33e2b5c074dc17eb121afb6cd1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698019, "uuid": "3e606975-fa1a-4f83-9572-a26ef1ff572e", "comment": "Malware payload (STRRAT)", "value": "bd77c9c92807cb83bac22bb9f7c877e1b9d85d8521d4ef3ca723cccc1ca6e649b863721a6305fa2c76950866a657617d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698019, "uuid": "f9eee5e5-0af0-46eb-85e2-2db010f57258", "value": "T174B5C0719BC45BA9EBAD1E0BD03E3B2A73F31B45C962B1CC62233847AD9ED584705C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698019, "uuid": "707031c7-b2ae-4210-b74a-b0a453ce1829", "value": "24576:AlWNKixlk5V834eicPe2fT19D3jRyWHteUe:x53AybfD3jEWH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698019, "uuid": "37b0ea9a-a813-4cf2-8184-a9201e35d1b1", "value": 2337200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698019, "uuid": "2be9f881-a714-4116-8b50-0778b9c4b70a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698019, "uuid": "22a82f2c-c888-41f2-b34d-e5be11a99be6", "value": "1f1a3e19a7fc556bcb0ef4a5d7b60fc2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d58e89-18a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772723592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723592, "uuid": "d414d648-0b33-4382-9764-f103f0d56ca9", "comment": "Malware payload", "value": "265037f8052878826fc04f862e182552", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723592, "uuid": "4c1f2e22-4481-44f7-9c37-a2dea281040b", "comment": "Malware payload", "value": "9a8ee12f874e254932ba9c6c3ba726e5b083409e9874efd21c6534c5f40a624a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723592, "uuid": "b09629bd-9ee0-460a-9a16-43c71eeb97dc", "comment": "Malware payload", "value": "fc183451199c7eb141b0b8f2c9c91162c664af1e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723592, "uuid": "2f2721cf-2149-4e24-a4c7-d620f972d7fa", "comment": "Malware payload", "value": "0d94c330fd37e37e2955038999ee1bc973ac5f807f073b45bf10d66aa00ccaacd9863c297be4164ed15ed882c3821ce2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723592, "uuid": "25501016-2bd4-4424-a3d6-b462d1eeccb5", "value": "T1ECA5D03FB28B753EE06E5A367A72E210593B7661A4124C1697F4C84CCF254B02E3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723592, "uuid": "b334fa30-886d-4946-a08c-f653c41add53", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723592, "uuid": "9090c927-b0cf-40a4-881a-1d493a4de19f", "value": "24576:EXNrSLScusMmOkKIhzvLKjc7RTVqP+GGDu+uZ2w6OqCu5+EmcB9535T0we6CRwH5:ruI5hSS9kP+bDuB63Cu8E9Bvd0/Nrbza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772723592, "uuid": "8d31d740-909d-4e93-a9af-cb21567b9364", "value": 2094616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772723592, "uuid": "f9594d4c-d6ae-4462-8a87-b289222438ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723592, "uuid": "db90f4e3-588b-47a0-9ae3-9aa4b789d9b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3175bd85-18a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772723749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723749, "uuid": "03d6d019-0727-4b2d-b18b-e2750c219418", "comment": "Malware payload (Smoke Loader)", "value": "a496f114b63153dc718fab41a44744ac", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4277", "colour": "#678A05", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723749, "uuid": "54339756-cf16-41c1-8c30-48304864d5c6", "comment": "Malware payload (Smoke Loader)", "value": "9ab1a83f7db9c110d69edf2a332173942c53a18bf2df2769671909495e8c7d04", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4277", "colour": "#678A05", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723749, "uuid": "87415975-26c7-4ffe-b8b4-f47f40b80e22", "comment": "Malware payload (Smoke Loader)", "value": "2c3be680cdad59f305e6b5ec87d381c02c2c3638", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4277", "colour": "#678A05", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723749, "uuid": "9069f165-201a-480d-b8f0-972f35f321ad", "comment": "Malware payload (Smoke Loader)", "value": "b68c3496976c01c20c6fd7b78b62ab20725073c421a756cee1ce1ea3acbda46f718b97569481edce9b53338a860363c1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4277", "colour": "#678A05", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723749, "uuid": "e66963f4-3973-48e7-9ced-6497d8b46aad", "value": "T1F6E5339C88A0E867BB810E7108B65E6E920D71FC5B87E4F89F5E6A095740DF5FBCC211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723749, "uuid": "2294df6e-f812-4b47-8c7e-a6284a22cd8e", "value": "49152:gsqvL5TqNY9KRBINYwg9ZzgdV4UQsK5CWzzB9d5d5DOziJy6sBJVLQeDApt5UOTu:WRE6KpnUQz59b3J5sBTGJHNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772723749, "uuid": "8f1714ed-fa54-4188-91df-27044d361d8a", "value": 3176659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772723749, "uuid": "9f865b08-9914-4f8e-ad43-0c62895a7533", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723749, "uuid": "a4884247-7610-4da7-9c6f-bdb872a1799a", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b891c2-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697846, "uuid": "60a1352a-dd23-4137-a14f-5d74f901469e", "comment": "Malware payload (PhantomStealer)", "value": "d9ed6bfa23921bb697e0fc295bb21a8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697846, "uuid": "b1adeaa5-7f7f-4b16-b4af-f7308cef0921", "comment": "Malware payload (PhantomStealer)", "value": "9ac5119f1b9f1ab1eba5ead160717a7bcff192795f04ae8f097d3c006773bad1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697846, "uuid": "ee48f9a3-95e0-4cc1-ba15-6fe2723fd878", "comment": "Malware payload (PhantomStealer)", "value": "7364d0b25ae95f6ea4aa5990012a176eafd795ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697846, "uuid": "1479efd6-9d91-4b5f-8ed7-35be8deba50a", "comment": "Malware payload (PhantomStealer)", "value": "6d753bce0976a66c72a04cffa015b00412229b5181feb9453bf0a8496902c326b4c097c570f3fe2d4451b9be2be1c79f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697846, "uuid": "f2c845e4-f597-42b3-a5eb-35f66cc6c94a", "value": "T1D81360AC3FCAF1A04381B57F39EF607AF96E1CC4E00C94A5CA98345AF456F09E1B9954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697846, "uuid": "2626f3c2-2817-47c6-ac7b-153e3528ab1f", "value": "768:5+lKT9+ej2Qv4PD5m7sNM7iY2jZTbJU0vc2DaZJjYpmm:4lY9+UDUmAW7h2VdUKc2DgJjsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697846, "uuid": "1f3e1b13-f10a-4359-a0e5-a61b0a875bfe", "value": 45292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697846, "uuid": "34b2e56d-8409-4b84-9131-b5d227cf2a8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697846, "uuid": "32dc9996-32f3-405a-8571-ff3a85b51c3e", "value": "Technical Parameters.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffe03d6-18b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772729142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729142, "uuid": "acd8e17f-ea2a-48c1-a4f2-864caa391aab", "comment": "Malware payload (Mirai)", "value": "e70fb824cab3f156f444adc3fe7c9bf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729142, "uuid": "cbf5e333-2671-4cb3-9015-0157a9879c69", "comment": "Malware payload (Mirai)", "value": "9b79eb41d801b5f864bc9684f6bfc051053198e0b8044d0eae373cfc44f5b583", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729142, "uuid": "a5f56474-d9b4-4be7-828b-d3ada11544c4", "comment": "Malware payload (Mirai)", "value": "cafb39e5cccf2c2723f177e6098f382ec76bd877", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729142, "uuid": "dba3b1fe-a10b-4cc7-8d0d-ff282888cfc9", "comment": "Malware payload (Mirai)", "value": "de374fd50dead277128726ae57b98ed193ae9b5d8ba7de7424032930bf9dbe7faf8f080ae635a76064c7a5c796e6e0de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729142, "uuid": "89415720-b1eb-4de4-8c77-53d7d05323c0", "value": "T11D333A35B6752A1BC8D8587D22F74328B2F4168E28F8CB1F7D720E4EBF6085025176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729142, "uuid": "960865e0-24bf-4585-9452-489005f0730a", "value": "768:vj72UF999I26p/d1DNwm+Bq4HpX2KlNhdtBBYDhju/QJwO+351TSOj:v3pF1IDp/nNwDBq4HpmKlzB+DIQJa3e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772729142, "uuid": "22be015d-1c53-4e4d-9a8b-0d574de087b2", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772729142, "uuid": "60155cf3-f004-410c-af51-370ec17e7b9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729142, "uuid": "3a1365af-946e-4f18-8f5b-d7185105cda1", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410e27d4-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698006, "uuid": "5975dea6-5c32-47cb-99ee-272ba8fbe715", "comment": "Malware payload", "value": "a600f41742e7ce796411cb10aff3f14c", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698006, "uuid": "45fab231-9ac7-4c7c-8412-027274a63b48", "comment": "Malware payload", "value": "9b9c2c83654da4d7ce9afa51c4528585644873743d3cfe872c1e203e0e606fd4", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698006, "uuid": "e1ac2d8c-dd14-4089-88ff-56f856ef3aa8", "comment": "Malware payload", "value": "4dc00ac38594167690deb0976ed0d7271dd44cbc", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698006, "uuid": "eca6fe6b-ce19-4504-ab6f-170741ebd5bc", "comment": "Malware payload", "value": "2e32615f7ceb4d6f1ff075b7bc6238591d3afb4c9aa638bdae540294134dc77277d65a7d9653fabdaa90bb626a560065", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698006, "uuid": "0e357a22-be2c-4340-8574-0f718cc2d3b5", "value": "T193F58D17FCA105AAC0A9A23189A35292BB72BC484F3023D72F60B7783F76BD45D79754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698006, "uuid": "0949e93b-a785-45a6-8324-a7c50291feef", "value": "49152:Nyp2kGspPGyE+ybWVraGnWL7nkvVwe4CaSAE4MJD732jjzTCwe0:NvsIhD3AwrXk3Eu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698006, "uuid": "28147928-ced3-4989-8327-2ca85664fd07", "value": 3588297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698006, "uuid": "69bfd903-5104-49c7-8384-6cf342456f34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698006, "uuid": "2b4e4c76-6a53-4518-b1b9-07ee1e52fe45", "value": "archive_recovery_9b9c2c83654da4d7ce9afa51c4528585644873743d3cfe872c1e203e0e606fd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177d8199-18c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772736591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736591, "uuid": "578266fe-655d-4ad7-b45a-799cd10023e0", "comment": "Malware payload (Mirai)", "value": "7e52f16783ad6fe80908a827eba39abf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736591, "uuid": "a2ed8935-8dd1-43bd-b158-c97301327199", "comment": "Malware payload (Mirai)", "value": "9d01e5b34ad7be8f4d8f0dac63592cc3d2d644013dbec621ae843e7de6c4ad1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736591, "uuid": "104dffb9-1753-4935-8481-383ec8704ed6", "comment": "Malware payload (Mirai)", "value": "9a015545e627b6e35ee9b03bd8c2267853b1b958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736591, "uuid": "76e0e259-9c6c-4fc6-add4-91266d8204ad", "comment": "Malware payload (Mirai)", "value": "1c17b9411dacb92821ebaa70717aa1c84f6fe02baa450c972a16333d6cac9eda4b6606e23a0003e5299248aceb8695d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736591, "uuid": "fe4d03ca-8e52-4338-8e72-6e8272e78e14", "value": "T109056B5BA2A374BCC157C03443ABDAB3A935B43902216E7F55C8DA303E27E701B59B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736591, "uuid": "13e34549-2753-490a-adf9-8efb23fadea4", "value": "24576:ass+14s2kWjDCgc5q+rtCiLFxJJC8T2kJa:Z34s2kWPzitTlhT2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736591, "uuid": "7aa789e9-8b22-4884-b402-e1850a3df27b", "value": 851222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736591, "uuid": "2a114128-4bda-4b87-9dd6-6221107b66e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736591, "uuid": "98367c04-8e7f-43cb-a677-232bd61fd5d3", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5f8d69-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726724, "uuid": "94b2be9a-7535-4db6-ad8c-b1c9c3e11dc8", "comment": "Malware payload (Mirai)", "value": "ca8da7a5686271ce585552f460f77129", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726724, "uuid": "ee8267ac-42fb-4c3d-ab06-97a96932df69", "comment": "Malware payload (Mirai)", "value": "9d8db152b8aeae7fb4183ba98d1c0c27f81eb564c71d9e0749843356d1344540", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726724, "uuid": "44ed53c2-53f5-43a6-9fef-d094597aa7d7", "comment": "Malware payload (Mirai)", "value": "231efbea103dbb95de2e0a5d6d70954bea3aa3c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726724, "uuid": "ac925d42-099d-4636-8944-6364a51c7e5d", "comment": "Malware payload (Mirai)", "value": "243d9cf921f8540ffa2687a71e34920810956954c36d6c2d36ccfacfdd7b33426f38418bd1fc5880263637f72ed194f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726724, "uuid": "722639cf-bdde-4f11-998f-e2cf62003c37", "value": "T10E838E26C16C6CD4C6158B3476A99EB44783E60852E37FF1C6C6CB5E0097AB8F5087F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726724, "uuid": "ea101d04-573c-4ea2-abe1-9d0e37f9c7f1", "value": "1536:Lc/8IM4QBHNpwtX6rComO9e1OZES95iBUW0wzcqxnCbirMb:AkIPQhNp29EekSS3cj0kcqxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726724, "uuid": "46f7696b-d5e4-47f7-bfde-afb77a29cea2", "value": 82936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726724, "uuid": "3f5cd34a-e3ad-45f1-966f-364fdd3ed3b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726724, "uuid": "58f594cc-c947-4e73-84bf-d7ca9c275e25", "value": "MMaaRRiiOisecTanee.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7c2a18-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681513, "uuid": "d1a3ed48-fd49-4868-b8cb-331107005c42", "comment": "Malware payload (Mirai)", "value": "446d0e75acece0d6078049038033661d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681513, "uuid": "7011fc2c-0004-44d6-89b6-559044c66593", "comment": "Malware payload (Mirai)", "value": "9ee5de7ced64818b1995be2269d12bbfdac5c71bbc96f6dc053edfc09fb64968", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681513, "uuid": "6e57bc95-d468-4bca-a878-786436a8034f", "comment": "Malware payload (Mirai)", "value": "c7bf73ae90055e7270405a22f3fe1d726a38a496", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681513, "uuid": "ed56510f-8ddd-4154-acd2-c48cc18ca528", "comment": "Malware payload (Mirai)", "value": "cac0d865f6fa4444312d440d476a355111eb813b540de52f9b243a8da9dc33cd0c02e564ad6853db738121492524cba6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681513, "uuid": "b877190b-1031-4c74-ac65-5c5c761d89c6", "value": "T17243F1212B94C245C87DE03DB1F9ADCDB49084891AABCCE256D072FD6894F6C2E78ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681513, "uuid": "660d5dc6-ad1b-4fe4-baba-d9705cabd350", "value": "1536:bVA50+jFgxotaJvyVNbmhClktd7lyT/lrnouy8Eyf:erFgxo4JvyHblkt7yhzout9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681513, "uuid": "fe5ed9f6-d4b7-4253-bc0f-ad0a9f868d9c", "value": 57408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681513, "uuid": "c4a7e8a1-12f0-4e48-8baf-fa7dea82186e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681513, "uuid": "6fc3b92c-a56c-4e14-9762-c56f44e6ab82", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23d80a5-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707645, "uuid": "372ad552-7d93-4e09-8a72-c6a39f8b913b", "comment": "Malware payload (Mirai)", "value": "6274bdb2ad181dfdcc57c75a0a566e69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707645, "uuid": "4a2dc991-bda9-42c0-863a-41abb76d471d", "comment": "Malware payload (Mirai)", "value": "a02ba577ee0e1a57f77c484f0bc507267c6eaaddc3b3f89c5bc6a2eada8b848b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707645, "uuid": "a1a90b40-4198-4dfb-988c-29444ebb22e5", "comment": "Malware payload (Mirai)", "value": "ab565e4188c3b383c766ca02188e91b546eaf438", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707645, "uuid": "85868dcf-5114-445d-b5a8-48c57861243e", "comment": "Malware payload (Mirai)", "value": "3f0e70c8827fc4f935bbc0b1557c446099fd1db472e1a3063533b8cddce4a0e7c2ab6214795e75dfa3d547e98879ce75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707645, "uuid": "7ec9c59c-416a-47d3-b364-a19d93e20d0b", "value": "T1E503E2A8F2E1A89BF6FA51F1486D9580BBD85DE1339DDB507B3AB7023040733911AD8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707645, "uuid": "cad190c4-2f8a-4083-9944-548bb797deb3", "value": "768:d9ZLsCfHYXNwXQ3Vw1O1kBX4dbPRbXLHttAnuK/mY6esUCv4uVcqgw0RNWX2:dXsCfHYO0k2P1rPgN6tj4u+qgw0bWX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707645, "uuid": "3ac3c180-0540-42fc-b0c4-c4793200a68c", "value": 41344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707645, "uuid": "8e4abb06-cf74-490a-ae9b-6465cc99fd73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707645, "uuid": "ed7cb038-0f86-4cbf-855b-97f6cc6993a6", "value": "5r3fqt67ew531has4231.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17e8fd3-18b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772729145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729145, "uuid": "bb0eb848-3d43-4554-8c57-f68129c7bca9", "comment": "Malware payload", "value": "ce60113b7edb6c514304c5460da208be", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729145, "uuid": "9029b71c-5c7d-4f87-81f0-e8830a8dbc5c", "comment": "Malware payload", "value": "a067ca095a064d38fdeb9bfbc2411617249e4e1f90480b28d2bb3a417bc55794", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729145, "uuid": "a4cfeb0d-8a21-4ee1-81b5-fdd8127b042c", "comment": "Malware payload", "value": "54678733707eb4e47897828a9fae8c94081f3a37", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729145, "uuid": "f797d176-2e94-4cf1-a610-462ee0c951f3", "comment": "Malware payload", "value": "7ac744d0ccd85edbc6f74cc190725ce76e4c26f7677513c3eef7ef8c37063f38c1e03de53a11ad3d96d582871f4d8df9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729145, "uuid": "a194f686-f21f-4df5-a084-7372332e7bb5", "value": "T1AF4118C951D25032ECF6E922B2F9898072C094C7A4CA3E5CE8DC39F5D4DCD48B666B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729145, "uuid": "a420956a-84bc-426e-8c75-7ce2e0319a91", "value": "48:ipKevUp9yevUp93evUpVevUpPevUp1evUp/OevUpkevUpBevUpYevUpHevUp7ev2:i/vUlvUKvUivUcvUqvUjvUxvUSvUdvU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772729145, "uuid": "01ce18a4-d8b9-4b9d-86cc-f7ff871d0839", "value": 2224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772729145, "uuid": "34c20164-86d6-4f46-a5b0-764aaef91827", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729145, "uuid": "5baf07e0-cd1a-48d3-8182-0ec2cca3c344", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334d1831-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697553, "uuid": "9a6ab9d3-b5e9-40ef-ad79-30e06753f6cc", "comment": "Malware payload", "value": "be059cf8351f0958710bceaeeb8b5542", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697553, "uuid": "a38b339b-a912-4ff0-9735-8e61fdad7239", "comment": "Malware payload", "value": "a16727907b3f116a257311fb8436dbd3c6e15f39cf45e422aa525c0bff5d5533", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697553, "uuid": "1f24cdf8-910f-4bcb-a14a-f028dd116899", "comment": "Malware payload", "value": "0ba68515c970c336677e6c744bd2576a8b0c23a4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697553, "uuid": "fdb09b97-9ed9-4244-b1be-4178c9dd772c", "comment": "Malware payload", "value": "ab4ce0c646a179bb9a4f1936e2d6e7b8839871879161405d57758cf247c89dfbc1f067abb0108742179691fdef1c6269", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697553, "uuid": "ee0c8057-e2c4-43f9-9635-6a51db8d8ebf", "value": "T14145B85E13D0B8E6FC66905DC49B4ACD95801327D520FDEB390CC7E2239940DAEAAB73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697553, "uuid": "fb731e40-825c-4e78-925f-89907014cf09", "value": "96:uLLfD9dfd2dLldDdbLLDaIaLldIabbd+LLIacd6dca662afLLcaDd9fLlLL+LLLb:qgAwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697553, "uuid": "2b7338d9-2dec-47d0-9936-9e9abee9ba0b", "value": 1249800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697553, "uuid": "714255da-8f7c-4dac-831b-6cc13b0464a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697553, "uuid": "c83069d3-7ac5-4ca1-aee4-be9d89b1fd63", "value": "NEW RFQ CASE REF NO - 000102.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3651ee-1898-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1772718075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772718075, "uuid": "ab433697-938b-4ca8-a886-9900e3150383", "comment": "Malware payload (Phorpiex)", "value": "d5ceb73f09d45e4966b74ac13a43855e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772718075, "uuid": "4352719e-344d-4293-a6f7-baf5ed0dff28", "comment": "Malware payload (Phorpiex)", "value": "a23ee638987079840f3d0c5298a34b9227a498b5f0291b2ca1f298ac572eec97", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772718075, "uuid": "17491b49-92a9-4786-b913-9755bebd81c9", "comment": "Malware payload (Phorpiex)", "value": "91eb39eede372807a611cbed757be9003f1d5119", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772718075, "uuid": "0a41454b-d11c-4b29-8810-d3b50535ade1", "comment": "Malware payload (Phorpiex)", "value": "a2d8a431c6402d34e1d60df464c7b0727d8af80131c3ec1566d49a8b577bf5234a76c913ead61f8969512ad14a77f4d4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772718075, "uuid": "908248b4-1a68-4399-a1b6-5a4a625f963e", "value": "T18312290F6F4A4071E3E00CF056B58B8D8E3D866327D6A2EBF777C4980FA834494526E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772718075, "uuid": "6b865993-5819-48f2-bdcc-e2af0c4f07df", "value": "5b2be5371d11a0901c7dd88d5d6a5803", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772718075, "uuid": "4e7e1449-eda6-4dc5-9be3-cfca0523fac3", "value": "96:kDfoOBgrf3QL/B9KkjUBp/Bd0oDDSMZ+t8mL2jH2IPFJxGE9mK2FFhJC7tCESI7j:jegzgHUBpcWZ+mmPIPFJxTEKmFhqSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772718075, "uuid": "8e4aa2bd-0286-4d23-a44a-610e442d0925", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772718075, "uuid": "bb1f8333-0744-4d8d-ac8f-8907749bd7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772718075, "uuid": "9677399d-3ad1-4f78-8b15-b6dd72f0402d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af4f4ab-18c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772736784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736784, "uuid": "dba70e75-3591-4bfd-9824-c354f0fcacdb", "comment": "Malware payload", "value": "3c9c9de290bd5e0f28839976cdb8532b", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736784, "uuid": "8143c129-d219-4c20-89a0-bfb5f56a7402", "comment": "Malware payload", "value": "a246f2bfb779f3f2f1de7ce7ba761c92359a95d80a3ec1c744f491cec680562f", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736784, "uuid": "ba7ddb43-d57a-4fd8-9599-9ab710396ad4", "comment": "Malware payload", "value": "fcb9c97cf4113fb75fbcd7ff214d4d1051e65c9a", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736784, "uuid": "6ef91428-05bb-41a5-8996-41dd4937a475", "comment": "Malware payload", "value": "e2975b2527d44e07f8cd8aefa116399d138709cf4c68c5e7783750003b9f9129f046442ec56c5758d587e33d024dbb1a", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736784, "uuid": "3d18f77b-3edc-4b72-b1f2-a80e548ff533", "value": "T114187D03B3A705D5E8FBDA7196E652136932BC066F3095DF324C07262F73AE05A76B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736784, "uuid": "a97f9739-b4e8-4047-96bf-ec7d3478d2ff", "value": "359e649ab913e838011b9d61180c7f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736784, "uuid": "74f81076-7441-4ee8-bf0a-f6f8aeaa11d1", "value": "786432:+fgXTwWcQDgFFo5+6eYJL7beVpgPVlcm6:aGTwUDgFFoB7bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736784, "uuid": "9c1de652-9815-4c80-a375-d12c48e0e6cb", "value": 89345536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736784, "uuid": "6526c2e1-6578-4363-aa85-7f4da0c3cef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736784, "uuid": "5bc2868a-e30a-4850-94f8-4381b3f6e88c", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b42f98-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697769, "uuid": "f83efc0d-5d67-4838-82ba-ceea75d1065a", "comment": "Malware payload", "value": "d8d08a18462ca2577875221bb47ae319", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697769, "uuid": "1f365790-53a9-4946-8a61-93b77f1a05d8", "comment": "Malware payload", "value": "a26f4d8ed44dfacfa3165575643fa3914476ad9ff59da1ac7607b4941f9e7173", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697769, "uuid": "31a1b5f6-3490-424b-8bc4-786bdfd68ae6", "comment": "Malware payload", "value": "f99741510dcdb3ad1f53f89992cc31205c2b1f35", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697769, "uuid": "9ba53a85-8a7e-402b-a2cd-cef7481ed961", "comment": "Malware payload", "value": "3a15b8de7e512b31f46c8e889a2bab9d7770a7b0853f18e6b9bd6736e2a521b8e1c56f71941cc26a4a5fab0739704db6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697769, "uuid": "1a92a6b5-dcb1-49bc-b27c-f7767b4bd4af", "value": "T14306BF045EEF696586D7CF21D2FE061953970E83E211E4EEC7B12E21AFEF441472A18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697769, "uuid": "568dbc6d-6e4a-4f8f-9d21-826ee96924be", "value": "49152:pmCbODXyQHLenv7Ge2y8PTd8+6YDU5lNOcB8hHcfq8e12mrdvuW1yqJNib8uyD8g:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697769, "uuid": "6c920479-c42a-478b-9a13-d36416882cb0", "value": 3844698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697769, "uuid": "60df6bc9-c22c-42cc-b48f-9c021c2a787a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697769, "uuid": "579ff74d-1eb6-4b5e-9991-c38991e04482", "value": "d8d08a18462ca2577875221bb47ae319.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f927a89b-1890-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772714635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714635, "uuid": "351cd106-4aff-4605-bd7c-5ff45c141464", "comment": "Malware payload", "value": "14682833634cd6e91b282e00710baf3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714635, "uuid": "18f44736-cb9b-4873-8f2a-d15fd83dcdf3", "comment": "Malware payload", "value": "a4c9176d29dec775aa41079cd4d3e37f7281fcfedb12e2504bd0db21b56638d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714635, "uuid": "52c957ec-e4d1-44bf-ac67-156f62b17089", "comment": "Malware payload", "value": "ff20c653f8f2ebedfd4f35de1c7fa6240f3d0e4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714635, "uuid": "8153820d-6e08-42ba-869e-48f4d2862fda", "comment": "Malware payload", "value": "f2f4ddae976963e30eaeb3c61d59e0baa1de5b700844f1f019aa7ff6ee258ac591139a7b84859cb710f801d2a6623c89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714635, "uuid": "7d09857e-8e5c-45fd-b03b-00c0ddf482f5", "value": "T1C2641925035D6E0BE59E6A73D4F1210C73F4A1B4E5D2CB5A24449B7D0FD1382AE32BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714635, "uuid": "2133a676-064c-49c1-ac9b-03a409be1789", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714635, "uuid": "e8f2b0c0-730e-4618-824f-4b98dc911443", "value": "6144:SbJg7NeonQLB5N7NPygEseS0NG2Q40//rVt9hVl:SbJz7NLx0cz9hVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772714635, "uuid": "275b3ca8-62c8-422c-acf2-c7b40c436f84", "value": 326904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772714635, "uuid": "1ee60899-b524-4ea3-b8ab-e4cc82cec70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714635, "uuid": "eaecf875-f7e3-4995-8893-013d538c431e", "value": "Feedback.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd3efa3-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697836, "uuid": "ec0aa22c-aa6e-4934-8a01-38b8114af6a5", "comment": "Malware payload", "value": "ef6016cd0d8d2f0a13ae3f8747053a65", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697836, "uuid": "de7f8376-330b-4b4d-8a27-31eef578fda7", "comment": "Malware payload", "value": "a4cc88781e199f46c40c220220dd93327c427b98963f70c8f0fcbfcc93ede3aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697836, "uuid": "db6fa5db-7827-4324-bc82-e63b4d441b25", "comment": "Malware payload", "value": "7efdcc004ac572b94754e9be12d1736902367c64", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697836, "uuid": "5899d355-f5dc-48fa-af8f-e549d7a34eab", "comment": "Malware payload", "value": "f92fa920f5f5308b0b64765006923ea693f664b0b4d576470fb19af9dccc91c57e096846ba28f36873cb61ca71d889c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697836, "uuid": "72830144-d9bb-46eb-933a-6b75244f78ff", "value": "T161268D14764B6B74DF14E92E00FD9908E3F1859A6143226FCB62F14C4EFE764186B8FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697836, "uuid": "06f1568c-80dc-47e8-85bb-52568a1012cc", "value": "49152:RLEM/MSgx+ezKX/ZGvOLSjscTypTbJ4bHoTi/Vje/nXgcV0J:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697836, "uuid": "9f97efdd-0fbb-48fe-a87e-d58250577c4c", "value": 4637243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697836, "uuid": "27a95c62-fa9d-46c2-8870-1f2ce73258f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697836, "uuid": "0e0f0e2c-7990-4c9e-84f4-5a2839ba95eb", "value": "EDS RFQ108004.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b54184-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707647, "uuid": "fe20443c-c55c-45df-90d0-2a7de7c631e8", "comment": "Malware payload (Mirai)", "value": "8330c33d12ef32283b35e2646bfc963c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707647, "uuid": "346d58b1-72da-4ba9-97f4-6b2a30fe3e6d", "comment": "Malware payload (Mirai)", "value": "a4f24f5c8f34b9a3719e556eeaa199d450ddb6a0e36fd10b72fcc301b1a61b07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707647, "uuid": "7620011d-cf96-4e43-9d36-10de5cc23c3e", "comment": "Malware payload (Mirai)", "value": "959d3ff5f91b53ae9fad81754a94154d80d30f65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707647, "uuid": "9ebf38a2-be02-409e-9475-68911572dbfb", "comment": "Malware payload (Mirai)", "value": "edbb5fb7936abcb0608578e1f1045bbc4bdf1e202f84210190f7727db933fc041ed2bf57b892286e355b3c15c3a80322", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707647, "uuid": "8e194d63-0f09-4d0f-930b-47064ea38361", "value": "T13C93AE32E1161C60C156033170F58E393F23A5C491B76E7718B1D6AAD047E8EB94EBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707647, "uuid": "befd76c3-4dab-489c-814a-d4bf69d5495b", "value": "1536:AhMNhj8jM8yXW5nJJ88pycnWEYNdtUahExbVrgX8wK3FnVR+7ghKMXCCHg/PnU5M:AQF8jMr+nJJ88pAl7E5VrgX8X3fR8ghL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707647, "uuid": "b1ecb99a-ce5d-4d2a-b46a-dfd6f2d15b47", "value": 91564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707647, "uuid": "f57ac361-9705-4783-8d91-7613f67db881", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707647, "uuid": "3812ec04-f906-4f98-a614-6a57da50c015", "value": "5r3fqt67ew531has4231.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277db9b5-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697533, "uuid": "e9e0ffff-21c7-4f8c-948f-18f0091dfffd", "comment": "Malware payload", "value": "0e1a4b0daa2a2395691943fc33b4275e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697533, "uuid": "7678d376-c095-4047-ac1e-4c68d152d964", "comment": "Malware payload", "value": "a520b5d0c8bd7eab88fa54ce41ab5aee5e79098919e9527c7467dceffeb64fa3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697533, "uuid": "09f5cdd8-2fd9-4343-9bfc-128d3b68a394", "comment": "Malware payload", "value": "7a5101a97a67f6a3e20732a4dd72e34815336ae2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697533, "uuid": "691dc76a-6592-4e57-9900-83e4e113fb38", "comment": "Malware payload", "value": "1ccfa88201dc3c12440f2256fc78597498f2a7f5caed8b66ce5c33c44fda109c3f50818f0a1bcdd15ef9e9cfe313083b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697533, "uuid": "9c46d090-7576-41f2-b061-17f68d2de53c", "value": "T18545D6219E2385AE4FB37E2A4C5DCDE7C053B24A08EA8724EE5E57B3B6CF97101D1446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697533, "uuid": "fe2595d2-0771-442b-b4d2-c85696133049", "value": "192:gjozJkQA4YJgs/1KSBVYXuTeYmJvlieHv/esHLESkeUtTrcOzArsL1//MDpJHLFM:gdgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697533, "uuid": "a0e23732-b5eb-4813-a76e-9d21c7c2e9d6", "value": 1200956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697533, "uuid": "908d7c45-739a-464c-8913-bcb5280843d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697533, "uuid": "ba5466ca-5eaa-49dd-bed7-12a82a7a5d9d", "value": "0e1a4b0daa2a2395691943fc33b4275e.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d48a1f-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772697745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697745, "uuid": "40c20873-afaf-4f8f-b60c-53f1b5ff819c", "comment": "Malware payload (AgentTesla)", "value": "ba8045a841524a3644e6e681a80f3dc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697745, "uuid": "9425686c-8bf7-43e3-8699-a8b8ac7511e6", "comment": "Malware payload (AgentTesla)", "value": "a5309f6e9b7d461a02d872f11d0a256d679bd49bff2f770f240399165e2ae052", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697745, "uuid": "cfbdca56-4cb6-4021-8c2d-cab2a4e2670c", "comment": "Malware payload (AgentTesla)", "value": "24b7af026d3d76ae628c0861096b9e84de19a2fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697745, "uuid": "8284e36c-74eb-44be-a9a6-232ab01d7020", "comment": "Malware payload (AgentTesla)", "value": "e8ce079a37dbaafb6a33053c321b93e4cb8c0b38608d74660494054fbfe692193b261110dd7b54c262221e18c2372654", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697745, "uuid": "1b360a19-323e-4cdf-8485-4a63f49a13e1", "value": "T141557D56EF42374ECE47A60A80FD333BFED846A5A5861CC7A24A6C445FE62017319E4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697745, "uuid": "605f8e4a-a610-45db-a7d3-af9f96eae3c4", "value": "24576:WqWx3Wsmt4K3eO/bEMjlVV6TD/f2/hZjFlz8YyNDKR2K:S3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697745, "uuid": "8d4926dd-a610-420a-bf32-2bd3a1ac02e5", "value": 1355927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697745, "uuid": "2c263007-0764-433c-bf81-dddf0f68aafd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697745, "uuid": "414633a5-2ed1-4fa6-8f78-32c4a4fd31f5", "value": "ba8045a841524a3644e6e681a80f3dc3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db3690b-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697517, "uuid": "eb206745-9a26-4f27-83af-f3ae5c513bde", "comment": "Malware payload", "value": "36eabcb31ccbfb524109dbe77a7ccca8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697517, "uuid": "b16ea87c-4e66-4a1c-9822-0bfd4a443443", "comment": "Malware payload", "value": "a541d19a031434550286535ccf13c864b7d31bfa9f8b8884595bd2416abe85a8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697517, "uuid": "d31405e6-a8a8-44b6-a98d-c6452835b2fc", "comment": "Malware payload", "value": "e2deaf5a37d1581ba699e99b655af743c65d0d99", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697517, "uuid": "0217e535-054b-4626-a46c-53ea78162c53", "comment": "Malware payload", "value": "d8a0c58e436eb918c235cdf5c9e6e0e819d980bb89eeba84d038d11ad7753627e8e35880cda8b4f377699a679aac17e0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697517, "uuid": "85d137e6-65db-4e12-953f-0a7579fd7827", "value": "T1878397A30631C92B05CF5211F40DF5B6DD6DFA12BF9CE9639A5EE463D8B2ECD9081086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697517, "uuid": "6bd85b99-3d07-4fd3-9385-82b0313b9698", "value": "384:AOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOS:XAj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697517, "uuid": "65596b45-5fcf-4730-a933-efb1f1507fb6", "value": 83727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697517, "uuid": "ba8c2545-58e8-454b-ac01-a7907245b6fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697517, "uuid": "20e7335a-53c8-4e70-9ca2-ca606371b56b", "value": "PL10-03-2026L.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20727e07-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697951, "uuid": "82071d4c-3a45-427f-b55e-309b867326f0", "comment": "Malware payload (PhantomStealer)", "value": "56475b7f54961c598dfe1da78999ad4c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697951, "uuid": "06e4558f-29d5-4855-80fb-4b083f7f8501", "comment": "Malware payload (PhantomStealer)", "value": "a5783dfdf258e630b887186f3713ecf63ccf7b9c615b95a68e7f94c38ce2ac74", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697951, "uuid": "7d6baf25-678e-4606-9e65-b0b803f3b08f", "comment": "Malware payload (PhantomStealer)", "value": "ffc3ff90cdef2ac39db9dab0427f2d46ea834eb1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697951, "uuid": "9ca507a4-1e5d-43d2-afde-a3d03f04a862", "comment": "Malware payload (PhantomStealer)", "value": "2de026d5cf1db4d9cdeaf3f985ab648d4c91a80f7987a76553aebebace4a0f35e24e50ee527ed8e3cb7f9105bb24d1d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697951, "uuid": "4290bd74-316f-481a-a938-4de44a1c2d3a", "value": "T17626AF0590E7139D9EF48E5AE6FCBE8B25F070768947B535D28F2CDE5B0B94862031AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697951, "uuid": "3030ba73-a363-4917-9156-330f4e26a4b8", "value": "24576:+pPKeEFzntuNX5hFy7iPSE/OPJkJKV/5mE40IVDXWci1V7Nj2fsROTIvrY66PoQb:2PKTQR8ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697951, "uuid": "5b21caf1-2ac2-4e30-9828-cb82f6de8af0", "value": 4660669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697951, "uuid": "f487ff57-59b4-4332-84a9-786ffa1310bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697951, "uuid": "198e9e3d-18be-458b-bbf5-0eeb2810776c", "value": "56475b7f54961c598dfe1da78999ad4c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a57b14-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772695222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695222, "uuid": "e40eae24-b7d4-46df-a877-06f5f9020b53", "comment": "Malware payload (Mirai)", "value": "bced1ba05f23251176a261201ed3b521", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695222, "uuid": "3781dd48-0958-4eaa-8ee2-54bdb8bb2d84", "comment": "Malware payload (Mirai)", "value": "a59b80d777e60b5ec7992d2d655cd19478268e309a38a07a24e0f6ea51b229fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695222, "uuid": "7bd77a1f-a10f-4966-9524-1ed6272336cf", "comment": "Malware payload (Mirai)", "value": "a500d4c32e6615fc58df64a2eff509c85726e2c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695222, "uuid": "4e43ef98-8f4a-4837-8819-5bba80874a1b", "comment": "Malware payload (Mirai)", "value": "bf32ae1273981557f538604fbee648f23b5197a27594dec48419e21b3a73e6ce485c43ec1d4cf9083e4d0094ce4f4633", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695222, "uuid": "bdd9f8a5-f287-43d4-b814-6b74d9bdde55", "value": "T1BE144BD7F800CDBDF80BE73A8417490AB131B7A21493473B625BBD67AD361990963EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695222, "uuid": "681c41bd-1191-41f9-9d1b-b8e6b3632930", "value": "6144:nfOaQ+BuKxKv48G9J6umB5W7C6LbKypQkwdm:TzKv425g2kR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695222, "uuid": "89ad6511-18dd-4d3e-9fbb-1331461496a4", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695222, "uuid": "861ebbb1-8dc5-4417-9128-ad4c24e2f2c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695222, "uuid": "f9e9a967-de1c-437b-b386-e0f5b52367a2", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d08b92e-187a-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772705005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705005, "uuid": "2c2978cd-4877-47a1-9941-b6b7d4eb733c", "comment": "Malware payload (CountLoader)", "value": "752b1215b3dc7c084eba8a74f0fec09f", "object_relation": "md5", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705005, "uuid": "c7d7823d-6159-470c-910e-a134aab0274e", "comment": "Malware payload (CountLoader)", "value": "a5ae6e16849e3c3a40d9687059f9f0caa2f69f29a42007397c8ba82528b2255f", "object_relation": "sha256", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705005, "uuid": "1fb47b18-c05d-4f29-aa3f-479b26121d3e", "comment": "Malware payload (CountLoader)", "value": "f18f32a71a0a4abda5f4cb0497b3923e9ab4b1c4", "object_relation": "sha1", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705005, "uuid": "68dc3b7d-d47d-443f-8307-c278d8a73a29", "comment": "Malware payload (CountLoader)", "value": "354d91c2df7346b8447fa732c0ff357e9d348d6dc9f2f00593c5a9bcbcc25ad7e9b862136142e05e1e8da41f65846238", "object_relation": "sha3-384", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705005, "uuid": "d017c5be-8853-41f2-a11e-aff9b5f8dc49", "value": "T1B3C5239CA87A10F4EBEC48F82E05171717C2C779DF1A97298A7E2C697F252091C49E1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705005, "uuid": "2da28194-8555-4026-8907-6b34df99183a", "value": "49152:Wk5n/cJogZcDsxUU1+KKJjzcGbQTsk9PgplK+fShm8n77+:t/NRQd+KgQGbQo4glfu7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705005, "uuid": "c924a761-5b91-4871-9363-02b5918c5689", "value": 2532184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705005, "uuid": "e0f5262e-94d5-4e62-b1a1-661c157d5942", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705005, "uuid": "db7976c6-3ca9-443e-8069-ef6a2c418388", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154788ef-1870-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772700509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700509, "uuid": "c8b1a4a7-f727-47b2-a1a8-b264798f6b5f", "comment": "Malware payload", "value": "30465e572777a587040ef2964ff7dc70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700509, "uuid": "4397618d-13c1-432c-add8-43d4ab53a7f1", "comment": "Malware payload", "value": "a670868ebcbb56537fdfada580eef30ea9e68290d611932c38ce95fd1a807f5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700509, "uuid": "d1dee9e7-0779-4b97-8e2b-070d64385a76", "comment": "Malware payload", "value": "9f6b6f7927f237401bc1890bf7a9946486645146", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700509, "uuid": "1dd70caf-e588-4506-8293-a96f2a9611c2", "comment": "Malware payload", "value": "fe569da2cac5ece9ca265710f40bb610c65cdd20d3c4e46a943db26a0b14122a7ca39fee09bb6a7fb0155db0cc6a3b5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700509, "uuid": "761df7d2-7f2b-4b00-be77-cc95dd9436d5", "value": "T192A46B1BA2A370FCC197D03443AB96B3BA31743942257EBF56C4DA312E56E60231DB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700509, "uuid": "6ae52a58-4c20-4f5c-8ee1-e7e977bfbe2e", "value": "12288:5UsX8nZ03HF4s9ZD/2kWjD9ARshv05vy+CW7tCiLFxH:ass+14s2kWjDCgc5q+rtCiLFxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772700509, "uuid": "096ecdf3-f359-4f01-9ca9-2e2e7a2dfab0", "value": 476126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772700509, "uuid": "a7a9072d-3226-4b77-aa0b-4e256463fec4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700509, "uuid": "956043e0-f6fc-4d59-9cbd-6471b031fe7e", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025a7a0b-1890-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772714221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714221, "uuid": "101e2e3e-2db4-44af-9d8f-d140bb9dfbe0", "comment": "Malware payload", "value": "7f3c8a7fe78d3d05b6022df3ea0c15fb", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "Stagecomp", "colour": "#FA1850", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714221, "uuid": "3ca19bb9-7ff8-4541-a2a8-501774135907", "comment": "Malware payload", "value": "a92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "Stagecomp", "colour": "#FA1850", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714221, "uuid": "4ada27c8-9bf8-4c03-a8d6-7e9ffc902a79", "comment": "Malware payload", "value": "0ba2306ec15f7124fafc7615e81f34c7986ba9a5", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "Stagecomp", "colour": "#FA1850", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714221, "uuid": "03857b27-dbd7-4dbf-9f63-288435fa2853", "comment": "Malware payload", "value": "ab78a12bd8a39152010845484888fb6d10e941de3603c2628992c90a29f1bc852c247a60053c0ec158d15ef2b08d7ee6", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "Stagecomp", "colour": "#FA1850", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714221, "uuid": "d300e796-212b-43b8-a04b-5f0ca877abab", "value": "T14C646B047DD0C0B2E46119345567EAB15E7DFD311E608AA723E53E7F3E30BC1E2296AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714221, "uuid": "ca887289-c39b-4558-81c3-67edf7ed4445", "value": "9963ebabcee092908eac2414f7c4661a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714221, "uuid": "384bf46c-9d32-46ff-b178-324385cb489f", "value": "3072:eLSMqpdvXugbMnvqYhYBCDOh4zUdORB4mRD8wT6T9yRT6Wml5jbxaq1Ta:eWVplAnrYBdYRBZmxaqla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772714221, "uuid": "1a3174ea-6a18-4d3e-aec0-72e7f7994d1c", "value": 307656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772714221, "uuid": "c1ba4666-190d-43bc-adb7-915f6bc7266a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714221, "uuid": "fb93c79d-bdba-4a07-8619-6400e20bdc00", "value": "DIDS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f2e8e9-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726740, "uuid": "66ca876e-cb68-4d50-9ddc-c32551ac32c5", "comment": "Malware payload (Mirai)", "value": "40c0fc959bcc0b90b1761d769aa24998", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726740, "uuid": "2c944177-a969-4434-afe4-288a2c0c926e", "comment": "Malware payload (Mirai)", "value": "a9305ed4a98fc79ec1822ff30a7f4fdff5f56cc70f258eebbf46ffe23d01c509", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726740, "uuid": "6142211c-1b19-4d1e-bb9d-cca6e349a690", "comment": "Malware payload (Mirai)", "value": "49b032b07c861b51a084a0bae9a053361089cfc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726740, "uuid": "b24bf9fb-0af4-4f6e-8a62-78e31d7d5ab0", "comment": "Malware payload (Mirai)", "value": "47a3cba4c0d83d7717041c536e29e0ed606678cf15188a73a843960c538e0908608612f7c4567879145dc76dc7f8839e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726740, "uuid": "5d4f2150-c950-4015-bf27-deb8c8293dd3", "value": "T123833B0173544E07E8A64AF9252F17E4C3FEEE9021F8F6845A0FDB594634E33654AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726740, "uuid": "ee78d8ac-84f5-4606-bdeb-47cdb07184a7", "value": "1536:ncY2lOP8VXdln+3B10M/6O8AH2waFO42ho515eTXTHbL:ncw0yeDc14e/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726740, "uuid": "b5fc0279-3e06-44c4-bb5e-df8ef66b7c29", "value": 83784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726740, "uuid": "d04f6f18-f210-420e-bd4c-420b65da7e5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726740, "uuid": "3bb434d5-697a-4b99-b019-0cc7eb561116", "value": "MMaaRRiiOisecTanee.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead465ec-1877-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772703874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703874, "uuid": "f7e7b679-8b12-493a-b9ed-623c1ddc73c1", "comment": "Malware payload (Mirai)", "value": "cd4ed1b7c3223cf375837e69f8fff2d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703874, "uuid": "890802b7-d5c8-4940-b233-78a4f34de559", "comment": "Malware payload (Mirai)", "value": "a9bf697fe791e0ad69fd3afb372d46dc36615ecb101fb28c5e6ab64be370a979", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703874, "uuid": "fc41879f-90e1-4306-b936-7dfa3b25ed77", "comment": "Malware payload (Mirai)", "value": "c5e19a9f1ab4ee17e23484f4d6668041a908469e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703874, "uuid": "eae49d46-af62-4182-a3c0-1cd1b5b716c4", "comment": "Malware payload (Mirai)", "value": "15dfb73a4c841cbfdf134959267ecb56397ead70f59e52fc2f29483a340c653e1d840f57499fd7c681758e4c6cb5418c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703874, "uuid": "9058dcb3-0662-4b72-8910-e64d8ccb929f", "value": "T1DFC30956F8819B11D5C151BAFF0E124E77131B3CE2DE7312AD24AB707B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703874, "uuid": "05c3e95d-41e2-4f94-80cb-ebd0617a9fc9", "value": "3072:fED7YhjFMX+maR8TcDeRqQV3tNQYciYTG1P:fED76aX9aKTcRQVnoiYq1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703874, "uuid": "f66ec739-c622-4406-a760-9c89ee93c6f0", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703874, "uuid": "58f7d77f-e5b1-4c17-821b-df713dc3f2e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703874, "uuid": "b1e1bcb4-3bf0-42f5-a9d5-60e8b6d75910", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a5e03b-187b-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772705560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705560, "uuid": "ba50bf05-c097-4454-ae32-b47ab5faff7e", "comment": "Malware payload (AmateraStealer)", "value": "4b36648523dbc1847118e47a0af3eb98", "object_relation": "md5", "Tag": [ { "name": "89-110-118-6", "colour": "#CCED25", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705560, "uuid": "40f00425-20ff-4323-a5ca-348304ac4576", "comment": "Malware payload (AmateraStealer)", "value": "a9e953e11f8b2fda34d952617dcf823456013ee9c3418bcfd218ae7a997d7869", "object_relation": "sha256", "Tag": [ { "name": "89-110-118-6", "colour": "#CCED25", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705560, "uuid": "8e044620-96cc-43ad-b09f-e480117da8d9", "comment": "Malware payload (AmateraStealer)", "value": "9cf63b3d7f321c0105292d1a59ae8684729d81d3", "object_relation": "sha1", "Tag": [ { "name": "89-110-118-6", "colour": "#CCED25", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705560, "uuid": "c8f4a4f5-be45-4a63-aa5e-10efde7e986e", "comment": "Malware payload (AmateraStealer)", "value": "7bbac977fe7cae07ca17a4120acbe01bdcbd59d0681863e1dac45891e65188cc02760fdd9d367704a5dea6093ba928e6", "object_relation": "sha3-384", "Tag": [ { "name": "89-110-118-6", "colour": "#CCED25", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705560, "uuid": "89ed897f-dbdd-4ae5-997e-fe5151356530", "value": "T16A96AE57B645503FC0672A368D3B97AD643BBE712A229D4B27E03C4C8F366807B1A747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705560, "uuid": "c24644bd-a6f6-4366-9509-2357d55f6a32", "value": "e76c4470619433796d0ce964e2d84f10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705560, "uuid": "c98ff532-f7f0-40f8-8663-9c05447d7941", "value": "196608:c/dj1UbkCchr3rlFE8GCWhKUzGZ3gRTFH2Bz58//SN1zO:c/91Ubkxhr3rlFHWhKUzGZ3gRTFczi/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705560, "uuid": "f55895d9-0f56-489d-9db6-73da3936458f", "value": 9444064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705560, "uuid": "fcbcd4ac-e549-458b-b57e-bf4c13963a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705560, "uuid": "244cdfa9-65d6-46b6-a885-8c1a5467878e", "value": "S\u0435tup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95907c4a-18a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772723488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723488, "uuid": "b2c0f51f-f062-4b36-8e20-c73126d237c2", "comment": "Malware payload (Vidar)", "value": "ef6fe8927f197f33b296c4c65b6bad6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723488, "uuid": "9e1f7524-a0b5-43fb-9b46-46b398c4d0a0", "comment": "Malware payload (Vidar)", "value": "aa1fb89e2ce41dc3e380f79012d43486eb6bc7b772112f5625ea1e7c4bd21130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723488, "uuid": "4b9d2d3c-36d5-40fe-b31b-eaef4eb422f9", "comment": "Malware payload (Vidar)", "value": "1cb1d6da7b389f6f0e5c6828e5b9c960fba012d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723488, "uuid": "d85aca24-1b2f-4af4-a199-aa73bf35d2d3", "comment": "Malware payload (Vidar)", "value": "8877b7a17fa80c8bc3fb501c48e2c83a3bab544edbc5007ed970468cfcc0c22ff526e7d5c4eb944edbee3092f64d5cb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723488, "uuid": "63751176-92ee-4651-84d3-63e0f3447cca", "value": "T119959C47BCD024B4E5EAD2328AB112A27B30F85A0B3077D72E55A6B92F773D41E35394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723488, "uuid": "5defc4d3-14e4-4215-9eda-2b5f7981c82b", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723488, "uuid": "07e51c2f-8b8d-4815-81cb-11fbc281750d", "value": "49152:Pt1Myg6z/zmj/76pIFPu8wkDbMYgtxwK1:53Oj6pIbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772723488, "uuid": "9f2da1fb-069d-4dc5-86a3-f9b212b64634", "value": 2005504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772723488, "uuid": "72169f30-1135-460b-90da-a93ec4e5e205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723488, "uuid": "9b857ff4-5ea2-4342-a726-6a0df0162ef6", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a62964-1887-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772710440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710440, "uuid": "d284fdca-ff13-4b45-8c1d-820890838de7", "comment": "Malware payload", "value": "416dc21159ac8ef6f3e887922b914395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710440, "uuid": "1eb60969-d77e-4a19-9adb-0168f5416144", "comment": "Malware payload", "value": "aaddd89397ef8ac73f809941894afc1f4caffb484892a042d7bae73a427d81a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710440, "uuid": "6c78767a-89bb-4ec4-8191-8b4f65ad0796", "comment": "Malware payload", "value": "4ea09c69d2bc6f6c4dc70584b403927ba607141c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710440, "uuid": "cca18939-dbe1-4f60-a625-dccf82127f80", "comment": "Malware payload", "value": "b40a29fd6e9edc91f092dc3891f469e146527ed70e7ee196ae21370573409f71696cac7e8882cbebc2d8199bd90449e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710440, "uuid": "319323e3-86fd-4a01-b46f-513ccbd3978f", "value": "T19AE733AFF5E69985F81027F86D848CF1AF86E558E9F8534F4208177B2863078DD5CB28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710440, "uuid": "c9d937f3-02a4-4acd-81bf-316f20f41141", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710440, "uuid": "24fea705-0e53-4ba0-a29b-bdbfc596c6c5", "value": "1572864:O9ArgabM3gDK/iXojlNIJkpSn4M8Ken6/qE3moSGBt//7:Oyr7gwyiQNKVcKwGQRAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772710440, "uuid": "8ca298b6-bef2-43aa-9ca1-5dac0d133263", "value": 68501768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772710440, "uuid": "249c6d61-bc8e-4801-addf-ceb8b50a129f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710440, "uuid": "ef546a5d-719a-4ebe-a413-5bba80ca443c", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da34a4fd-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707712, "uuid": "ddab91dc-8a46-4988-a091-b7222e0950cb", "comment": "Malware payload (Mirai)", "value": "24f5038284abc65c52935a95e288c4d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707712, "uuid": "5f4a4767-57d5-4d2e-9d4a-2972ab5d2c09", "comment": "Malware payload (Mirai)", "value": "ab9ad6f6cbac73926e5ff2f2e562f34af1ef795717f7522d7256a1c0dbd780a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707712, "uuid": "8d27cdfd-86a1-4339-98a5-7ab96e0d6f55", "comment": "Malware payload (Mirai)", "value": "6cd5c0aab1ffb818d3e9a344fec8ba35c446d8ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707712, "uuid": "565d213d-5cd4-4f31-b79e-166fae949b59", "comment": "Malware payload (Mirai)", "value": "4b014fe68f03aa3ec67146e35ec1f1fb699cd251f3475ade6772e3fe4ebcbaab6a7042f5f26979de678e0c0c34e0d631", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707712, "uuid": "95d49bd9-ad7e-4933-86bb-2e5cca81bedb", "value": "T168A35B85FCC15A12C6C112BBF66E028C372693E8D2EF7203AE216F6577CA85F0D67945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707712, "uuid": "e050e3a5-324f-4f04-af5e-5fc20efa1201", "value": "3072:74vOKPkC4rg0mXbdphD7IPKSduV7Nc4LEwbZnw:74ra07Xbdr7IySduNXowRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707712, "uuid": "f0a1d9e3-aece-4af8-9670-ddef334cf629", "value": 100528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707712, "uuid": "853ae16d-d05e-433a-b022-a27a07fcf38d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707712, "uuid": "8969545c-8e2c-4e25-a793-2a8c7ea34dd9", "value": "5r3fqt67ew531has4231.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc420e72-189b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772719311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719311, "uuid": "bc9324a6-0004-449c-9bb2-19aeda45429d", "comment": "Malware payload", "value": "72f721cdb43e7b703638ec58bfce542c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719311, "uuid": "6957999d-a1b9-4af3-bb33-e74342cb6564", "comment": "Malware payload", "value": "ac161c60e82ad3d095d1248b6a961185018715f6fbb7ceeb52d934a40d3f7be2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719311, "uuid": "42f45442-974a-4b12-b910-dd0d65d09ba2", "comment": "Malware payload", "value": "d118d46189226685c684f4d60c838a33877fb1e8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719311, "uuid": "f6c61c67-0809-4927-98b5-9be422f04052", "comment": "Malware payload", "value": "1a3a4da796a6997222542640cd0f6b13bc5a0ecfdaef777fcd41eeebf2bf8e6da8919738170b3ddcedcde956c6fa9180", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719311, "uuid": "30c03f7f-58a4-4ce2-a78d-6888bcf28e6c", "value": "T1153396A167F9152AF6F78F783C7065968C7BBE726D61E08D4280204E08B5B95CE78733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719311, "uuid": "f0a08f50-6a69-4138-9367-940a13194640", "value": "0765db21700aa225ca00e841fcebff9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719311, "uuid": "59ab38fe-b2d9-4704-b69c-4cf05e098c51", "value": "768:vOVB8H/0vaXDiTLlGCI0App3tnvU7+dEErkdqsq:+BXEiTLXA3dsidEzdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772719311, "uuid": "a9ccf93f-a13d-4780-916d-a1a2bf00017d", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772719311, "uuid": "501e4bb7-5130-48fa-a42d-13d562425100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719311, "uuid": "1d2dc368-0892-48c3-8dcf-5bd008a350a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd9b35a-18aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772725433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725433, "uuid": "fc9de49d-f391-4a36-805a-c29f5597bd90", "comment": "Malware payload (Stealc)", "value": "183a42d59cc15b711f7cad6a108767f7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725433, "uuid": "d4ecc36b-b988-4a09-b62a-d50fb783f936", "comment": "Malware payload (Stealc)", "value": "ac30bd536ff63648634c9304c0c7b560eeac0d140788d7c99d575174a5caf602", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725433, "uuid": "91bc3604-751a-45b6-bcee-b3c3c3ca4736", "comment": "Malware payload (Stealc)", "value": "350746c3fa687dc81d97d9e3854ef7f6009d0df7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725433, "uuid": "0df66ea7-6faa-4c8d-bc46-990f863b364d", "comment": "Malware payload (Stealc)", "value": "f81cfa4a1c35af65d82492b1f844dcd70771ebe6793cfdce9dd51b62526807996818abfa623a9b1a071bd632f4a6dd55", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772725433, "uuid": "0ef40fff-eac6-4265-a8fd-c818483f5e5f", "value": "T13505B0B976043CE6E67F467BC9966CD813723A238B87A4CE41646BD30D633B1EE16805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772725433, "uuid": "22123458-584e-4ab1-8fd4-5d176d08c6f3", "value": "e9db3df973f0aa33e2085e01e9984486", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772725433, "uuid": "7b4851a9-bead-4f0d-8664-b61b7c6e8f37", "value": "24576:KedqGy85hCpO7NmRenOIoCnf4Ugd4Zh9Iqgijt:Ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772725433, "uuid": "2ec3a3f3-3dc7-4d10-8447-26efe0710efb", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772725433, "uuid": "44eb0da9-2760-482b-b17f-952f25b8a980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772725433, "uuid": "c74bcb89-da3c-4a55-a6f1-b062bbfd7f7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb911f30-187d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772706479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706479, "uuid": "ffd24b58-af2e-46ba-95cd-84c47101a62e", "comment": "Malware payload", "value": "148b922671c5e2ede8bf2a0a8c473f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706479, "uuid": "b972317c-797f-4610-833d-9d908a74eb46", "comment": "Malware payload", "value": "ac4b77a008784a1f7f4006b3167ab274f1c616adfb3de90d287fcddd5e0bc243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706479, "uuid": "63422325-863a-4638-a385-c166327fcf6f", "comment": "Malware payload", "value": "395b523460973aa121e18cd9910b7e2aec1f3808", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706479, "uuid": "6d36d0bc-4c71-4b55-9dca-9d67215b9746", "comment": "Malware payload", "value": "ae31fa0f5e11069e8d43a3e15dbb844b858c64415cc9c1415c2d96885aba884b929824077fac94a13bcb0effcecce73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706479, "uuid": "d4de732e-f317-4e7f-90a2-9f7812af3e13", "value": "T12FF31B138AEC3CDAC03997B0B77B87C0DB2EEC9952A2C18E57C00995C97D9537A267C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706479, "uuid": "c77f3d55-a3cb-4063-be63-f311720f6802", "value": "f32b968a3be9d872e4748ef4a7574f49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706479, "uuid": "ac30033c-3953-40a8-86c4-7c5b48cf735c", "value": "768:YtH11FAwL/ADT8PBQJv3/oWMHa1sx5QzsSaPcojgzsu9D6rQppz6V9Sbh9SbTN8k:YtLeYADMBQ9yrusnPcKUsCDSGuCRoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706479, "uuid": "f29712f9-1c7f-4b3e-aac6-2c88f421607d", "value": 158056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706479, "uuid": "292ce27c-94de-4121-9ec0-db7ca52793ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706479, "uuid": "e3b1578e-a9b0-4001-81ab-3cc4b882231d", "value": "ac4b77a008784a1f7f4006b3167ab274f1c616adfb3de90d287fcddd5e0bc243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee50480e-18cd-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772740817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740817, "uuid": "2cae60a4-f803-44a1-8487-5616e390880d", "comment": "Malware payload (ValleyRAT)", "value": "0749f54e08134cd9116bc19a070df0e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740817, "uuid": "566e0a95-980e-48d0-b61e-0316864d097a", "comment": "Malware payload (ValleyRAT)", "value": "ac88b82ebc65a8285c993396560c30fbb9d16c260e026e25eb036e028764e013", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740817, "uuid": "4e9f8d4c-170a-4f6f-a957-2b01d67d136f", "comment": "Malware payload (ValleyRAT)", "value": "8a49fd4239714e6ac6e78815db8ff7baee84f78b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772740817, "uuid": "f5193a72-a6c9-4d4d-b958-d98ef729c54f", "comment": "Malware payload (ValleyRAT)", "value": "f71d3d1ec6db701b4cb69f9b2cf42986795d55bce0996bbe2ae67c2d7aabdcddb7036955f8279dfdd26aaad5b85f3570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772740817, "uuid": "ea1ffa24-ff3d-4cb5-8f1b-86dc11fb48a1", "value": "T10B171253BEC64CA6C986677899DB4331637AFD518E126B1F370CC6306F036C5AE4AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772740817, "uuid": "bd551da4-4dd7-4e0a-b530-5cd83a15533f", "value": "bf2535b8c63f7d9528e4a6f37ee5c9fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772740817, "uuid": "a7a96488-85d8-46c6-a9b2-6e734d251fd9", "value": "393216:FNI9ujzoA3fQdg8YZfmOrm4u4uJoIuGv/uzie5mRc3iYsO8aoovNel1o:FNIGN3YdgVlTanXsie5JgO8xl1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772740817, "uuid": "daf519ed-9d76-4ab6-9f49-16216299c461", "value": 18824040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772740817, "uuid": "621744f7-d43c-49fd-95c9-e40cb3cbe871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772740817, "uuid": "b03598d9-21f0-443e-ac46-2365f58462e9", "value": "0749f54e08134cd9116bc19a070df0e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1e5a46-1871-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772700980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700980, "uuid": "c1c37be2-3a52-4710-84f9-56b526adb4eb", "comment": "Malware payload (Mirai)", "value": "81d30968c638414cf78d3aad638621f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700980, "uuid": "613f7063-18d9-4a37-8ef8-6aa3a16869a9", "comment": "Malware payload (Mirai)", "value": "ad36100e49d183b4c0cc44ffd8967b8435b987331a0953542d322fb5b4436100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700980, "uuid": "5dd0f3ac-ced7-4828-a01f-fa1f59c81d66", "comment": "Malware payload (Mirai)", "value": "7d0979b03e3b09c700337344c8c3c70b358b6d7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700980, "uuid": "ef5a2a67-7916-41ba-9850-084490cc4071", "comment": "Malware payload (Mirai)", "value": "8d71b37b0d73f04356caba58aae1ae47340dbea6846183b987f602c71f3aaa25a0dcb589aee8edcd973ba1840b1a768d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700980, "uuid": "75204fd0-7f3e-4870-9c1a-9746983ed488", "value": "T1CC342946EB804E13C0D627B9FA9F42453333D764D7E77306A9296BB03B837AA4F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700980, "uuid": "a2154d5d-34d8-4989-b755-fa30d6d8d32e", "value": "6144:VqzzMAzvnkIWKeqRWa8Pvcp8t43pruIV3+ie8V/GbhuEl:ozjkyJRWa8vcp8tct7Z/B8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772700980, "uuid": "ece9c071-874e-45be-aa78-95986268dcd0", "value": 251908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772700980, "uuid": "03c3c326-5119-4ab9-8086-863c38662995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700980, "uuid": "b50de59d-b4af-4f51-b4f7-61f4014f8905", "value": "Polar.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9033243-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697777, "uuid": "5d750a3e-423e-48c0-a966-212b4b0b3497", "comment": "Malware payload (PhantomStealer)", "value": "2b4b6a4608af36756022ddce79ad2050", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697777, "uuid": "6f4aafa9-dfb9-40a9-8e55-712859e09703", "comment": "Malware payload (PhantomStealer)", "value": "b054cdfbf5c23378107d0959f5da09d919a53a13227502c8eefb04a6c273118b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697777, "uuid": "b1296ddb-49ff-4b39-a437-bce50896ee39", "comment": "Malware payload (PhantomStealer)", "value": "09404a92f255c14ce2ea0f52d3d348c7577e0f2b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697777, "uuid": "227ad179-d853-4e8d-a7c1-1ca68cdb0e5c", "comment": "Malware payload (PhantomStealer)", "value": "aa9092ac918b6748f19b2f232dc21699c65f2df01952aa25be61087f45cc716e026c172a7d83fb5d2c5e0fe5f6b00a72", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697777, "uuid": "bcffe094-b626-4944-ad64-26ab7a1d817d", "value": "T14126BF846BD43FE04818343A66FF257E94D574078E9A7F407A1AFCACDF6A3582127938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697777, "uuid": "f1854ab0-6746-4cbf-9b57-6094b10916dd", "value": "49152:BdJywwbVPukNVC+mG+4hMUbK3zztt6sRrIO:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697777, "uuid": "6f0ddeab-b8a5-42bb-a638-6c219e02b221", "value": 4638363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697777, "uuid": "221b928d-be22-4f52-9771-fefd6049c804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697777, "uuid": "9ba59544-aa0f-44fa-9f16-ddf0d263cc85", "value": "2b4b6a4608af36756022ddce79ad2050.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca8e6d5-18c3-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772736358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736358, "uuid": "237570fe-e265-4b61-a4ec-94cb6fc8cebb", "comment": "Malware payload (PureLogsStealer)", "value": "1ce07a2bd4d4b71fb725fea298163b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736358, "uuid": "e5c74e93-73a0-4206-97f1-cc4cf059a086", "comment": "Malware payload (PureLogsStealer)", "value": "b08379185071a9e03f72b26a72df69ebb819cb7b9994048df1ccd12449b1c357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736358, "uuid": "a912798a-4366-4308-b9d3-4aacd3b8a52d", "comment": "Malware payload (PureLogsStealer)", "value": "218f30c89f18706cf6b76607bd3e84d2e1b1d95c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736358, "uuid": "3d72912d-19f1-4161-8141-10593e3faf73", "comment": "Malware payload (PureLogsStealer)", "value": "21287b9f6696f923c049ae0882252c6b4327d52f4fe645313cdaed04709be05ce9d130bc1946bcef08d63692e02467d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736358, "uuid": "9c1a0d04-e532-4cff-96b0-3b895faa51ae", "value": "T100651212B7C08573D57225350FA65B50167CB5B02F72CAEF63E469AE6B309D0CA22F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736358, "uuid": "ec118bd1-4efa-4558-b516-4e158197eac9", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736358, "uuid": "fab78d12-9d76-4fd3-a7ac-61d8dec3d438", "value": "24576:KN/BUBb+tYjBFHEPxZsSN9/EfeN8Lu6ZeSIs3QvtG/X1zJ54D+qRfoBan5F6:6pUlRhSESHEfeeLu6ZeTs39/X1zJ5w+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736358, "uuid": "c9903368-5fed-4cd7-970b-7aeeaea71114", "value": 1481829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736358, "uuid": "1f7f1dc3-2fa9-4133-9e87-cc72f9bcfe7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736358, "uuid": "f266cf5d-2929-459d-a73e-9046a2fc7b95", "value": "nPedido_de_Comp.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914c739e-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772697711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697711, "uuid": "786d32c6-17a5-40cd-8fb9-b8ce9e7be8e6", "comment": "Malware payload (RemcosRAT)", "value": "4959bc08355816e7e71dfee7a6c7c3a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697711, "uuid": "cb51b48a-2aaa-46e6-9b30-6c35cb51ea54", "comment": "Malware payload (RemcosRAT)", "value": "b098a1eb7a1b6d9b1c8b5d58b36ea9fcf51dd3cf057069251ab6dba7902d784e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697711, "uuid": "d589eb47-0d96-41c1-b561-14d96e8460ed", "comment": "Malware payload (RemcosRAT)", "value": "2e667aa8f976332f849375a3cb9aea2f470708be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697711, "uuid": "0b399c60-3cd8-4628-8a15-da1fa3fc3948", "comment": "Malware payload (RemcosRAT)", "value": "fe9e7ac808d4134de27ed49bb843a30a34ac0b4f6404033f18621c3898d7798c4cb52e240ed50e5a26760d2f30e5429e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697711, "uuid": "5211caed-286a-424a-83f5-2310c686239c", "value": "T15845C990CE60C984E630458DF3A89185ED3C0543F16AFC1CBBBC75B6A59F688E2F2791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697711, "uuid": "ee60a89f-1e58-4056-993f-f1386aabbe1a", "value": "384:uELFmd9R8wqZQmZeGlP61lD/ZTdfZn9lbWZoDqlDuZX+nYUTvv:YYYUTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697711, "uuid": "1bfd0bf7-659a-4832-a2c9-13d86974069d", "value": 1228839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697711, "uuid": "4b331831-75bf-4e52-ab41-b70afc328864", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697711, "uuid": "bd3c1619-fd88-4b01-aa6c-6ca03f6760c9", "value": "RFQ CASE REF NO - TMY000103.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c02678-18d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772743351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772743351, "uuid": "e7c8fe35-77a0-4c47-b41a-37a01c8d4834", "comment": "Malware payload", "value": "4e242163f1696ea9a789dae83243ad24", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772743351, "uuid": "641ba286-fd1d-4e0e-8954-6c881838d3c3", "comment": "Malware payload", "value": "b0a0d3cb33cd5211b483701339f1889a4270353c86456487d870522ff6b825e1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772743351, "uuid": "e64e93fd-a0bc-4a1b-b762-cd48c828f527", "comment": "Malware payload", "value": "df57e12dcac0bb503279ab28f65f71f63bb0522c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772743351, "uuid": "684986b9-cfce-46ce-9dae-d4580a60cb83", "comment": "Malware payload", "value": "03cac76bab535a2c08ea07d592c9905086a3103c455a591a5309b5ea36191ac1ebbc7b9aaac1d03fae63b6d3466340df", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772743351, "uuid": "7832069d-7b2c-4ac1-aba2-0cdd66758aa5", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772743351, "uuid": "072e2b24-7820-4455-9dd8-fc8452a628e9", "value": "3:WI0Ra3MLfKxmkfKx:WIs7YmZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772743351, "uuid": "92e59722-3921-4e0a-8d95-159aa3683cf6", "value": 48, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772743351, "uuid": "52d79967-48d8-48c4-aee7-77602523e1c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772743351, "uuid": "3e4e1ec6-8a52-4848-94b5-bf54da7a5110", "value": "1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c9dd95-1862-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772694630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694630, "uuid": "48330b2a-8bcd-4d9f-a70e-ff7d06488969", "comment": "Malware payload (AmateraStealer)", "value": "3f46ee2b95b2669d6f968ba35b70e422", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694630, "uuid": "a40a0c23-d2bd-45f2-8643-b59700353c79", "comment": "Malware payload (AmateraStealer)", "value": "b29afff0321315379fdaa7c7ffb7a289228cc81b264930e8794a293cc51810eb", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694630, "uuid": "f75e6c82-4e3f-4c6a-a1fd-ae256f0a5deb", "comment": "Malware payload (AmateraStealer)", "value": "1133239e06d7d7747fb498abf372b9af2aa40864", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694630, "uuid": "3e4da653-1d85-4f69-b083-a6f69414629c", "comment": "Malware payload (AmateraStealer)", "value": "65285bebaa3fb20b2eb7dc3d0521e149c6c0dd55165e32ae59d6ff57030298ceef39fc1fbae8fb97166d1590fc76ddf2", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694630, "uuid": "66683643-2b70-4df8-affd-232b80b39efe", "value": "T1F146AD11BB588826E5930272767E97BA14387D300B34C1CF56977BBD1BF26C21A36B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694630, "uuid": "2d478bd1-13ad-4617-9b7e-0f699c0eff67", "value": "5467423689e959df2c2760382c79231c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694630, "uuid": "72a99042-d471-4eb1-b407-446139b1ac5b", "value": "98304:QQFd3bph5BwGC6Dcq3+AXhKmKURPKSjyCjoZjZ7emMnAiHdyuSBbuIeTC8SqPsI7:QG3bph5BDCRq3jdKSjyVZRwm6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772694630, "uuid": "13609995-bd63-4449-b3cb-a7e03077f165", "value": 5539920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772694630, "uuid": "0cdbf849-b56b-47db-a910-3665cf4ca2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694630, "uuid": "6a7db0ab-b1af-4113-a736-3b6a9e22dcf6", "value": "3f46ee2b95b2669d6f968ba35b70e422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8b2730-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707714, "uuid": "a793d8d3-5d7e-4ee3-b088-d40f5aa4a87a", "comment": "Malware payload (Mirai)", "value": "14d375c1d67f966809dfe9fdb4e88047", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707714, "uuid": "30ff21b8-90b7-4bd8-8a57-34a8470481e9", "comment": "Malware payload (Mirai)", "value": "b2cd21124008bc397546a71ddf599095f11c3b4ca33ec17114c6512441bc5838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707714, "uuid": "5444ca5d-2fa8-4619-a250-b511b32cb44a", "comment": "Malware payload (Mirai)", "value": "8a05da899c72c0712ad8dfeb318889522fb64c9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707714, "uuid": "5a7b55ba-8aa2-4a1e-b18b-63ee397fec2e", "comment": "Malware payload (Mirai)", "value": "abc64f954b88f0f0d9e4acb7e7eea7f232c4a5e08a93c92b92d99832a6582558630f96cbd806225c0042307b302d8013", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707714, "uuid": "d681a29d-f019-4476-9537-8f833e942cb2", "value": "T143B31996B8D15F11C5D612BAFA2E018D331263ECE3DFB2138D206F24778A92B0E77955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707714, "uuid": "92aa920b-955d-4c8c-b4ea-11bc4075be2d", "value": "3072:8gyWg64fSKpc5pgoPC0aaka/ZRCLYxzwwbZnl:8gte1+y8CDaBiYFwwRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707714, "uuid": "441375fc-7d46-4bc0-975b-3898ec118dc1", "value": 111984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707714, "uuid": "8e1cc5f5-7f52-43d0-b723-53431cba584e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707714, "uuid": "f710b542-2a3f-49fe-8fdb-37edd848a538", "value": "5r3fqt67ew531has4231.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e177d43a-18d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772742084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772742084, "uuid": "db515dfa-19d3-4f2a-8960-0bfd998ee5f4", "comment": "Malware payload (Mirai)", "value": "60d08fb264b862abdf9ccb900fcb552d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772742084, "uuid": "0c0dba91-44b5-4e07-abab-b56adb382ebd", "comment": "Malware payload (Mirai)", "value": "b6cdcf25ab8ab01a0edfcc681ed264bdd5ecd04498906f75241a303d67cc0bad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772742084, "uuid": "ce8a7edf-4183-4b11-b39f-956124830539", "comment": "Malware payload (Mirai)", "value": "9a759ec74adbd302e7c6c9f635f099964e2cccb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772742084, "uuid": "ee73f6d0-87d5-409e-870c-3e0c975a1b55", "comment": "Malware payload (Mirai)", "value": "3d2e0af99a3b03f6858d1c9eec7bc74d8e8866d9ae628a59644cc51020f2558e05c0db948058843610e32841a00f4955", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772742084, "uuid": "3654d836-c99d-4e72-ac95-544254bda7b8", "value": "T118D34B06731C0947D2632EF43A3F27E193EFDA8121E4F644355FAA8A9671E321586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772742084, "uuid": "18f0c35e-639b-49ab-9d18-722598f4611b", "value": "1536:fRkySkzXFQSI2YIVxfjI1EPF1IQYVA7ikr4trvArjrE2+N/NuqNnRsI0:fNzNYIVxeE/v7Xr4erEt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772742084, "uuid": "176cc145-7a68-42d9-91f4-f6e87f24a683", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772742084, "uuid": "fa1359b9-2c99-4aa5-88c2-826f71146b7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772742084, "uuid": "b7148453-7076-41c6-b27b-3d82edc2ffe2", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebf2d7d-186e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772700015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700015, "uuid": "63e067f4-c22e-4fb3-9d4b-c315d5b64eb2", "comment": "Malware payload", "value": "31a43082612e10377bf367661882dc61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700015, "uuid": "93dc0aee-2110-4604-b2cb-d04f704ab3b7", "comment": "Malware payload", "value": "b9d8be474ee01ae55aa31a0893a6bf7bf8d8c4e38d2bd746a862e8d25f969143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700015, "uuid": "2e563c6d-8559-4131-9212-06a19f7562cf", "comment": "Malware payload", "value": "b2afed2a1fb8f9dc52c1338908bac99cb9ea59ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772700015, "uuid": "d94e68cf-f68a-4398-9524-c9df61a2f0e4", "comment": "Malware payload", "value": "a8b799831a3986bad6ff652fa0af5fef6ac8fe45a45ea502115cd57bff34b54419fc2daef3da337377684e50cfa074cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700015, "uuid": "d54af61b-56b1-488a-8723-34af2516e6e8", "value": "T145D3F8C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700015, "uuid": "4892e338-41c2-4838-8f96-86e5971e9165", "value": "3072:4Nbul4MGHJLqHy5Fut5K/cwpifdDounVoQV1jbiGLD3rQtJ:RHy5ct8/cyiWuVosLD4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772700015, "uuid": "998fc93d-6a69-47a8-a38c-0a861973f1d5", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772700015, "uuid": "5a29c036-6059-4c54-8e57-f47c5217f277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772700015, "uuid": "fa12e9bd-3b81-4a42-a1a4-a597a380e08c", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50458d3d-1892-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772715211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715211, "uuid": "44efc514-24ea-4a3b-a0d4-1ce12b3bacb4", "comment": "Malware payload (LummaStealer)", "value": "df197257bf3a488033b9b6fe82363256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715211, "uuid": "29522f7e-4700-45d8-86e0-abcb6b7560e6", "comment": "Malware payload (LummaStealer)", "value": "b9e5ca7d2cbb2bc6a554e1fc68e9b43d31dee96bd040acd52e78b9f19077a655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715211, "uuid": "15127499-aaf6-4867-8616-8d843510e1f6", "comment": "Malware payload (LummaStealer)", "value": "1e110e98f315dacfca454271621ff3d45e9aec99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772715211, "uuid": "b1f7797c-e868-4cda-9f29-b54b793c5aef", "comment": "Malware payload (LummaStealer)", "value": "3da22844b9d5cf05b0ce65aedf9884b72d049e83181ee812d5064ba839d10b14d0754fa30171085b40cf6b8a3ef57939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715211, "uuid": "7f7abaff-2f40-4d3a-81c6-806f9ad10ba2", "value": "T186A5E0216EDE4A63E099327189D1E7027974BCD4DA94C357BDDC2A7B0C340762F2B63A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715211, "uuid": "c7df2ce8-dc59-4868-9230-58112f648132", "value": "49152:o3hZ0c01NWV7rjJuqeMO8BxO0zAviLZpUOSMVw3C8+bhvkc:o3hZ0chV/j8XcVAepSKwk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772715211, "uuid": "973192f5-87de-478d-a20b-40f45bcd617c", "value": 2201600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772715211, "uuid": "6d52f07b-ae5d-402f-9712-2b602266173a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772715211, "uuid": "380ef19e-0723-4da8-8e3c-578032299259", "value": "b9e5ca7d2cbb2bc6a554e1fc68e9b43d31dee96bd040acd52e78b9f19077a655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5066623-18a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772723970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723970, "uuid": "60b6187d-ef4b-4238-8519-44759cd2bacd", "comment": "Malware payload (Smoke Loader)", "value": "bee595e3003d5f424fc85dd351118eeb", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723970, "uuid": "08728cc2-c42e-49ff-85cb-7cc37274fe9d", "comment": "Malware payload (Smoke Loader)", "value": "bac70244b93a4a92b9d633415435cd81e8643ecd20b52b962b369ceaaddc3958", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723970, "uuid": "232104a4-cc84-41ce-a797-c5c636bd4af4", "comment": "Malware payload (Smoke Loader)", "value": "34ba97248cd8ee0781925b798d7d2940102df844", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772723970, "uuid": "4fb0ee09-46e4-4854-abc1-0ebc082a4748", "comment": "Malware payload (Smoke Loader)", "value": "001f9263278221eb31b47d85b3b69c88436f7445daabb9ab31594bebbf99c1322bcd8f021fc53e84c14b3d68e44c7030", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723970, "uuid": "7d77250b-1229-4e2d-bda8-b7da374d07e0", "value": "T184756A43BCD060B5E5AAD2328EB111A17731F85A0B3137C72E5566B82FB77D41E3A398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723970, "uuid": "a06df165-53b9-49fe-a769-d6f4916af94f", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723970, "uuid": "b7d364f1-d1b2-4d9e-bcf0-bab6b8306f41", "value": "24576:tDDmWGtcPKsliPZGjTRRYrxCj3aAz+kcLOcsYgtsOA9K1Q:tDSWGtcSsPB2Ay/LMYgt29K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772723970, "uuid": "91e56cfb-ec9d-428d-9c69-112b2d760cff", "value": 1624064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772723970, "uuid": "4fbc6310-b7ce-4420-90b4-fd4853c4795f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772723970, "uuid": "fc8a8756-d9ac-43bb-aeb3-6a0c63b7a95d", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f78ae1-187b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772705602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705602, "uuid": "c3e814b6-c179-46db-b75a-f4c4c1a80116", "comment": "Malware payload", "value": "0234fba371f020e6a07ce214b07017cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705602, "uuid": "67af6b8f-bba2-4587-8664-a48f7d5a3fad", "comment": "Malware payload", "value": "bb299ca292d35ba826fab67355c4d4ec9aef3663f1e0910203747dbf027e16ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705602, "uuid": "60e819f3-6e54-408d-92da-ba4250ba5498", "comment": "Malware payload", "value": "fb367104773a508b6589378c09d343de9b443a85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705602, "uuid": "b34ee3a6-4e0d-476c-af82-2b73bb26af39", "comment": "Malware payload", "value": "09270d706eb55cc0d841a2d000a067f19697be270d6201584399593ae260b08490bce6db888e1b980a67662cdb5c16aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705602, "uuid": "dd85b3b7-9a90-4d08-8244-cf9a6b34856a", "value": "T123B63313D57BCCF0CB234678D6E10A46BB4A058A9C5AB8D4E584633E55D34ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705602, "uuid": "54a758ed-ca80-4577-b5ec-842dc0278cce", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705602, "uuid": "203600b4-fa0d-4868-a32b-de21e1210739", "value": "196608:vaZk+wH0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8H:nnH04RT9R4PkE7Ap84p29qIT0Z6rXr8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705602, "uuid": "8972a628-d362-48c3-9645-6cd8cfd9c034", "value": 11055720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705602, "uuid": "34b065be-f84a-410a-afab-153d03ec54af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705602, "uuid": "bbb07ebc-8896-4414-ac63-b67de0b40eab", "value": "ZoomWorkspace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f6c4e0-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1772697749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697749, "uuid": "61f8901d-cebf-462f-be80-d0163b874476", "comment": "Malware payload (DarkCloud)", "value": "350fb4f443b8a223150a119793e52574", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697749, "uuid": "7c415390-427f-44a4-9815-078436f7dd82", "comment": "Malware payload (DarkCloud)", "value": "bb98f270bda3a4caa1ba6f3e24abd77ef017b19888f588c169a86286cd1cd7de", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697749, "uuid": "3b646320-5aa5-4144-9c7d-22b07b19d836", "comment": "Malware payload (DarkCloud)", "value": "ee6f672f22b46ef675ca3601551ee7cfb31cadbe", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697749, "uuid": "bbaabf74-ebb4-4933-8463-279126f07c43", "comment": "Malware payload (DarkCloud)", "value": "4a12d05dd68f706534c2ad9c55ac02bd2637c28ba7278b4b6f09d2b92e11bfa75349ba8bc691258fb2712d147042e008", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697749, "uuid": "3bac3a01-774f-4faf-87bc-8a78503af8b0", "value": "T1EBD5D0A0DB166BD5C823643C60BD364960E34B6F562DB396E335BD0BBCAFC90158A4CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697749, "uuid": "db3465e9-3dde-4e5d-99f6-809834c9ebaf", "value": "24576:V4dqPcewdPWOuQvRyhMkzCK/qePZ4jBRzImpd5B2OFpPm0Bo2GtxaehtLxdwXCR0:IqPK+JCfj7B2+PEnta5sEGIDX/0zz9wT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697749, "uuid": "63d23ecd-2270-4b95-be39-3cf346e90e1e", "value": 2818294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697749, "uuid": "4966790c-85b2-4f9c-a788-16c29d45c2db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697749, "uuid": "074ec1fe-9fce-4fef-a837-58d91260ad53", "value": "350fb4f443b8a223150a119793e52574.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0099cf84-187f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772706917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706917, "uuid": "b1a8c8f5-4924-48c7-944a-e0a94af97096", "comment": "Malware payload (Vidar)", "value": "5ceaa8e440cde28df2477b97e44ee799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706917, "uuid": "554d0527-8e6f-49db-ac71-37aeea2ad95a", "comment": "Malware payload (Vidar)", "value": "bbbfd105f713522e536bf2ba6ab78763deb03850ae3c6dba98478c61cbbbc882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706917, "uuid": "fd542ab0-1289-4e03-89ae-6b02034e06b7", "comment": "Malware payload (Vidar)", "value": "982fc198ffb77a08affd03f843c20231c6e6a540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706917, "uuid": "209633cc-037e-4278-8369-8227fc5bde53", "comment": "Malware payload (Vidar)", "value": "6bfdb8c0ec2dd71cffe65aa0ee7531696a3946c35faa9334ed9d76e796365efc28b22ba16adb20f2199d772d29cbaf38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706917, "uuid": "162a6f3f-32f2-4dde-8fc1-6490f78d534a", "value": "T12CA6F5AB2EE68768C31D813AC0928B4195F37D74072282F7027307299A6DDD55DBEE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706917, "uuid": "10669b8f-6038-4f49-b4c9-6f54462000ce", "value": "c777c0958f1392e5aefc182510e58608", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706917, "uuid": "f2bc2870-8aa3-411d-a229-9e476c55339d", "value": "49152:fsx2id0vJ038GaE05/uzdQ/7KzsSwFYlPZPyen1qFxIjPpSCoeouHkRAPKsnapnf:GDqMPNoeouERHsnapnZhQoIu6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706917, "uuid": "600b317e-7013-46b8-8374-fdaadcb60c4c", "value": 10250752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706917, "uuid": "d5a63895-3007-4da0-9116-834806c7ca4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706917, "uuid": "ce17d061-1457-45e1-9648-5621cf6e2fe7", "value": "SecuriteInfo.com.Win64.MalwareX-gen.79944476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba02eaa-1839-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772677166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677166, "uuid": "f5381a52-22c2-4718-8c84-87919eb96d31", "comment": "Malware payload (CoinMiner)", "value": "f61b1b6aab4b2f0ecbcc86c9f9ed583e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677166, "uuid": "db36e5fd-c268-43b7-a459-4f32eb9d6c6f", "comment": "Malware payload (CoinMiner)", "value": "bc4b8678d0fca85d3f80017b13e87f9b3eb8a279afe7f69db8f4fa7d65c3e5bc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677166, "uuid": "d0daec43-05e5-4681-bf4a-36273127183e", "comment": "Malware payload (CoinMiner)", "value": "4ea40b487d18b0e1315330b2574e5214032b2c85", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677166, "uuid": "42b4c905-f1d1-45c7-86c7-06c84185a055", "comment": "Malware payload (CoinMiner)", "value": "54340df824b03190f405655cd48f5b5ca92824e28d8be4a4cee1822e3611fd02760d9bffccde74df6f4a5b333ef23550", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677166, "uuid": "b89147dc-5704-457b-9619-0606d4712b24", "value": "T19A55333B879BB6DBE1E7D2B04913E4C88B3C4A6F55184F02836E947B928723277193D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677166, "uuid": "27c7cc7a-719d-4278-a869-b8e2edf2accf", "value": "24576:BhNOWAYQYpvO3xm1p0zWjHGuAsY5+uB3cVvV01nQNhaLv9nHrp3qpO6LQHcCK:B9AiZOBm1SuG3ziK1neaLv9HtsLQ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772677166, "uuid": "d2a0c101-5fff-4c53-8737-56b70b2f2be2", "value": 1309484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772677166, "uuid": "3287029d-7ac7-42c8-af00-5ed9696ef6b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677166, "uuid": "a36406ca-9fdb-437a-97ae-60813f9319bf", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6536fbf3-18c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772735003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772735003, "uuid": "b899c9ba-4cd5-4f87-b785-d6faf3d5c97a", "comment": "Malware payload (Mirai)", "value": "201b2f6db57c1197b83a20815ecaeb0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772735003, "uuid": "0e1fe03f-bf99-43ec-b402-adfc33df0b66", "comment": "Malware payload (Mirai)", "value": "bd7e4b9beae675f0a54cc53506a01192c34ea846c9762857e6281853da8e343d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772735003, "uuid": "18d37314-a735-478c-8945-deaf76d4592a", "comment": "Malware payload (Mirai)", "value": "c05d2f6472c8cab66833709cf5735183e9463f60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772735003, "uuid": "82e4edb2-23a5-472c-b2d2-d93471661172", "comment": "Malware payload (Mirai)", "value": "7409a7a337988d730a542d836b6da29c2da32df8069e91b88ac3915c7fe79b19c267487534f0034e52a8e6f55f78f34a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772735003, "uuid": "ebf86dc4-aeb4-42c9-91bc-ceff83a9576c", "value": "T1F0242A45AA408F13C4D727B9FA9F424533339B54D7EB63069928AFB43F8779A4F22601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772735003, "uuid": "6f72d4e9-25f2-4004-b69b-a97ef536f5ff", "value": "6144:JckyFHBMnRE4ZaaIhOd/mlgv/MtTUHoxOM/RMGOaq:a9HWRE4ZadhOd/mlsUxXxn/ZOaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772735003, "uuid": "2adc9dbb-795f-4275-a73d-387e73ed8aaf", "value": 215253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772735003, "uuid": "8f5cd988-44d5-4da8-a6c7-930e1c073aa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772735003, "uuid": "98c0d1af-3714-496a-ad4c-daab73e54c6c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36fcdad-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703378, "uuid": "3fcadd9e-6318-4eaa-9de5-7a855aee0aa5", "comment": "Malware payload", "value": "eff4dc8ef3950617b9dec58ab56fcb33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703378, "uuid": "2b9720e6-f940-4c34-b608-6fefd7fcc260", "comment": "Malware payload", "value": "be21cdd6ec65f93c1f69a6603285f836f03f0a7a75bca0c0f076ae44dd1d03f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703378, "uuid": "726cf535-265c-45d1-b38a-ae5508cb93c0", "comment": "Malware payload", "value": "b606f0bf1a747510c22c097008e747bca81d5cb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703378, "uuid": "e2056118-a84f-45aa-9adf-cb3c6cb0edd4", "comment": "Malware payload", "value": "513e803cd44e0a38ddd30a4d5198d465bf1d29f8465b1f9753b5695df5011a462120140539f01157043a3c3ea3c88f35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703378, "uuid": "0df59566-8e5e-4847-a58d-442f181412cd", "value": "T1B0F6AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703378, "uuid": "2f03d3fe-5a2f-48ea-9288-1ddbc3766cee", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQx:cqYUQuVDt0TZEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703378, "uuid": "98bfe580-7660-4bee-90c0-8303031ca1cc", "value": 16121856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703378, "uuid": "5cb9fde2-0f0c-411f-9154-7d38ae1d4727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703378, "uuid": "6e398c01-e2d6-48a7-bc3b-2009e0f6a5b8", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e43fdd4-18c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772737542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737542, "uuid": "aa779f68-814d-4ff9-847f-20735f7f9662", "comment": "Malware payload", "value": "1f9b3ef5cec863000853e06467921ff7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737542, "uuid": "df07053a-322d-43b1-9885-43a63b63898e", "comment": "Malware payload", "value": "beb6979d6de1fca232dff618fa0bf08b636886cc035af89dc8729176843907c1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737542, "uuid": "93b26790-56dd-41db-a2a7-4128834f304f", "comment": "Malware payload", "value": "71794a0fdc7d789254802894670d8596394f1c75", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737542, "uuid": "71580015-27cd-434c-8f04-2f66cc87b506", "comment": "Malware payload", "value": "de98eeaf3fe361ce094ba4bb2eb14f852bc2eea31bc11fc67cbc12446966743508f45f1128dbf45234617ef8ca79c3cc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737542, "uuid": "c29773e4-1984-4800-9161-3187b29ce61d", "value": "T11F116A15DC02A9A75E5776E8CA130A18DC79F93B4059A80DB714CE492E359F8B1607E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737542, "uuid": "60cbd409-2eaa-445b-bae3-17e36c5e7633", "value": "24:KXnAKqahwAAT2Fpc0K5NU9RGUimUwn/zii9nJswC9KVk6Uwn/zii9nJ7wC9vZ44:NBp90YNIGfmdJJC9KVk6dJkC9hT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772737542, "uuid": "6d500505-e100-4fb4-ac3d-d597e59da95c", "value": 1102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772737542, "uuid": "299e4ea4-2c83-4105-8b5a-5b4f4a9c8c3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737542, "uuid": "e2f1dcd7-b030-47a5-994b-34f30ffe8675", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e1d3fe-189d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772719990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719990, "uuid": "884bf196-8b7d-4f36-9303-94bbcf5bb558", "comment": "Malware payload", "value": "d3f8c08f17e12ee468df66206c11532b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719990, "uuid": "d8287495-4549-4f11-8cae-a28a5426d52a", "comment": "Malware payload", "value": "bf867b950a957a6297faa076cc52ef58dec3cb43a03acd8d76b5b874e7687895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719990, "uuid": "2982b0f0-2e23-4a92-ac84-3f9f56966357", "comment": "Malware payload", "value": "f0a9390437af8943f1e9e49e26ad39f3d766fee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719990, "uuid": "e9c90138-b3f9-45f0-9021-b4e779c4041c", "comment": "Malware payload", "value": "c2a71c5c8b6aae250cddce3da86fa384a78fbaf9c68d827c4378e05304027e72065bb2b2424a651851a7032ce633b1ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719990, "uuid": "a4448a85-7bf3-4264-9dd1-2c107d5837d3", "value": "T1579533CBB9E349EFDE11A57732F80342F588FD4E89E1234965A78E8AAF4F80117904D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719990, "uuid": "c20ee96e-ea38-47ad-bb25-6956184ff1fc", "value": "3361e9be11d6f7c365756ff03be5c096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719990, "uuid": "a7c8d762-eeb0-4a4e-a0ed-60cc762f51c2", "value": "49152:cCvbvA6FXOdoE4IQVlFnqCNzMuq8hav8Dt38ShX3:BRXOKE4FlFnqsz9q8gvMHhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772719990, "uuid": "d1dee5f0-4d29-409c-846f-cfaf28969aeb", "value": 1916416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772719990, "uuid": "1064ddb6-5e7c-4847-b993-e9b2349bc5fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719990, "uuid": "dbdee98f-2153-4f05-901b-af0184a9a800", "value": "bf867b950a957a6297faa076cc52ef58dec3cb43a03acd8d76b5b874e7687895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f4701b-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703386, "uuid": "6bb3d550-774a-4e35-9792-42ce50a8ed16", "comment": "Malware payload", "value": "2f7a3f1410dab07c328de52e2de877cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703386, "uuid": "f456d09a-3dae-4204-8d9c-256cf39b1c8d", "comment": "Malware payload", "value": "bfc3ad8e8a31422886381bbfd1c955c808ba9a7ba0996cc4a18093b1d77c5cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703386, "uuid": "5171cd6e-bfd3-4818-82ac-c000d7206e98", "comment": "Malware payload", "value": "dbfc4394888ce02a755319513c78feeec4df6b7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703386, "uuid": "c18d4866-cb25-4298-91b1-a56155810a53", "comment": "Malware payload", "value": "d8b3b8ca348a3926dba84c0baa4556002858b139296f983990c55998056c2b48709f91c043a9ae51f896b00eda662293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703386, "uuid": "f70397fc-22fc-418c-8112-b78dae4be3be", "value": "T1C4F57D13FCA109AAC4AA623189634292BB75BC490F3123D72F50B63C3F76BD49D7A754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703386, "uuid": "d73ae809-7f11-4f2a-8caa-20cb407169cc", "value": "49152:6ZsR+2bMwdcmebnRy+/pe4/NOTqVClOFo1E4cR/IBFiJUtk9nK50:6W4GwgA8i74cR/I2JbE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703386, "uuid": "afc7e663-1343-4b9a-bb93-024e90920130", "value": 3594011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703386, "uuid": "29aea938-a2d4-4538-8181-7a2352d002f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703386, "uuid": "d9568a4d-f68b-4c58-bdb4-d70535abadb8", "value": "xt0li8nt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377d746a-189e-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772720324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720324, "uuid": "d6407dac-b716-47d6-ac36-13fee097978f", "comment": "Malware payload (Vidar)", "value": "95ad686736c03ec159a13e4df9032371", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720324, "uuid": "255a7d43-3609-4a7f-a343-4efc63e8b601", "comment": "Malware payload (Vidar)", "value": "c071599f02ff215711dabfeae9e96367a093d28b10fa0bf02204edce76c7358f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720324, "uuid": "c223fe3e-69d0-4da1-b7de-cd21cdc4e6aa", "comment": "Malware payload (Vidar)", "value": "f3ef0741a263db2d5afeb3f321b1d1c2eb992b0b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772720324, "uuid": "9f0dfc9b-0e18-4de8-953a-2d579224af44", "comment": "Malware payload (Vidar)", "value": "98a125bbf43b19dbe932abb5a310be41b45a58a3dc0a35c74db653e39ffd5902563ece8c1dc73c0265973a0ef9a4d88e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772720324, "uuid": "d67b05da-962b-4c83-a17c-7d4e276aa5e2", "value": "T133E6F62F665D4568C31E823AC0BE8B45A4F360B90772C6E7DEA4C3681ACE5D44F7E634", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772720324, "uuid": "14a1efde-8026-42d5-b438-a7a553f5ee76", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772720324, "uuid": "a374b56e-49d7-4f15-b4dc-e36f8e943e86", "value": "49152:ktD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUc:pxGLEUp9VDFtYdOTAqxzOk39+b6dQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772720324, "uuid": "cb87cbff-1300-4b60-9e1a-d3adc1eeedb4", "value": 14129664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772720324, "uuid": "4e75fa18-502c-4b75-81bc-973311572dc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772720324, "uuid": "563190cf-0a0e-43f2-9f37-600e1c332177", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cef52ea-187e-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772706562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706562, "uuid": "eede8400-4d86-4da1-ad1c-250443e1f44e", "comment": "Malware payload (ACRStealer)", "value": "c075085d85adb65a389690c766a9afd3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706562, "uuid": "a1daa28c-e069-495e-b7de-79c17251e68b", "comment": "Malware payload (ACRStealer)", "value": "c1a05817b406a8f053a8449d5b66f7075176f902ca818d8b1a69fac7910f8e62", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706562, "uuid": "0e9b3bf0-a25c-4e92-a736-70726bd840d9", "comment": "Malware payload (ACRStealer)", "value": "7c9c9b790369a0850641080ff8a8f16779141047", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706562, "uuid": "bc8aa295-62d7-42c1-bbac-06f63122c26f", "comment": "Malware payload (ACRStealer)", "value": "75f221973f02e75be24a6a0ca391e2998d775acafdd4e409a3f29fff9437cda90ff72d9b71541567a8aa674060d9a9d9", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706562, "uuid": "aefb5a5d-3093-43a8-b7a9-5d0307e67168", "value": "T101B73344FBAE531AD74EDFF7A64A739CB6A2C009D715BA7B446849002C733F88B1650B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706562, "uuid": "0adfce10-be67-4243-a3c0-8f5f53f0be91", "value": "786432:XXe9qbzUDZPm1hMPjgCzHyNO+rj9FVKOJmIiCCMM2loh2N5LMWvgsYa3db0Jkwnh:VbwDoUcCzHy4+jniCCM5FAPaNQMbqoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706562, "uuid": "45dd8b15-7b6f-487f-a7e8-1dfdafa947a9", "value": 50811578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706562, "uuid": "043d53f1-5186-40d9-9f9f-7529586fbd4a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706562, "uuid": "fc579bd1-56ad-446d-bcb1-84b6847ba54f", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b2c38d-18bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772734710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734710, "uuid": "8eb6bbb6-f74d-49b4-895d-24144fc5ced0", "comment": "Malware payload", "value": "72a2c4cb2c77e482b03ef1e038f53e8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734710, "uuid": "0881c848-5e5b-439a-8629-f8927f63404c", "comment": "Malware payload", "value": "c1c989bef04b728b4f2a90d1a7fd974db04b42c00e342217a48c72b7e50dcedc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734710, "uuid": "5498a79a-6424-442f-bc37-8b16423c88a0", "comment": "Malware payload", "value": "277a6e061465866a7b74425a0ea2711cb3cafbf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734710, "uuid": "eef4e791-c906-4ac0-9510-8ff4ebebf0f3", "comment": "Malware payload", "value": "c98e72f908d9b4f50491778ec0e80c4458d6644b791c2887aa0fbb9480e022c12f1337de1be29242cd468bc80dde1f11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734710, "uuid": "8ab471d9-ae9f-4e1e-bad0-bc45fc5c186a", "value": "T1B5136BA28CA41E14E185C531B8360F32F357A910654B6FBF16A7833D8887DADF2463A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734710, "uuid": "8f3139fb-514e-472d-abc7-83e2fa811f31", "value": "768:svHLLck6cB6/ALceV/36cDKGAiC1kVK35S5aUoko++eCdgNJJfiwbuqI:svH8YM/hU/lxBK35S0DkoeCdRwSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772734710, "uuid": "415d2b6a-1c17-449f-9d16-ada4d7619a3a", "value": 42476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772734710, "uuid": "5764d90b-f869-43dc-a210-21ffe06a3fee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734710, "uuid": "f7935e78-1e04-43a0-aaad-861db1dcd726", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9503ff38-1887-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772710602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710602, "uuid": "f51f3154-dc47-45d2-a518-aa086286ac15", "comment": "Malware payload", "value": "92f60203310575e7436bd0b879f8d945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710602, "uuid": "785b916c-fcc2-4935-9d1e-dff136f11824", "comment": "Malware payload", "value": "c314c4531c4e18a1e81785650129065cee90f932f5b2d68af8adf1ce588ec583", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710602, "uuid": "281fb659-e170-4c77-adf5-82ce076e8605", "comment": "Malware payload", "value": "4254a35d78cfc0e3e37681dbe5d31dc3cff8cfce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772710602, "uuid": "25a40318-9c5f-42e3-8332-fe9f254607a1", "comment": "Malware payload", "value": "6f57d6c7ccde3027e9873655c31ca5b79a390ec4ba12d2f051a47eb4fd34e65507d5657aba8499a41e43517ba359c1ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710602, "uuid": "b344ef13-5fb6-4e6b-aa3a-77160477d8b8", "value": "T16D0833F061D90041C9ADCA742C31F1FC154BC315BAEADAF9AE3B50D96E2D217EA091E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710602, "uuid": "60515db6-daec-4f78-8a00-a123721b3cd5", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710602, "uuid": "4160a8e2-551c-4e2b-9fac-593186400b4b", "value": "1572864:z/c4ikIm8X68dbz4aijzdkTufDOe5GnxLHFT+yvENJWLgh:zktkIm8LdcjRRtsxpT+3LWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772710602, "uuid": "bda7f811-efd3-406d-8ce4-07d93ce4856e", "value": 79765528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772710602, "uuid": "54395a37-b527-45dc-9847-833a3ae51a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772710602, "uuid": "0e885339-61e9-4360-8b62-5bb4bb66255e", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7c1d31-18c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772734908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734908, "uuid": "cf10cb28-1938-4285-803c-4af69504fb32", "comment": "Malware payload (Mirai)", "value": "f3902167b2ce4dfe4c7d1f21504425b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734908, "uuid": "b339e3ec-3dd8-40b6-9820-abe19d9a9fcf", "comment": "Malware payload (Mirai)", "value": "c32008c409c2d47c98ee62ad453ed951426c8e45f40b2a8f911fecd5936070d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734908, "uuid": "4e83bafe-2cad-4065-8194-e429bf4639d3", "comment": "Malware payload (Mirai)", "value": "fe9b4104c4ad74fbd24bc164538f373009374d60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734908, "uuid": "9ff5825a-a8e5-4d28-a296-19063d49be40", "comment": "Malware payload (Mirai)", "value": "2fc34f19cf8b7ab24c4850d1735f20ee242013268f1f88cfdf473b4181d2d558ed703a5d5fa269892ecc9b51a8d18fb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734908, "uuid": "06a49924-7703-4dcd-9da6-db090a80aca1", "value": "T18E732956F9806F11E5D521BAFE0E0149339357B8E3EE72129D209B2537CBA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734908, "uuid": "472b2f92-ed95-4704-a4fc-1633c4846328", "value": "1536:6+nxA25aqa5OoZ5ImE5eta56SC5PgxQLfioHBVaqeSEY6tBillfiXKuBfML8cY7J:2257a5hZ59E5Ua5PC5P77imBVaqeSESy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772734908, "uuid": "100c2309-0282-4679-8a79-62c954c4edf7", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772734908, "uuid": "72978b77-40a3-4ee7-aafe-603053f894a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734908, "uuid": "ed01763b-79e8-420b-a230-728df187a304", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f05171e-187c-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772705706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705706, "uuid": "71d2588d-fa13-469e-8d65-866a1c0f68df", "comment": "Malware payload (Smoke Loader)", "value": "96a64326f49895cb865125bcf1f3e2b0", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705706, "uuid": "8019e875-aa82-472e-9c01-48980b0d26ef", "comment": "Malware payload (Smoke Loader)", "value": "c3a891c4652dc9f892b685d17a28b9c04bab0c5c162916b9a4a29bfe9cf5e852", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705706, "uuid": "ed7f7b0f-87bd-49f2-a671-4b04b081e13b", "comment": "Malware payload (Smoke Loader)", "value": "2c06bc934eec2222403a040da6324c236363897e", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705706, "uuid": "c060c734-819a-47ba-8df4-66bc9cd59e24", "comment": "Malware payload (Smoke Loader)", "value": "1a1afb6ec1cfaa45e70927a8812d9a908756bd63d2d21fab0c7f74cb3dc0a94214339ee76bac32112e9192d819803b74", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ropea-top", "colour": "#8FACD8", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705706, "uuid": "01fcbe95-2265-4e3c-bc48-3480755e4e9a", "value": "T17277BE06B7E84065D4BB9234897B9756E671BC21073097CF2254B6BE2F33BD05E3A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705706, "uuid": "873c5fd0-b825-4115-93b3-a52d74c33777", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705706, "uuid": "0a9314cb-a4ff-4149-837f-1b3d125e07f0", "value": "393216:rYtaqDCKAqtu84lEhiAk/WUg1CPwDv3uFeG6Ex8aTNXP0MdaYeM0QkvIBzeHk6DS:0taq+KAzsM6wT1M9RvpLLel3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705706, "uuid": "00e89076-6dad-463a-a31a-52e34a4b6add", "value": 33660928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705706, "uuid": "a58a0517-b0f2-4024-a66c-16ef1dcd04e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705706, "uuid": "fa0f9647-3576-40fe-96c9-02ec37115b79", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604c6560-1897-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772717385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717385, "uuid": "daf052b1-812a-4e32-a32d-d7f1a672f288", "comment": "Malware payload (Mirai)", "value": "dafcfdd392d56f2e660bea4709f7e648", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717385, "uuid": "5252cb42-254f-4ecc-b47a-bf99d691166e", "comment": "Malware payload (Mirai)", "value": "c44bcc3284b925376c18a2492c38145223601674cc46e3e29d941fbd25295add", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717385, "uuid": "cb1796ed-fa5d-43a5-885e-25b3eb2f450e", "comment": "Malware payload (Mirai)", "value": "c07839fa156d537243f8c6324734e7e885cf1808", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717385, "uuid": "054a5e19-204f-4ff4-ac73-c6cae453c2b3", "comment": "Malware payload (Mirai)", "value": "b2156a6c123499da2b1ba4dca901bdaa7de29400ee21f97c770a1c6e3fd5101f2f8db7b92a5732fac5a0bb6c82f59fe6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717385, "uuid": "98b24005-b946-4925-8f37-592faf194819", "value": "T1BBE33A55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717385, "uuid": "7ccd698c-b0c2-40ae-85cc-6fa4a6e9c95f", "value": "3072:8NMcOPLZDozjefDoHwreWu1gSa0lI7TEy6KuImk/:IOBozje7oHWuOSa5F6K4k/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772717385, "uuid": "8c6eacc3-7695-4f37-8f16-5462a62a6fad", "value": 145552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772717385, "uuid": "77a78fc1-cd77-4a8f-b964-dd055600b386", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717385, "uuid": "6130fbb8-caa9-4880-9021-6ca8f98b7f9d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e90ce39-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772697733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697733, "uuid": "65ad03b2-c38c-4cc6-8ae3-4b780135253f", "comment": "Malware payload (Formbook)", "value": "75c58f98e14214b983718b5c5719fe97", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697733, "uuid": "be5fb2b7-bf9f-462a-897a-d4ea42508f39", "comment": "Malware payload (Formbook)", "value": "c506931fb1c4252abed4ab22d82f2ebc88e46f58dd83ddca62b03c5ea6d8dc1e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697733, "uuid": "5b148daf-f1dc-47c5-9778-9c80defc2527", "comment": "Malware payload (Formbook)", "value": "23f2d9f93044920d7b6579dea7b985c55245a06b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697733, "uuid": "4473019a-849b-429c-b570-4e39c33bb7da", "comment": "Malware payload (Formbook)", "value": "1c338dac6ad9d4fd3fa17f33e0659a85b0c8c390294e133ba3d480c226cb19a0837bf660214ca5be9c7be1332c0f2800", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697733, "uuid": "4caf8afd-f88b-4bb1-aa1a-d465db4449d1", "value": "T1B5E264D57AF9B34867F401338579E2CF8D80AA77CCD0D316B6C9A689985749EC0BE720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697733, "uuid": "be052d2a-c12b-4361-8ef3-30b825eb935d", "value": "384:/YEA19Ajxs3D5ag5Rjbd8Rz6m3S0H5T80PH:wEAIjxs3xrjGRzZT80PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697733, "uuid": "53b2c1bf-916e-4918-9e56-6beb7c0f53bb", "value": 34146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697733, "uuid": "f1518cf4-4032-4831-9361-417dfd3f7555", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697733, "uuid": "3f577928-1b64-41a6-9662-c0c59b626ff8", "value": "75c58f98e14214b983718b5c5719fe97.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8b5693-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681516, "uuid": "00429cf4-698d-4350-982d-6c87975ddde7", "comment": "Malware payload (Mirai)", "value": "3213ad966cace702b5b19a349d4a592e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681516, "uuid": "87d83d60-f1f7-43b2-82aa-a96de4c75172", "comment": "Malware payload (Mirai)", "value": "c5b7bcf0c6454b8f6eba13290e394b26d917bf3e7bfa7179963615903df99cf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681516, "uuid": "01fa6433-4e24-416b-a69e-47b2fd766ff9", "comment": "Malware payload (Mirai)", "value": "9b601d1d7b04822e5ea33b7df9a40798b8cb8b58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681516, "uuid": "f5a6e041-0244-4633-b152-bd358c7f36f3", "comment": "Malware payload (Mirai)", "value": "d7b395facd02fc3dc0732f6470d1ff669b3c0f5f242c59a4e9aeab34db70e88da70f74033bd1da9799836c7f68a1f0e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681516, "uuid": "d2537187-badc-4728-8ed8-c3fb3402461f", "value": "T18173F1ADD5F738ABCCAD0EBCE11E97D90756858431EAC6EEC6220C827E6514DA11D0BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681516, "uuid": "d0d32d7b-7acb-42ee-a70b-712c90af313c", "value": "1536:S0eAFFPF5SR8zIfqgQpv/vcfaEC68pAWAD4wdhYxF1fCc0jJBg6ru:f7FFPFw80ynv/vcfi1AP4gyx3fYjJBgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681516, "uuid": "b43b591e-7877-4ebb-8aad-9de996ab0301", "value": 77436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681516, "uuid": "db9c6d47-8986-4527-90fe-4acab19c15d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681516, "uuid": "189690f9-bd82-4fe6-b0dd-5347d8446a3c", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a00983-18a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772724644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772724644, "uuid": "1ceb5800-06aa-46af-bb6a-bf4f0ba23f87", "comment": "Malware payload (Smoke Loader)", "value": "e10a6518f72ca572efb5b267b0569c7f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772724644, "uuid": "cd6a14be-7f99-4762-a5ee-0ce716be8be5", "comment": "Malware payload (Smoke Loader)", "value": "c60d0b23667af82a59fdc30ada3d6b34e7fde1c878831c027e11738f2fb621af", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772724644, "uuid": "b5482baa-1c8e-444c-bf82-490f537a759b", "comment": "Malware payload (Smoke Loader)", "value": "54f7699d1793e4a38f55192af70330b11271b8d4", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772724644, "uuid": "413bbf5b-a72f-43a2-9819-20bb5ee533b2", "comment": "Malware payload (Smoke Loader)", "value": "66cf361c3af19e797e9d8e5ef9b2581134a51c4e5f3d7146a38cdd58e0131170a4b0c6f0de3f504c2444e68a9bbae869", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772724644, "uuid": "dc7ec938-ed54-426d-98c4-a6fc5252d5e3", "value": "T11A756A43BCD060B5D5AAD2328EB111A17771F85A0B3137C72E5566B82FBB3D41E3A398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772724644, "uuid": "793ebb22-9b84-4997-a5f5-43df65552d65", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772724644, "uuid": "71ee25ca-8c56-4084-a83f-940f9c1c4670", "value": "24576:VDDmWGtcPKsliPZGjTRRYrxCj3aAz+kcLOcsYgtsOA9K1H:VDSWGtcSsPB2Ay/LMYgt29K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772724644, "uuid": "ce85a2bb-4636-4518-91d4-18c77a670d2a", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772724644, "uuid": "4170be8c-aef9-4b8e-a085-4fc4a487ca8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772724644, "uuid": "5fa47235-d7ac-496c-b184-550cb4e5d425", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb47bb7-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698188, "uuid": "c1a1d15d-5866-4c4b-8631-a877662c818a", "comment": "Malware payload", "value": "b0b104bb751ac10be5442cfedf8bf046", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698188, "uuid": "05cf9a80-902d-4f3e-9cc8-5be08a141cfe", "comment": "Malware payload", "value": "c6418bf6a72636506bd08a52f69753d3236ef48bbf281c78f285bc5230cee127", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698188, "uuid": "7e440f91-c9e9-453c-a29f-d2325464b675", "comment": "Malware payload", "value": "6f7eab27fd62e963cbc59b5bddbb91056c4e34a8", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698188, "uuid": "0ddee5d9-57bf-4a4f-b8d2-fb70c6d8d866", "comment": "Malware payload", "value": "040d68be08fffb927249cc6bbe6c0d22017aad3b071c8547f6b488b710ae25d7bf9d75eb6189f567ca637f546b3f340c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698188, "uuid": "f799df77-dada-4763-b98f-9ba0501e5362", "value": "T10A51E1256BE40264E2F78E72543AB100557BB96EEE36899D408885CC1962618E83EF7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698188, "uuid": "0dd1ab85-91da-4965-a6fc-f4c82447876b", "value": "48:8sn2NjZR2h9rYClXN2s+d0MXXuHcXv3KaeKl3lz6N0:8sn2Njjq9rY8dXMHuavKL+JM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698188, "uuid": "8c0e3054-3cc6-4475-aac3-2a1f39328e46", "value": 2644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698188, "uuid": "8211d686-8d2d-427d-80df-6888dcb154d4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698188, "uuid": "7d534192-6e99-46fe-82be-191df788d048", "value": "README - Best Indicators.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9d3df9-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707721, "uuid": "61217166-3332-44a6-8be7-55af72e4107c", "comment": "Malware payload (Mirai)", "value": "5ac26c3a5d2dbb81eaa2ed89d995db18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707721, "uuid": "50e4ad76-21f5-46a8-8743-df5b5a1288af", "comment": "Malware payload (Mirai)", "value": "c6cf46d5693716628271175861adbc96365eee30b7bfa1ce36344e10a9cb7659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707721, "uuid": "69e1eb0b-01d1-4833-9b56-d53b74f22604", "comment": "Malware payload (Mirai)", "value": "d1a274567e7178fa97d18559d3aa9eb6f7827b10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707721, "uuid": "9519c282-3ea1-4ae2-b79f-44fe7194f477", "comment": "Malware payload (Mirai)", "value": "8163c01cc3c247f0e11cea907b614e15b45d1d88cab8ff8d7c58221c8c8a86012472b96f09cff2f27463f8d4ea8db3c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707721, "uuid": "982b8bae-1bc9-4aba-b55d-247dad2f65a3", "value": "T14DC3D50ABB611FF7E89FCD3B46EC1706388C545622A43B767A70D928B54B24F16D38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707721, "uuid": "9b0bb8a6-4c48-4ad1-aa03-949ceccb4922", "value": "3072:obYWwFYiGnQyjTmRoJF/o4zBUwbZnitFg:o0WwRvyW4KwRijg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707721, "uuid": "2342618e-4b10-4b25-b1dd-0ebdf1cb07d0", "value": 129332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707721, "uuid": "071e8b23-0cf9-490a-a916-9b132658b0b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707721, "uuid": "8c8ee0a4-8cce-4312-ba98-1b8f1d0423f6", "value": "5r3fqt67ew531has4231.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c39c3c-187e-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772706609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706609, "uuid": "fa2b0b21-7d5c-4511-9b50-cb0b87e2c9f2", "comment": "Malware payload (PureLogsStealer)", "value": "d614a83c5fa6ce99335b5861f2f676fa", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706609, "uuid": "d855127e-699a-4532-9a04-6c7649598195", "comment": "Malware payload (PureLogsStealer)", "value": "c6d5d5f8682874a8dc4519fb9a5ea243a74638d8a75bae9b5664515d5f77cc5d", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706609, "uuid": "28f363de-6eda-4be7-bb50-4c87a6f00f2b", "comment": "Malware payload (PureLogsStealer)", "value": "76d5e1ea21474360b927227bd2ea91f2f62ecccd", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706609, "uuid": "a4ec9dbd-d1d9-4995-809c-2d1d248b0117", "comment": "Malware payload (PureLogsStealer)", "value": "aab4441f8fd4a88075fce333ac49d4da4ee9cf9904ae47180b3103f9ee06639b6c19ba524ac1dbcd83b27814b01f0884", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706609, "uuid": "d81b74bc-970c-42ce-b191-f35edcc867b4", "value": "T175751212B7C08573D57225350BA65750167CB5B02F72CAAF33EC69AE6B319D0CA22F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706609, "uuid": "9e1ccf27-1a0b-48e1-a283-56fceaa1cfb2", "value": "24576:5N/BUBb+tYjBFHEPxZsSN9/EfeN8Lu6ZeSIs3QvtG/X1zJ54D+qRfoBan5F:LpUlRhSESHEfeeLu6ZeTs39/X1zJ5w+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706609, "uuid": "a7858090-7c06-4188-bfe1-32e62722e8cf", "value": 1550336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706609, "uuid": "f39cff41-002c-479c-8fbf-97f4c9664495", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706609, "uuid": "765c1c66-1d81-4f7f-80e6-1a52fe3e61f5", "value": "nPedido_de_Comp.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca09779-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703394, "uuid": "5dbf7e9d-9bec-4f99-8b12-8ac079d00786", "comment": "Malware payload", "value": "fb85f4cd91808c0563a52933ea5c697d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703394, "uuid": "8d7919a4-6008-48d3-8fba-ed38b28da269", "comment": "Malware payload", "value": "c6f5414fe4b8dd00f54004db9c067e896e5e1d67acca7e88746ab6a782785c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703394, "uuid": "85d675a2-3c09-4330-ba8c-c9e54e313126", "comment": "Malware payload", "value": "125c2941fc2875a4aeab4c4f22e9506044115200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703394, "uuid": "1b2b88dc-bfd4-418b-aea6-14008b3cf1d6", "comment": "Malware payload", "value": "612877a6bb888c6bfa5e09008da11df02c1cc11faa78694e8de759d274aacecd5019074be6ac2c0528f21bf5be9cf3f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703394, "uuid": "b21cf58a-22b0-4e8f-acd6-33f140ae86ca", "value": "T13E462973A49154E4D2EED574C6256212BEE0389B273423CB7BD076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703394, "uuid": "037aef73-44d3-46fb-be03-655069e04c54", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ+:cqYUQuVDt0TZEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703394, "uuid": "22764fbf-bf92-440a-b035-66a61f511ca9", "value": 5537792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703394, "uuid": "5d755edb-a4e2-4cd8-8c04-9ddff38e9994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703394, "uuid": "d80a1785-aa9a-4f78-86c8-f3664da8cde4", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a3b145-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681552, "uuid": "48186141-6945-4692-9356-eeda8ed2d4da", "comment": "Malware payload (Mirai)", "value": "178c1ac70c959b28bf1fb50ca3d57a03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681552, "uuid": "d54281c3-9bbc-41ef-a83a-62e323f9ff69", "comment": "Malware payload (Mirai)", "value": "c7d0b6d5573539f44de288f3fa5078475c5abd08580d905501aac7c1910dddbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681552, "uuid": "be0dc5b8-648d-485d-8038-4a0e5a2a4ef7", "comment": "Malware payload (Mirai)", "value": "c48a138526395a693e50d843728a4c07ac9a2a00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681552, "uuid": "cb47975a-72a7-478b-b1bc-54d510897446", "comment": "Malware payload (Mirai)", "value": "1b7d8e3f158877f8fa340b6c388e5f209354a2dbfe1f1e1a64fadeaa003e13deaea929520d5c31dabac7a34ef6976010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681552, "uuid": "74f53549-3c73-4bda-878e-4075d7367524", "value": "T14F34D71E6F228F7DF369873447B78E25975D23C626E1D585E1ACC2101E2078E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681552, "uuid": "7f90d53c-18da-45e8-bb3e-7f6d7bb45616", "value": "6144:m7tEkIDZXy8PxUhbI5XCagS/CdbeUtYWg0FhMbm9azYQN3uJSAb+PtwrzkXJReF6:L2FXjCV2mU3NW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681552, "uuid": "f512c6a0-9cb1-4cc5-9534-589ba79067ee", "value": 247988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681552, "uuid": "bfff5c63-aeba-46f0-adaa-c1e20576062c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681552, "uuid": "2bf1ed01-9d06-47ff-ac1b-92fd85b111fb", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de45161d-18c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772736924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736924, "uuid": "763ecfed-07d5-469e-919f-a1fc259592da", "comment": "Malware payload", "value": "1c8185449641d9dbe86afb3dc3d78511", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736924, "uuid": "0d9d0e9b-4ac7-407c-ba5d-578fc6618c32", "comment": "Malware payload", "value": "c84f011369999892bf0674cb47482a2d85646870599c8174202a852895ec366e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736924, "uuid": "d661d1d5-318d-4db9-9d1f-0f9338f958b3", "comment": "Malware payload", "value": "ffba46fba86945a5c96a3543bba147be39f0b9f2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736924, "uuid": "cee33d87-0c0b-4cc0-a16b-1ea93b1785e7", "comment": "Malware payload", "value": "f8ab46eb7708c424ec33f36a26d7266d28132cee6812560ce7e1c52511bd11e8191f4a6b2503a0c597164e140dac5af2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736924, "uuid": "faebe06c-8e02-4557-b358-90fe004ad4b6", "value": "T10B472310EBA05025F8F721F756FD956D992CBEF0276450CF42C566ED8A2A6E03E3231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736924, "uuid": "70bf1c99-6fd5-4962-846f-aaf4935c61cb", "value": "dda65c5b8877d629e9188bba19e0c25e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736924, "uuid": "9e21e7c8-2b98-40c8-8d0e-74db399bf251", "value": "393216:nIG6qcMK405dsuJTGHmVN+nO0NrN1IG6+ckj405dsOJTGHmVNwMnG0NrN:nlcMK40IsUO0lnlAkj40IMC8G0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736924, "uuid": "731b72e1-755c-43ef-9a1a-48fc83167e89", "value": 26839040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736924, "uuid": "36127bc5-8cb8-4ca2-9dc1-10384e0a2319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736924, "uuid": "1ddc341c-3509-403f-9fcd-0c6082d4fc0e", "value": "1c8185449641d9dbe86afb3dc3d78511.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601ac8a2-1877-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772703641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703641, "uuid": "96b160ac-ce1c-4b78-a3e0-5715fcde1a45", "comment": "Malware payload (Vidar)", "value": "4acf56ecb29d79a67469ede1c6e5e8e1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703641, "uuid": "c9cb54fa-c74d-4b6f-a3c6-20a582fe1e92", "comment": "Malware payload (Vidar)", "value": "c84f047f38bc1d3167666345d61277f06f32aa5912c0a4612e37d5c8d3b07c31", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703641, "uuid": "e60fd7b2-8a8e-4144-970e-d1e786e1b432", "comment": "Malware payload (Vidar)", "value": "4d0a2685a0f91264aa257e40531712f681166d3b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703641, "uuid": "9130f772-d1f9-4574-b177-cae0840c6776", "comment": "Malware payload (Vidar)", "value": "92ba613a5b005946d3dcf373814d08a438b1a3bd3292cb5c92a518602ba20b9d5f3e61e9c4aeec0408bac7ebdf3abbc0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703641, "uuid": "0474a970-184f-473a-86b0-5ebb0e30d443", "value": "T1E4A638AB37F7CE6CC01D813AC0528B19D8F3B6740723C2D746AD07689B619C79D7AA61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703641, "uuid": "4759b513-365a-4c26-9b75-cf21ac4f21a1", "value": "c777c0958f1392e5aefc182510e58608", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703641, "uuid": "1b1c8c95-8b69-43d7-8c87-23a5fb79285d", "value": "49152:Tsx2id0vJ038GaE05/uzdQ/7KzsSwFYlPZPyen1qFxIjPpSCoeocHkRAPKs5JZbu:CDqMPNoeocERHs5J9nlqPjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703641, "uuid": "dc8dd2da-8ce2-410b-bd79-7dd64341b761", "value": 10075648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703641, "uuid": "4cb98b58-1433-443d-97fe-03920367203a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703641, "uuid": "3e484919-e0a6-4a65-9075-9188064fec6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b06b3a-1881-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707966, "uuid": "31ffc1f1-4a34-4351-b4f7-c8b2a8c5b274", "comment": "Malware payload", "value": "fb9c4d4c75cd9cb80ee8b6765a9fb276", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707966, "uuid": "ed0d618a-60aa-4766-a651-4d09ae774f0c", "comment": "Malware payload", "value": "c8a92e071c10940556a5b5d854a34268ed933ec41bf6f13da27ba95b74e02c59", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707966, "uuid": "d6eda8ba-60ca-43f0-a92b-27e1d16b26bf", "comment": "Malware payload", "value": "85ac0f713b15ee9ca282ec31a25f69c088f755cb", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707966, "uuid": "ba17bb6a-2726-4f18-8f64-53359a035f36", "comment": "Malware payload", "value": "e5d8d3f3f78cdb1b89ef48f39f7e21d92b3885dd1510ded21eeffaba39dc82d42f7e10f5350056710386f2ec048694a6", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707966, "uuid": "d7e765e7-761a-4f67-8115-c5dcbe959588", "value": "T150828505A465387293934CBDC8B5CE41633B6C03E5446E38F97C86C42F6563ACFB2AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707966, "uuid": "9974ba96-4461-4ff4-9d88-b869caf7fc6d", "value": "384:c48PGF0FxRiMiyZpmE5BEnJ+8EOBcfggBIo:c4CReyzmE3+cfVBIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707966, "uuid": "7c357a22-a792-4d42-831d-920124c0c35f", "value": 18457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707966, "uuid": "0e38cb14-78c0-4561-903d-8e9db0aa24e9", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707966, "uuid": "167c4817-03bf-46e0-b83e-cec6b88e2846", "value": "CVE-2025-40554.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20eb4ab5-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772697522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697522, "uuid": "d4dc5771-fc30-42db-bee7-72b3b70b8492", "comment": "Malware payload (AgentTesla)", "value": "183164eced39d07caf47f1e1aafb8ccb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697522, "uuid": "10e67bbb-555c-46a4-988a-6880f44367fd", "comment": "Malware payload (AgentTesla)", "value": "c9acce520b9803dc21d0cd1e163b99e94a40f2fed338b879d63c637aaf4752ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697522, "uuid": "8aaa4def-1978-4c5e-a428-54589fad881f", "comment": "Malware payload (AgentTesla)", "value": "3cd2233556a4dd468491aa7ac99f9aea792ea327", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697522, "uuid": "9194517c-fb32-4a41-a407-fe142686d272", "comment": "Malware payload (AgentTesla)", "value": "dacbc56dcf7e4e45aa97bd49915541811c76a51477ba93b7102d9c99c3eb7285574a0523fdd19616fcaca3793292ad15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697522, "uuid": "574472ef-01ec-4dd0-8bc2-138f8fbf7ce1", "value": "T15872833AF94CDFF40B2E51D5018B6D02609897E6B43A59ADE4CDC1587F277108EEB8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697522, "uuid": "41ff2c03-51b7-43ad-b8c1-0a41aa5b5506", "value": "192:IDgj8sDGma1rmOnVNKV3o9w4sWcPsyI+Sry7DZ4ksIkZWOP5d4P+CTzMP0ojW17Q:oKS/7n2V3QwJ7KJoi8KWOxiPaC/qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697522, "uuid": "0b6d5082-abdf-46e3-8160-3aff86c3c74e", "value": 17075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697522, "uuid": "53ccf2b4-25b5-4f80-99bb-372be89b4cc3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697522, "uuid": "e301e74e-b915-454f-81b2-38234ec5f2a6", "value": "183164eced39d07caf47f1e1aafb8ccb.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a361628-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772697941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697941, "uuid": "2801b1b4-5070-4d78-a5ac-e0829e59d7eb", "comment": "Malware payload (AgentTesla)", "value": "2a211d88c3cc12deb807e76b0077aa3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697941, "uuid": "9280e28a-1396-45b6-8f7c-ac0e3cbf5626", "comment": "Malware payload (AgentTesla)", "value": "c9c2eebf486939ca6c07f8b6f19180c102c00ced204566c163ed872f08aad5a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697941, "uuid": "c63f5115-0671-4a95-b9b1-37dfadad0be0", "comment": "Malware payload (AgentTesla)", "value": "e7a695654318074f15b4042cb370e33c7bcb22d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697941, "uuid": "f4000a9b-52dd-4771-b1f3-2127a6540192", "comment": "Malware payload (AgentTesla)", "value": "8d0daf9c90950a2545fe3f4eb82ce321de7bbff6740d55c74edd6e0d2d00a44d7c41db85550bfecdac2eacabd004ebe3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697941, "uuid": "cc3dcb8c-32fa-40d2-8f22-76bcb1fbe1c1", "value": "T174559D88ADC94E3332BE5B5D1336311BF3E1CF0D58D23DA47F43AB0A667A11521AEA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697941, "uuid": "6f62102b-1a3c-4094-b12c-ae0882406f88", "value": "24576:IkLApG5OW3/ZeSKxpmHirirTkgc5U7bF5eNRlHgrOd++yuRGjpbbDGoeF9Wn4V3f:ypGU4/ZeSKbFrirgg8UfFArlHEOQtuRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697941, "uuid": "ed528f76-dfce-40f0-9026-2b3d534feeb6", "value": 1340446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697941, "uuid": "ff603f9f-942b-4dd2-996a-f13dbf35b94f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697941, "uuid": "82e56d28-21e9-4975-b0c3-e7767f459e53", "value": "2a211d88c3cc12deb807e76b0077aa3d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d640d2d-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698080, "uuid": "4094e1da-8be4-4f7b-998c-1353bf6c8938", "comment": "Malware payload", "value": "3c22affb4be55cd5385aca1e77d9f946", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698080, "uuid": "5322194d-ee80-419c-9d80-3a00782a921c", "comment": "Malware payload", "value": "ca60785914c69fb10d6c203ad70d5301328780c6493809593ace9e0c2864c352", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698080, "uuid": "22cf4a91-e8d5-4c35-9788-6910e574fb6a", "comment": "Malware payload", "value": "6990c2a8ad4c5c24053901394a9fed0542bf3bb4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698080, "uuid": "286b4483-f73a-47c9-adb1-6073902b381c", "comment": "Malware payload", "value": "245584a1596ffd94a8f3075e451d4dfa228265637d4fffacbdd2fd935f354993f4994b3a95d3869948afd988078c7841", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698080, "uuid": "542e0633-554a-44f6-aefb-ec80705a630e", "value": "T108A230CE3AC6F17C02C734763B7FB43AF57F8E542888A054C2567588E865B18D67EA18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698080, "uuid": "ba3484a2-ad83-498d-a827-d282bef37490", "value": "384:x3IH7zxpG0DEvp8wHIL3vZ+K8acKzxcY3Uztd3kmY7k98Ovum:x4H7zxF4oLBqacskztZW7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698080, "uuid": "3c2a2444-a9ac-4b52-8d3b-59c73333d3dd", "value": 21295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698080, "uuid": "1a9a5cc5-0e40-45e2-91f2-4f50b1fc31f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698080, "uuid": "5c16f0c3-723e-4790-bed7-c2813b29a355", "value": "3c22affb4be55cd5385aca1e77d9f946.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde02423-1839-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772677223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677223, "uuid": "c5432b14-e2c7-4434-9511-fd4a4f2c425a", "comment": "Malware payload (CoinMiner)", "value": "1e36aa1b4561f62548aa566012f72d57", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677223, "uuid": "fd538e3a-ef8a-4724-9494-80afe95da5da", "comment": "Malware payload (CoinMiner)", "value": "caff27b96786e8304233ceaa6e497790c2104c15c9cf55f694483c6ca8dbe4c3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677223, "uuid": "828e20c1-16f3-4165-9186-ca515afb42a5", "comment": "Malware payload (CoinMiner)", "value": "d5db8cb3dbd840617c3887ea811e6b80f52b6e3c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677223, "uuid": "1af4f330-37e3-4dac-8949-07c368cbdad5", "comment": "Malware payload (CoinMiner)", "value": "775b4f86ceeaa2434e0e28790475c9522f72b81f7fd0e53edc97023d507070786baf301efba57e449d1b6619cdd8476f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677223, "uuid": "365412a1-7299-4462-bc17-52fe59ab9fe1", "value": "T188065C17FCA114E9C4ABD2308AA69252BA71BC440B3027E72A90F7383F77FD05A79755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677223, "uuid": "670ddc4a-f400-4554-a843-b76f5c29f5d2", "value": "49152:dXApe0ICGI2fyn/dp18Xwt3qupQ94ksj8yd5UxD6760zvfSKU5d8:dEq5fEpHpz5UxKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772677223, "uuid": "5efe4ca5-081e-4922-bb48-89505c6950cd", "value": 3874824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772677223, "uuid": "bb7287cd-4602-42fe-9973-f564f9962f21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677223, "uuid": "dc310df3-a464-4b92-aa37-9bde9bd52a5d", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79e512d-187e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772706848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706848, "uuid": "5b85e8e9-9a85-413c-9b32-de3dba170fa1", "comment": "Malware payload (Mirai)", "value": "58f8648fe44ca5461871189b1651f8dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706848, "uuid": "b4e86304-ae15-4946-9422-76a1d24b48a6", "comment": "Malware payload (Mirai)", "value": "cb6bd26ba5424ba78ce18dd2546fca312ebf2c07c2031d0f7a9f03e6e5b9a26c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706848, "uuid": "7073a733-4b41-49c4-8808-9d5ebe86098e", "comment": "Malware payload (Mirai)", "value": "6ba070d0e4ce6585c40c60be2da1418bbcd19bc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706848, "uuid": "bf67e42b-f89d-415b-ac80-b8c227f1885f", "comment": "Malware payload (Mirai)", "value": "373d21a9c0411af3fe1cf81084f30110ecf847b7caee4ced9246938cd6591eed774b69d5063560d85d37a276f7d9ffb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706848, "uuid": "3b6d8c29-ad72-440b-8a5a-c8274e494105", "value": "T183343B45EA418A13C4D117BAF5AF418A3332A7A5D3DB7306D9246FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706848, "uuid": "d9f5a66a-660f-49d4-98b7-4a4915df380e", "value": "6144:Ego/jNgGzHzakeqacEp1d4n1trnbf9ihM/9+AU:EDhgSHzakeqacE3W1R0G/4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706848, "uuid": "da75cf2c-bea1-4cc6-be46-fd0aad21b0c7", "value": 230976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706848, "uuid": "77203db0-1bfa-4dc5-8402-442460f6c488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706848, "uuid": "715c0962-6ecc-4645-b6f9-f3f209289396", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7e4b67-1843-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772681518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681518, "uuid": "85a2acc9-5c03-4ac1-bf10-82e30903558f", "comment": "Malware payload (Mirai)", "value": "71140ad23218fc063bc4e863f1607bc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681518, "uuid": "b4808aa3-74f4-4b89-8ba7-c5945ad9dca0", "comment": "Malware payload (Mirai)", "value": "cbd05ce746f97e9ced520f8ed41dd57da46bc0155666bff800a9884817e36db9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681518, "uuid": "6d92afc9-d7fc-487b-bccb-10dc0a4fd5e2", "comment": "Malware payload (Mirai)", "value": "f2d07061b00f74aa221b96b0faaef7e2af64c378", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772681518, "uuid": "a976b86c-1a9a-4cf5-be13-dfeb4aefc3fe", "comment": "Malware payload (Mirai)", "value": "e550e92f594417b9ca559396c31f64aa3e795a943d83243447222783a501fc5492649b3741f4092588960f30d12136a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681518, "uuid": "8339d603-4de6-466a-b815-cec2a779ce01", "value": "T19E63026491A34F688B744C32BE3B5A03B5C85FDC959028DB2AA1CB1C66D3F979DD8C43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681518, "uuid": "a8dd919d-fa12-423b-a399-f9c99430d44b", "value": "1536:FUUOGluQ7Ymk5fF+ffaZKcdSZQyTuf7K4LgIY4JAq9JL4:2UPluQ0mGf4i3SZlTuu48IYbaJL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772681518, "uuid": "92de751f-55b7-4b29-a861-82c9f79b11fc", "value": 73116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772681518, "uuid": "fe4babcf-39d5-4a9d-9278-373875c40e9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772681518, "uuid": "180e5333-1a26-47ea-8c32-848b46826e9f", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e19817-187e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772706839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706839, "uuid": "ff54a899-1a09-4a05-a5c4-abb5660c88bd", "comment": "Malware payload (Mirai)", "value": "ac31ea259c6a3a6cad084a1e6f9235d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706839, "uuid": "a159ba3f-c21a-4441-b926-7a606f322066", "comment": "Malware payload (Mirai)", "value": "cbdc68af77dfd0da9c3734f4a1b688973ecf9e0856ee6bd6b6bff505154389e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706839, "uuid": "97698fa1-a1cb-4e65-9cb4-cd5e9ffbcd0a", "comment": "Malware payload (Mirai)", "value": "a008ffaa35ffe5274245383d7d6d9a2aa1377829", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772706839, "uuid": "7de2bb5f-da68-499f-a28a-772575250b0d", "comment": "Malware payload (Mirai)", "value": "fcbd59bbc279e686dcde834c388ae8523460b0c668aed3c1df55c219bebbdd4b567f4fe106e2a97b3771a301a520330e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706839, "uuid": "7073539c-3cba-418a-93ec-6ff9fbda3c64", "value": "T189E34D8AF802DE7EFC0BE57E44670D15FA30A7613243172D529BFDA3AC321A65D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706839, "uuid": "70ff7e6b-8776-47c8-89d9-2ccd684c1013", "value": "3072:luWypdcGShA/TtPq6ND6ZJ243nxl9XzrTmdZH:gCGShArdDPAxl9TmdZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772706839, "uuid": "875e2933-d4ad-4517-a463-ab3f93eb4e7c", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772706839, "uuid": "dd62a148-259b-409a-80cd-70e5a5cce340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772706839, "uuid": "d59f09a1-7ad6-4c0e-bcda-a904db657ebe", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96c6995-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707657, "uuid": "8749a805-f75a-49c2-83a3-922efb18cfe7", "comment": "Malware payload (Mirai)", "value": "c04f70a58b9e43354913d14977200b65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707657, "uuid": "6094aef9-1aa8-46ce-8686-a33197d760a6", "comment": "Malware payload (Mirai)", "value": "cbfb426bdc02190375c4f8e0b5ea705a5761e294ee65bd1500a69578e6b57c85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707657, "uuid": "073a48d6-c481-4800-9e58-38477711b4e9", "comment": "Malware payload (Mirai)", "value": "ec69a9ac7a662f5a19e32f2cb615ad78a65cc91c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707657, "uuid": "63029697-6f0a-402c-a1f6-f6da21e417d6", "comment": "Malware payload (Mirai)", "value": "039e27d09d980c4acee26c21190d61f2208966cfdc0378af210bb27c97384f9628d5b216efce231a0b92989c86144c4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707657, "uuid": "701a26a7-b5ff-45af-8bfb-231182ff0d32", "value": "T1E8A34B85BC915A12C6C112B7FA2E018C372653ECD3EFB203EE216F25778A85B0D7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707657, "uuid": "ef6a699a-076d-4c00-904c-0957f6ac6398", "value": "3072:CYxl4SiTWo15HmexwEPaOQVRXokwbZnw:CY8TWoHmexwEPYRVwRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707657, "uuid": "65146faa-1f7d-4828-b40d-2257c2474f85", "value": 103796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707657, "uuid": "87941c7d-3410-4565-b63a-094b2d6a53bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707657, "uuid": "7715d4e0-894c-4ec6-9d95-83374ff62e3c", "value": "5r3fqt67ew531has4231.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4c3c9a-18b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772729136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729136, "uuid": "d39ff1fe-de39-4a39-a608-b86dc6ec52c6", "comment": "Malware payload (Mirai)", "value": "dfa8f37fc48a6368b8fe88f98e1b2bd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729136, "uuid": "5bc378a9-f9e9-456c-8e75-26a49337be64", "comment": "Malware payload (Mirai)", "value": "cd826c001fc29554c8b5b2f87d93664af925e69f8e2049d04521e4d395bd3a95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729136, "uuid": "4031082f-ed9c-4f33-9a0f-1d619d5d7eb8", "comment": "Malware payload (Mirai)", "value": "0ff5d603d6bf7bbd92d79de561af810d92d8be66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729136, "uuid": "63de4b66-341c-48ea-94b2-e1ad5023c7db", "comment": "Malware payload (Mirai)", "value": "0033813a9fd645ced43127c5cd47bb083a683baf538405b02cd76abe0649d5194e14c9e4d6fc4dbc042b7b2f0fae4fa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729136, "uuid": "7d20cdad-03bb-44a6-8203-452957924ffe", "value": "T1482329035491C0FDC955C230AB3FA636C922F47E123AB59D73E0BE227E4AE311F5A589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729136, "uuid": "5e5827bc-107d-4c38-ac1d-34747aaf5a32", "value": "768:FkrR8ysZAY+OGZZRw4xPwPtKOoOvHjKRDACGyjltp4B6gC:6d8y2+OOwykDckCGyp4B6gC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772729136, "uuid": "7354001e-3202-438d-aeeb-3f82f6a102d4", "value": 46400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772729136, "uuid": "5923cb5e-bc48-4b95-befb-399f1d687d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729136, "uuid": "9c0cc919-587f-4b09-b2dc-48360106a0f6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3586cc-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772698076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698076, "uuid": "f8a85fed-defb-4fbc-99ec-35221ee0c6ad", "comment": "Malware payload (PureLogsStealer)", "value": "7d65dea0d6f6b192f7cbb4d5d09451fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698076, "uuid": "90396a81-5d9f-4e86-a47b-82dba2671a08", "comment": "Malware payload (PureLogsStealer)", "value": "cf511ea64c451b82040476ec5409d27c0a4e97e5d0caabafc7f1f0e3141a40fe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698076, "uuid": "ea098dd7-8232-4f2c-a4f5-bf86488e9fd8", "comment": "Malware payload (PureLogsStealer)", "value": "3e0f755bed458f153d16b4bd3774c1d796151596", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698076, "uuid": "78b960ef-2fa3-4b3e-892d-c42c65400e5b", "comment": "Malware payload (PureLogsStealer)", "value": "7abd1d09d694e6fe468d3b9103ca8981db0515ebe62210af7019b1ac0efc250835c0dd84ae8471160d3d19250db54093", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698076, "uuid": "6979d951-e643-4fd7-a20f-d7e81e9b1831", "value": "T1B2B5AF41BBDF0FEC9614B63C24BBC08F3AD184857016F4A99A76B955FAF21C03B97948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698076, "uuid": "a48cbab6-1a8c-4fd0-a095-b9694cba310d", "value": "24576:U73IcotiHV7wkTFT5pL/5x5YNFxGj/8JvX:w4c1lwKTLLRx5QF1lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698076, "uuid": "80ed24a6-0465-48e2-a43b-c408684936df", "value": 2375819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698076, "uuid": "e7561624-0ce7-4af2-880a-9098091539a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698076, "uuid": "5169e30c-94b9-4008-b78e-bd50a84d2a06", "value": "7d65dea0d6f6b192f7cbb4d5d09451fe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e31a2ae-189c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772719637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719637, "uuid": "c23f1f14-a48b-4e56-a625-875b67e54f81", "comment": "Malware payload (Mirai)", "value": "be97db81ade8cd29966aa46fa797eedf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719637, "uuid": "162482a2-4b7a-4301-9bcf-5c6b236055f5", "comment": "Malware payload (Mirai)", "value": "d04e5afff4bdb40b44176c750b0b15c7c26440f31b7099006bcbba9e7132f959", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719637, "uuid": "99741eba-41aa-49d7-8798-0fdc501db50d", "comment": "Malware payload (Mirai)", "value": "2b7e3ec71b67b4f0d2bd9b27826a148d09901e9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719637, "uuid": "33b1c720-9e7e-4cef-87ee-a862792e6cd2", "comment": "Malware payload (Mirai)", "value": "3fec8cb2d5edfb9ddc98b854bcccf8e3fd74a6699064d9caf6f710f05611162c6dee9c0c5b802af90b6d9334a0b36ad7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719637, "uuid": "0b2b9e98-f4ed-4ef1-839e-9b98107c2593", "value": "T12431D74F036189B1CF6D48A5AB9B92959A0341935118CF0BF7DE56C8BFA4298F885BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719637, "uuid": "b1c2ab2f-66a8-4049-86a4-eafaccbe67d7", "value": "48:ceSLRCBMdQb9AAXNFDm+5+s+b+DpPwZDsw9szouUHwh:6LRvaDXNFK0HoWPwZsvzCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772719637, "uuid": "cb4df4d1-b0d9-4a10-b389-1ea8aa90cd0c", "value": 1669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772719637, "uuid": "5f42c8f2-cbd1-47f9-ae2b-3e7933d46d51", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719637, "uuid": "f19c279b-aa0c-4f7c-9b80-469e91577e74", "value": "bash.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f76808-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697858, "uuid": "3f7ec11f-d514-4443-acea-601ae77d388d", "comment": "Malware payload", "value": "6f54ecf5eb69fe38aabae6e3fe0d0016", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697858, "uuid": "ade15f69-54a0-4d39-b37b-23501da2c207", "comment": "Malware payload", "value": "d0e0658aa0acaafd8af44ab79c42cecfca4ffe003b004af8e18b62dd4b2e1b45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697858, "uuid": "cbcf598c-99e9-4b74-a701-52c55dedc64c", "comment": "Malware payload", "value": "24c2f98f4bb31a9d31b71a971d7f7c30df48ef36", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697858, "uuid": "32615c79-e9bd-42da-a84f-db729da13751", "comment": "Malware payload", "value": "04c46b12261bbbbf6aeb8c4d9c6092f15c318efb617e8bcfddd09d6a95ca737fef9c8bda2bb31eb7dd0a45c64b5974f0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697858, "uuid": "5fec7f70-dd8b-4a09-9b97-e9731a679f7c", "value": "T15092858E3FC3B0740221783B6D2FA59EF72FCC54708C8050DA659095FE68B49C9B5AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697858, "uuid": "aee3550e-e17b-43d8-968c-2efff4cb0904", "value": "384:yKng3OL/PYhI2a2qoBaupKwJPJ9RPqD0LGUAZtmS1sS1vOpQDg:fVL/P6qupBzPfM/V1Wpqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697858, "uuid": "d3e7643e-a842-4cf1-a1e6-35da49444478", "value": 20410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697858, "uuid": "3c7a3ce1-01ed-468f-92fc-6c5032491066", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697858, "uuid": "fdcaa2b8-f400-42d5-88c8-28d37ba39628", "value": "6f54ecf5eb69fe38aabae6e3fe0d0016.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05a0113-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703427, "uuid": "601cd2f9-fb1b-41b0-afca-0577360ea95e", "comment": "Malware payload", "value": "8928a2e8921e0eb4e68a09ac2ed71ddd", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703427, "uuid": "eb9d8ebb-59e4-4988-8a88-d73466304e02", "comment": "Malware payload", "value": "d29ad2d5c8c4beb689d640a5e0f4f05ee96d979e33e9e5486ec2793f649861ef", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703427, "uuid": "f2c3c6f5-5830-49b7-9ee8-cb90d596ce0d", "comment": "Malware payload", "value": "8049c9c5df593a7bfdee789ce4bf64df203d338c", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703427, "uuid": "7c40c554-4e03-48d8-a8a9-b18563c57207", "comment": "Malware payload", "value": "d8a865bb702ba1c45162d64e4a2ed7908022e687f6012b3e30400dd0b49b92e2cc8960a8e34c62d8107750ac16d115a7", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703427, "uuid": "e9a6c51b-c6ec-47ed-b7d9-504d3a2d65ff", "value": "T15BD423CEE71C9859C49BE7833CEE198613BAE527C80D78991F7DA0652B7D2E4400E71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703427, "uuid": "4ad8d0e9-3009-4031-8997-5f8d977fbe52", "value": "12288:3vZibFoHUj+XFQkEEWoMu3Ltvjiy2JSofDGzAZwx+j19ewtAn:3RYFXjQ+kEEWoMuljgQofDEKBftAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703427, "uuid": "83516835-9458-46bb-8659-f4aa636d849f", "value": 641920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703427, "uuid": "cc4ca5d3-a4da-49e2-a66e-89fd96641d69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703427, "uuid": "cd255645-cae4-42e6-899b-e1162925cde9", "value": "ow82023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d143c2ca-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703402, "uuid": "54c7c694-f993-489d-b640-f5edb66154d5", "comment": "Malware payload", "value": "be4e07611790888daeefeb1f37b6817c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703402, "uuid": "5a7cdf0c-cccd-45f1-ac07-2d31aab296c4", "comment": "Malware payload", "value": "d44144ffbe3f08ed159f7f977ec84b63f1895fc451c4d77ae09d3f8bf4b5821a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703402, "uuid": "b5aa1600-2fd3-4c9d-a11a-86b2de6cbca6", "comment": "Malware payload", "value": "ea4752f2e8c8ad2e55d168e66fcf81888e8cc3f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703402, "uuid": "f844de64-2b6b-4b3e-957a-537a34346cdc", "comment": "Malware payload", "value": "9f01519b0f0adedfc42553720ff85428907fbe233772058485230e4bb06dfd5e7ddce4af0cbbd7df5dd37d28c8d4fe29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703402, "uuid": "560287a3-6dca-46d8-bddf-476d7acbbb7c", "value": "T103462973A49154E4D2EED574C6256212BEE0389B273423CB7BD076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703402, "uuid": "63c7fe19-d957-4e43-afb8-efb32bc8bd59", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ5:cqYUQuVDt0TZE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703402, "uuid": "232eae51-29f8-49e1-8f9f-41030723a212", "value": 5472256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703402, "uuid": "b7d7ee7f-563a-464a-a61e-5ced26e4d023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703402, "uuid": "d5cea8f2-3942-47ef-89cb-8b453b128755", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c18ef1-18d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772744324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744324, "uuid": "19f761cb-8968-4007-8c76-63e1685dc3d1", "comment": "Malware payload", "value": "56a56ba41a1dc707c3b88a171f31b6d2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744324, "uuid": "274fbf70-f2ab-4209-9921-ff35b0f22752", "comment": "Malware payload", "value": "d46341184c3146579a39ce6e4438b6236addd1343d32815de8053587c2b4327f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744324, "uuid": "237c1968-998c-4100-9560-e3e29b3f6e4f", "comment": "Malware payload", "value": "41ba9f980f58632866d15e418155a2b34222f428", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744324, "uuid": "ee997faa-c0af-498e-9645-23728a58009e", "comment": "Malware payload", "value": "ab569185d3700be0a5148edc5a20092651e04bc3f46262f094f66281b66237f9e6c45768f766c64e0bc153ef2b4f7dc6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744324, "uuid": "36dd9f13-9534-48f7-9fd4-a504a27b7ddc", "value": "T18A41FC58BADB8332E233873398BA9310D5323C52AE424F6F11854B5D3033000BA66F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744324, "uuid": "380a3881-c941-4a70-9149-a7b4d17deeb2", "value": "24:8qtnF//ZEHXe/+GuHnF4sb+IMs416xoyDAK1G/Bbcav/MRrtDd/5:8sJZwXfGuHnJbfMT1coyDAK1oBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772744324, "uuid": "91bfa895-3df8-4e73-8e5e-d5011d4b8715", "value": 2166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772744324, "uuid": "87bf52b3-2f97-46f1-9efd-e9020855ec50", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744324, "uuid": "f679b279-4e1b-4167-99b9-7128188be6ae", "value": "Letter Request for the Technical Support of ISAFP.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a39a82c-1881-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707900, "uuid": "e095d024-1d5f-4d8b-b2f8-d64587404a06", "comment": "Malware payload", "value": "154d100deda38187fc51b070ed097479", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707900, "uuid": "17cf9888-eb4e-4c25-98a4-90ccb330b9ed", "comment": "Malware payload", "value": "d481f5d2530923c830e354d8d356535f4006ec55f810141ff3e4f1ee4d2178b1", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707900, "uuid": "46ebc7fd-b023-46bb-9e8e-b7e489dc92f0", "comment": "Malware payload", "value": "a597e9bee3a0c36d6cb1aa69febe9e5b76cddb17", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707900, "uuid": "9d4f09dd-b63c-44cc-b55b-4f30498983ac", "comment": "Malware payload", "value": "90981e61537ec9d2257e96c0a179bbfddda7a75bfba4b724e5788d8e6dc7c6178088f990971e1e915ac37134289307fb", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707900, "uuid": "7d5c4bda-3d5d-4379-b6a5-78b24711f2ea", "value": "T189D393903E13A04ED03B9F4F29F17C59E91E790B6AD0495F319FC69B9FF610A9C90868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707900, "uuid": "50e237d1-5b1a-4dc0-a687-e69c635719b0", "value": "1536:N2WJmKJ2XFW8/fpPtwYiYmVr/clUgOEhB2:NHmH4rUNT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707900, "uuid": "b7b20d3a-e84f-45bc-a8a7-d0b3b5927253", "value": 136711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707900, "uuid": "b52d57d5-63f3-4e24-bde8-ef07cb8c8497", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707900, "uuid": "c67647cc-e32f-4597-97ae-6bbfbaa5f0b0", "value": "9242_exploit1.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d21cf9-187f-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772707300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707300, "uuid": "2c66057d-10f0-48a4-8cc1-792139271cca", "comment": "Malware payload (SantaStealer)", "value": "0c93f82dd0359303ce939686da6bb9e2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707300, "uuid": "43d3006a-a4b3-4f71-b55a-d3aee8fa07c8", "comment": "Malware payload (SantaStealer)", "value": "d4a5690af6a171d3cd494f5767304d90bf9f5430aaef5a89a5fc4b346b525b2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707300, "uuid": "be12a7a1-5c8c-4243-8b60-93266f8e81cd", "comment": "Malware payload (SantaStealer)", "value": "a73ac781d4a3ce4ab9ad2f6977416fa23cc06cda", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707300, "uuid": "e82d76fc-3a56-46cc-9897-0799fb92a38b", "comment": "Malware payload (SantaStealer)", "value": "f327c4ba51abf86b6eca74dafc7844e314c723b82715a6148f141b2d72a3a49a3c9f6838473ab7b027dc078f47946c8b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707300, "uuid": "88447df9-54aa-44c4-bdaa-287c801c2cc7", "value": "T13BA7335D3BA14664F6334D72AE150E86A777AC31CF08B396D4E46D0E066D6FE202BBC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707300, "uuid": "38c1b34f-9026-40f1-b502-07f4bc469631", "value": "b20c0f31d098a9d3adb91b263a9160c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707300, "uuid": "591d2584-3062-4be6-b7c4-e954b16923eb", "value": "98304:vYfLZvoTUbO41P3QUfuXHKbp8q5CUfIQ:yZvoAbn1hfuoCUfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707300, "uuid": "79bfd177-e1b9-4833-9b79-c3674ed35f61", "value": 45794304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707300, "uuid": "a16a6ddf-3173-48c8-b9da-dc42940cf846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707300, "uuid": "675fa96b-5625-44f5-ab2d-24f5fa337bf8", "value": "active_desktop_render_x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763d4497-1871-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772701101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701101, "uuid": "b45f5964-db64-4073-940f-2500a30f67ca", "comment": "Malware payload", "value": "a05eba255073fe48262c211c9129a8c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701101, "uuid": "09ba3aab-fbd1-49aa-9d9e-8535eb2ab403", "comment": "Malware payload", "value": "d5166697974c4e38f441abeea64af65aa12f3e6ceb7f3062ac04305e73544ec5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701101, "uuid": "2ff6d1c4-12fa-416d-aa2a-6d0fda1ebcff", "comment": "Malware payload", "value": "6f21082f29ed8682382d01d89fb62f960adab4a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701101, "uuid": "4c81c911-cc22-48c6-940f-34399b047ab6", "comment": "Malware payload", "value": "06cafe179342adbd751ba75a1088c105d6347bbc49c4b1ea4d8691caed2d14be1d7483496ad353350ff00d21551ea231", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701101, "uuid": "1bcb82fd-359c-4073-8e32-91419396681b", "value": "T19BC35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701101, "uuid": "04f0fed9-d3e0-412d-90fc-b0817400fc29", "value": "1536:UlAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3Y:UWFmSmviqS1Bs0+Nd6lAqktNMxSNbmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772701101, "uuid": "beaf9041-c2b7-455d-9965-091e323726f9", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772701101, "uuid": "37020b98-bc08-4d2f-9394-aecffc065de3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701101, "uuid": "461c09d9-d47c-4776-911a-10d98b566596", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf764883-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772695238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695238, "uuid": "430f08e5-9a44-4431-9f2e-62d08fff3fa6", "comment": "Malware payload (Mirai)", "value": "3e39a75ca2a02f30aede5e3341a7a0a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695238, "uuid": "4e849519-f8c2-43f5-81d2-2f80f11e8628", "comment": "Malware payload (Mirai)", "value": "d5a4845a3be9fb7dd2eea81a1a0e0fc12f75dc2887bb079ba3e61c1b9eb734e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695238, "uuid": "4ca700a5-82e1-410a-a948-3b1ceba0d314", "comment": "Malware payload (Mirai)", "value": "316e8e5296e2f809625bf001ee9e8476ba82ba4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695238, "uuid": "26e1afb6-31d4-402b-b1a0-8a6dd653694d", "comment": "Malware payload (Mirai)", "value": "cb99bf203acffff6095eeb9883c24ca456b203177b39e8b2f37ae8783fd50cd3490961ba87a06f7167cbda7fb60f36a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695238, "uuid": "7e2107c7-ce47-4dfe-b30e-45ad32058858", "value": "T123443B45EB404E13C4D627B9F6AF42463333E76493EB730699246FB4378779E4E62602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695238, "uuid": "c22ea8e4-b53d-4b1a-939d-175855e5d030", "value": "6144:Vn9FmUqdq0hwsa7krI2O9BsE7Q8lUvEM/V/G+X3:V9FmUqfhwsa7krI2O9B0+i/hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695238, "uuid": "a62afa06-764c-4591-8788-8731fbc416d6", "value": 261670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695238, "uuid": "d257e06f-d367-4f94-a8e1-deb6a0058ce4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695238, "uuid": "5ad3b04c-3a05-4af3-b9f8-fee0455f5977", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989e8825-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772697723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697723, "uuid": "a3ad4953-de29-43a2-979d-6e76a9611f24", "comment": "Malware payload (MassLogger)", "value": "eaa34ad9521cf35142f72cfdf2d78368", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697723, "uuid": "b929979a-6ef9-4d6b-aa60-f137d75c50e9", "comment": "Malware payload (MassLogger)", "value": "d5e9e5b91a6ed76c8cff1091e6fc0a46750d39cb1c49716b84e7a9e4b29b9d2e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697723, "uuid": "1567c4fa-fb22-47b1-961c-b445ff5de023", "comment": "Malware payload (MassLogger)", "value": "b1844f04bd9320c0726fdc4f679763ea35c7756c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697723, "uuid": "0205a4eb-4e1b-478a-97e9-3f3a33a95c50", "comment": "Malware payload (MassLogger)", "value": "9b9a21829907809d89043cb04a579b44e388147e919c440086fdf69296b2d79ba3d34b15b317dfc651aa77efd80ed0c5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697723, "uuid": "55b07470-3cdb-425d-bd9b-cc99c5f92990", "value": "T1B6659E9427D87B8B2ABE582CC5E8552B06E05FA44E0B7D9506BBB7331BA33CDD4160F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697723, "uuid": "b3708022-e276-4b5d-b825-45d92fe16a49", "value": "24576:NJ0se1XbwTf71hwjBk5OVMM5CwenO25kfub6pHWfqFEDeWjArOmxViQs7NB5GJPm:/8idi25vutFSJSWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697723, "uuid": "a139bc5c-6f29-4f7a-9d36-57e1b2b639e3", "value": 1534698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697723, "uuid": "542c2be5-22e9-4f47-90e7-d1e050777814", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697723, "uuid": "1a9beda8-31d8-4cbd-9fe5-801e84a548e5", "value": "eaa34ad9521cf35142f72cfdf2d78368.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc2f244-189b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772719049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719049, "uuid": "c2755174-dd5a-40ff-8ea6-e0f8465a4267", "comment": "Malware payload", "value": "7cda716f787887334fc7bb770ae1f6f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719049, "uuid": "2ec75b33-0e62-495a-a268-7d287dcfc059", "comment": "Malware payload", "value": "d620a88c923a7d17d7a47fcf3bf017f5357c00dc0a52d19e8dbdc2acafcef326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719049, "uuid": "56e61882-3e3b-44d8-880e-aedf5bfaaa0d", "comment": "Malware payload", "value": "08cd04cefd013b23a729adb62fd9951876591486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772719049, "uuid": "fbb3107e-cd98-4457-a624-277d29301f9b", "comment": "Malware payload", "value": "4d783ec10bfed26afdd0d37ac5f9d2e5775c4ed2474d82d51a3ef1178b948fd1501a5498b2e3b7aa6bec7215680da0f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719049, "uuid": "829703b5-7924-4234-b7f7-1dca59ff8574", "value": "T1BCF533BB890D6DA4ECC98229931936D4E1406E312FCF9C54EE61F4E6DFF94E44B0B249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719049, "uuid": "f40402f0-64a1-4f6d-b4a8-27777a4006f0", "value": "98304:4XGwA5HqSqnvZC8tNzB9NeOFIPrwVQZQDhhQQb1J7:F/QB1ZfcS0wVIQDhh7P7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772719049, "uuid": "85f10eac-6984-489a-b691-7b88b3744202", "value": 3614172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772719049, "uuid": "1afe1e28-b028-4656-bd16-4735d65dc03e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772719049, "uuid": "40c8b41e-eb07-44e8-aade-cb23c02bb5a9", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3c12b2-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703447, "uuid": "9caa76dd-240d-4175-9b1b-923b91539430", "comment": "Malware payload", "value": "a6a0777570e673784c2bae7125c718f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703447, "uuid": "eef7bb88-fe57-4dc3-9723-43e9dc339673", "comment": "Malware payload", "value": "d7f98e379c400c13340781ccb65017c000330824ea26680866b9d3e43d641721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703447, "uuid": "f2c3ed3d-e577-4ac0-9ef1-6a4118e95206", "comment": "Malware payload", "value": "84e5464ac844ae8d09b0f93c7590ef6eee655a1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703447, "uuid": "ff2bf78a-94e0-4611-a0d6-0934b16ddbea", "comment": "Malware payload", "value": "fb3b950a74fc1f12817dd61c3bc23b0b0caa19862276abef65e7d09abc44dda5b3f6de75aef7de5fc041862b40e129a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703447, "uuid": "f614045c-662e-4c36-9483-db60d7db0150", "value": "T17453F84BA9A451E4D4EEE135C627A206BEB170985B3427E76F5282F00F52FFC5A7C318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703447, "uuid": "a1ee0445-c09f-46c8-9e2c-8be25af244b5", "value": "768:rEHx3z4gntbMMS+4Trsrr93usVnTK7rqi/9Y8p5vhnw96cK:wHxDV+MB4TgvZu8TI2WwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703447, "uuid": "af9a41e4-1140-478e-aa05-dd37d8d6d5d1", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703447, "uuid": "231a6c80-e709-4993-80f2-5060e5ce46a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703447, "uuid": "9c2a6166-a73f-43f3-bb5a-74a979b771ce", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c9f4ca-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703411, "uuid": "7101e59f-4eaf-4bbe-b760-7d01d2847b67", "comment": "Malware payload", "value": "9c30b32188b2b4d425e8378dabfabf40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703411, "uuid": "5917fc4b-9fd8-4a3d-800c-212a45265b56", "comment": "Malware payload", "value": "d9108451196c9022972a0b4735a453c3af83888451302fb465754b9c1662fedf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703411, "uuid": "85b507cf-cf04-43a4-b710-ed8601d6066b", "comment": "Malware payload", "value": "6c12c6bfe2dd6e74c9875ec26afed0a2669092b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703411, "uuid": "d80318a9-5afb-4cc6-893a-74c91d14b62c", "comment": "Malware payload", "value": "25cc9dd5f7520659060de68815a6f1e3bbd96cb734c8a3288fb370e855173e87ce8e174fc148ddea850251ac6736f4b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703411, "uuid": "9f8eb1d5-0593-4dfc-ae4f-92e3dc1c6a12", "value": "T1FC07AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703411, "uuid": "83b0a5e2-ff71-443e-9894-bc09db20184b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQf:cqYUQuVDt0TZEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703411, "uuid": "c882dcfa-b531-4a3f-adac-6d59664c1e95", "value": 18120704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703411, "uuid": "65286973-4583-44a6-afdd-197d01ee348b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703411, "uuid": "0a57c4e7-b9f0-48bf-9132-6af29a0608e6", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69583d84-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772698073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698073, "uuid": "436fdd68-e852-4671-9314-7d418854bfad", "comment": "Malware payload (VIPKeylogger)", "value": "fe5773e1f721d0c1a2f5c8abbcb0025b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698073, "uuid": "f9eb42db-aa29-42af-944e-98e5ea0e2d65", "comment": "Malware payload (VIPKeylogger)", "value": "d997b53d45040a7c1e6ba3cbd6625a2f4bfde5fab933300b1259f8723c89eb61", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698073, "uuid": "3dc6aee0-be5b-4a20-adb5-0085ad8702ee", "comment": "Malware payload (VIPKeylogger)", "value": "b01e7673f163859d303a9df760a544d05d61cf64", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698073, "uuid": "1140a14e-e6c1-48a2-98f3-76b0b9156137", "comment": "Malware payload (VIPKeylogger)", "value": "f30c7e115e4312ad7eef86ce7edfa8ac24f970c817f41de185db49fb90d76cb2de7275453b8a7bba25d56b42836fc118", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698073, "uuid": "e1945282-ce0f-427b-abe3-5a35137b6b53", "value": "T1A0A230CE3AC6F17C02C734763B7FB43AF57F8E542888A054C2567588E865B18D67EA18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698073, "uuid": "3c548deb-6f92-446c-9f02-e0d56257d7ce", "value": "384:x3OH7zxpG0DEvp8wHIL3vZ+K8acKzxcY3Uztd3kmY7k98Ovum:x+H7zxF4oLBqacskztZW7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698073, "uuid": "8870f1fa-ef91-47ea-9a7e-a8dd259afedb", "value": 21292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698073, "uuid": "92dc7112-aa96-4c89-bd3c-159d3d10d037", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698073, "uuid": "f8134850-22ce-4ddb-84e5-9d7932d5b1f1", "value": "fe5773e1f721d0c1a2f5c8abbcb0025b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418a6d7b-18c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772737520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737520, "uuid": "006fb9ed-e735-403c-bf37-0e1bb4032842", "comment": "Malware payload", "value": "9789b0d7f8aec45c8a17f78176bd3a02", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737520, "uuid": "e2a61b1e-2ba2-4d37-9982-a743f3a046d9", "comment": "Malware payload", "value": "d9d30d39e500fe31054ac222142c0dc2343552ebe709297e085af5e4a4e09e28", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737520, "uuid": "f842bf79-db36-4547-8e39-8cef44a34821", "comment": "Malware payload", "value": "8fd4c20c1d952f2e1086cb402ec03176c316ce6c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772737520, "uuid": "ce944868-6965-45cd-8794-7e89b14b17c1", "comment": "Malware payload", "value": "7e052cd0cf9cadbbc5f93bff627b50d03ffa8117bd5725c2f4191f1a3d5b18f15f1a6ccba96f0f7dd3d3f5c7dc60cacd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737520, "uuid": "08e1e814-4973-4dfd-80dd-6e9aec4fa19c", "value": "T1DB150103EB92BDFFE4471735198B0846913B6CA3321E8B5B1F82725A69723E6F15721C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737520, "uuid": "2cb466bb-10b3-4352-9e9d-8f2336fcf1ef", "value": "12288:hEo4Yw3GhW+zxfNNo7gZGtkhEo4Yw3GhW+zxfNNo7gZGtk3JuYnrCrDkbpZRU+ia:h5wCfmg/5wCfmgZnUDkbbbbqvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772737520, "uuid": "5856f490-29f8-4aea-9c49-aa927f1e2432", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772737520, "uuid": "7dd19cfa-7572-4efe-9f9c-faf795491933", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772737520, "uuid": "d66ce45d-d373-4eae-af60-406115e80611", "value": "9789b0d7f8aec45c8a17f78176bd3a02.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baba6e0e-18b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772729134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729134, "uuid": "682fcb08-c5f5-4f66-a94f-4423a14bb846", "comment": "Malware payload (Mirai)", "value": "6755111e8c8bca33ee3ab25bd54fe432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729134, "uuid": "4c7c0646-212d-40d5-b866-469a6e4f5ffa", "comment": "Malware payload (Mirai)", "value": "d9ea7f42978fe27e7065dfdd82ea67eb38993de1d94cba017e5501a12c9544c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729134, "uuid": "d2d79182-4784-4ee1-a5f4-0fe2406d2f90", "comment": "Malware payload (Mirai)", "value": "2ebdc475fe5c637b4374701df9da27ec5ea745ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729134, "uuid": "4c345ad3-e931-4203-8ac9-18f563e71440", "comment": "Malware payload (Mirai)", "value": "c2073927ea42b2a1f2c50e18996f975cee67af760c2179e8969ab005c26e43b7e8825c1f870c665c19b24def17ff5a05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729134, "uuid": "48cbbf88-e80b-47aa-82bc-9e58a6af57d1", "value": "T117133A92B400AD7DF85EE73EC093090AF131A79551821A3763A3FD776C322A85E76E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729134, "uuid": "712f6693-cbd9-4474-80b3-760ba8774a98", "value": "768:0xqFTD4t0MoBjFJWEw0Cmk+3oN6WluD811JtTRHGtHwl5bsW71:COaWVvWLHVz6WkD811bRHGtwlXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772729134, "uuid": "ef5ee615-e325-4987-8036-8b76f0d9ba6d", "value": 45516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772729134, "uuid": "81c0ab1f-aab6-4bd9-bb36-81ec7ab85291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729134, "uuid": "6867b566-b429-4516-aa7f-f79b0bc90c98", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1353bca4-183b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772677743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677743, "uuid": "c846fb1c-62b6-4310-9ea1-f479b955602e", "comment": "Malware payload (Mirai)", "value": "d40e6a14922997b41d64d0fbd36706fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677743, "uuid": "c38545df-2710-48a7-9b9b-8f5a3416f263", "comment": "Malware payload (Mirai)", "value": "da3b8a8e81d129e5034717ede8dc1b88197e2ee6fffb6fdc6833b032867d81d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677743, "uuid": "9a32700c-a9d9-4cd9-a325-fb47a3413347", "comment": "Malware payload (Mirai)", "value": "83cf8856434bd8d670968f85eb0c78c4960820cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772677743, "uuid": "8b5d4ad3-8461-4e0c-802f-dc18fc5acbff", "comment": "Malware payload (Mirai)", "value": "ce961f282f5fec636a2b346d7419436e5235b12e5f5ed1fbba4bf721a4381c8d43bd003892f659d0e846e5ed46791acf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677743, "uuid": "63f21981-0e67-4aae-b80a-65c4400c51ad", "value": "T1CD044B46FB818A13C4C62775FA9F42453323DB6493EB33069928ABB43F8775E4E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677743, "uuid": "93fb1d45-7bc7-419a-821f-09e0d347f6d9", "value": "3072:02pSrW59DKOy+aI6kOCbXdUUHITW3BrJqSeSL/Kru8S:LAWbry+aI6kOCjdPIa3BrJqSlL/Kru8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772677743, "uuid": "ac924ac7-04b0-4ead-a87d-64a6f4224f7c", "value": 179733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772677743, "uuid": "306f4806-ce44-4ddb-aa9c-5a115430a557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772677743, "uuid": "3ae9b2b9-62e0-4a8f-baf0-e9aa04f5e780", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbd3cff-1873-11f1-a769-42010a9c0008", "comment": "Malware payload (Loki)", "timestamp": 1772702106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702106, "uuid": "e056579e-8372-413a-b328-f00f7b81dac9", "comment": "Malware payload (Loki)", "value": "2baadcc2aa81fe758d4cff4b2ba27f1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702106, "uuid": "64e60ff8-8104-4aed-9fd9-aacdd2f3a94b", "comment": "Malware payload (Loki)", "value": "dadf297d60f465883336bd72b69fafbaba821fa0cc580d802b7f50e94c08793e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702106, "uuid": "5b363055-dc2e-4876-9d38-94dd158ee9e8", "comment": "Malware payload (Loki)", "value": "37fb5abfcca07791b29b1426a80956f1867fa0d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772702106, "uuid": "a9bd734e-144d-4746-a9b3-e90c7624f59e", "comment": "Malware payload (Loki)", "value": "1048ccd2cbd560e604b069ce54163b8a9c36c0c41b4016a2396b2d8b46b39e9efd2757643064c0add85c648fac741bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702106, "uuid": "ef87d7ce-17eb-4dda-b19f-d0e158e23d94", "value": "T112059E62E1907F33C1732A789D7B87A4A927FE112D286E862BF51C0C6F7975038291D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702106, "uuid": "fac22f57-fb4d-41e0-8313-656c56d2727c", "value": "c6ba065d6d32afe1953b9bd4df4709f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702106, "uuid": "4fa2417d-7d8e-4ec8-8ef2-ec1f24f65fb5", "value": "12288:C+oDbw5LoID8qBItX1qYsBQtNwwg03FS250p+6JpeOPcEwvq9:P2KGqBItFOBWi0VmGOkEwC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772702106, "uuid": "aec19764-731e-4972-b5fa-4299a171fc08", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772702106, "uuid": "41d5afd0-5218-4a7d-809a-df7032ffc690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772702106, "uuid": "c11e1505-0282-48f5-8f42-158b8126cddf", "value": "2BAADCC2AA81FE758D4CFF4B2BA27F1E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d170abb-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772697919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697919, "uuid": "e5e8b440-784e-4bad-a9c3-02f5462f6b52", "comment": "Malware payload (AgentTesla)", "value": "440b3a353ca298adaebf5afcada3d91b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697919, "uuid": "7bfe9893-abc9-4c52-904a-15ee24a4b628", "comment": "Malware payload (AgentTesla)", "value": "dae6dbc04d1c0cba5999569b881b2975aea043744cfc418df9dd0f508c322423", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697919, "uuid": "74ece605-0158-4018-83d3-519634d36265", "comment": "Malware payload (AgentTesla)", "value": "244b86c0c79d0032379a5151d36e1226caad5d43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697919, "uuid": "2f885381-838b-455f-9a81-502ca95b932b", "comment": "Malware payload (AgentTesla)", "value": "2e5658c474e679b7cf8b0fb3b9b148588a5fbdd02a5e951019a6c5b1a57aa520e36978c389f7640b8e4aaf0c28e4c039", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697919, "uuid": "fe3050fb-08c5-4caf-938a-24de09d12864", "value": "T176659D6631E078F51FF1AA3896567429E76283C8249A364CFFA3F1C260E7505FD03A5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697919, "uuid": "6195c0ce-b70b-4ce3-916a-a118c313243e", "value": "12288:ib7NBiUcyF51XQRgIxN0quLQfVkcGO2MwGs/DK0XDL7ZsDk/wlCXn3HKcIOc7h5q:I7NB7cBO/53ZjGCXn3H0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697919, "uuid": "ddc415ba-094f-4301-8ce6-7dfa41c300d3", "value": 1466875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697919, "uuid": "954806ec-703c-4f89-baf2-b9238ce0b58d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697919, "uuid": "9f8045af-2261-4159-8a39-4b55834235cd", "value": "440b3a353ca298adaebf5afcada3d91b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37ed042-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697822, "uuid": "64520e9a-0078-4297-bb74-cedfaf1005a8", "comment": "Malware payload (PhantomStealer)", "value": "6577b84fb7f5642ac49e611890d27dc8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697822, "uuid": "8b97f615-6020-4d7b-9537-9f1577b43c1f", "comment": "Malware payload (PhantomStealer)", "value": "dbf081aee36516b3efc4665f40e9d82689b4ec758fb7a099c205ba48a212219c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697822, "uuid": "1b764533-4c02-4689-aebf-8213f4263391", "comment": "Malware payload (PhantomStealer)", "value": "fc2f63ca0e3ae63fc071fe271636706d3c0dbaa7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697822, "uuid": "31de8293-7402-4484-9a45-2c5580ab7e43", "comment": "Malware payload (PhantomStealer)", "value": "39d063945bb0809fad60928b6cab356bfe2f97976e10780770946ababead8c2e912cf11e249f2f80a2628bc10bdac867", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697822, "uuid": "4c92b9d5-7428-4e66-be68-dce8d9a62dba", "value": "T19726AF5176C1DB71FBA5AB1CE0BA36098FB1DC6F95DAF4196D20B8852A437A0D00DCCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697822, "uuid": "8e48549d-9061-42bb-aa0f-40867a596a70", "value": "24576:BsOUjIlRe6Xhif4Pz06MsnjVW22Ma46h6jviBBA+ZaNHCDkaQHm4BRA5ZBMvW9nN:cjwECuiw576N8l0t1c0LY4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697822, "uuid": "01c70e4e-7f71-4731-bd1c-f973c8d88dba", "value": 4660677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697822, "uuid": "e95bf4fc-ccc1-4deb-b631-cc00697410da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697822, "uuid": "f01b589a-cab1-4f83-92ef-84901f78ba29", "value": "6577b84fb7f5642ac49e611890d27dc8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023096f6-18a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772721093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772721093, "uuid": "4dc2bb95-96ce-41b9-8cca-ae4ee9ef2f12", "comment": "Malware payload (Vidar)", "value": "688bce1978e00be2ef2be0f2743f23d1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772721093, "uuid": "c7882702-1af7-4d05-a996-511fbef6c8ad", "comment": "Malware payload (Vidar)", "value": "dd15ccfb326fddca525059afbd76772cbfd40304f9e38e9a9ad8cafa2f92199b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772721093, "uuid": "378e06e3-88f2-477b-b731-5fa8a2e1f8d7", "comment": "Malware payload (Vidar)", "value": "0ef0b175015fa2b20c9e5b2121b155386ff28d0c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772721093, "uuid": "ca78ff39-895d-4ce2-8e16-ed7f0343da69", "comment": "Malware payload (Vidar)", "value": "f5a681f053c39173d384967830c0b8ee3adaebbb8ecb516488764373e76eac1e9aaf085eb53c043ce1e82cb007fff2c4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772721093, "uuid": "93e14013-6488-4f96-a535-30a15cf8d581", "value": "T1C0D6176B66718568C1DD81FAC0A28B07ECF370BB0736CEE7C69003686E565D5CE7E624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772721093, "uuid": "fc50a68b-d4f7-4009-bd60-4014e150c404", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772721093, "uuid": "5a1ebfad-fafc-4568-8a0e-3a1462317d64", "value": "49152:1tD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUW:WxGLEUp9VDFtQdOTArK0EqgdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772721093, "uuid": "d6ac1b07-2da4-4a3d-a13f-64b88662e9cf", "value": 13827072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772721093, "uuid": "8516a325-07ad-4b67-a9aa-3a8ce90198dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772721093, "uuid": "537e4a12-a677-409b-8bc0-04685258677e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bec92dd-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1772697997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697997, "uuid": "9a61dcbd-aaba-4461-8a3d-bf0b9347635d", "comment": "Malware payload (STRRAT)", "value": "4709ef4d1efd285a5add4c0276d87d4a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697997, "uuid": "1a4eec3b-4908-4cf0-8124-caf263acb912", "comment": "Malware payload (STRRAT)", "value": "dd87e87dc9c929c02982d9fbb0d9154364f30cde395e1f348eb8e5887d8e9646", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697997, "uuid": "54303dbf-44c1-4649-9315-4ba83a707bfa", "comment": "Malware payload (STRRAT)", "value": "abd69f9195bf8770aa26112d8fa88b278989ec76", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697997, "uuid": "b877813c-2c5d-4af7-868c-735282401304", "comment": "Malware payload (STRRAT)", "value": "2c33d90887f333ee171c574268e8c76d0615674c73de050c50572401a0b434da3680817fbe27aaabe949681244174c6c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697997, "uuid": "f0e1cdbe-a782-4761-adb7-889f70c5bc13", "value": "T1240412769DB4F628444A281634D3C3646BC04E11F84ACE7DF2C6B89B18B165F6C27EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697997, "uuid": "0dd436da-ef3a-4646-9639-5951dfa648d0", "value": "3072:OJEYSjcIzsVRYl6sHNnCGZWaa9j5a/Dbf04VWYQDdRXrWEYY69tNj2kJMJ0r8+gA:lcIbQsRZWDtGf/SRRNYbHdMmr8k1MQOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697997, "uuid": "de62af5c-a529-4c0f-b888-cce18e6d54c5", "value": 189917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697997, "uuid": "c208b9f5-7f7e-4e42-8b4b-824a4ff2196d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697997, "uuid": "3204cd52-4a3a-4c52-b491-b9bb470d37ed", "value": "4709ef4d1efd285a5add4c0276d87d4a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08d2ffe-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703454, "uuid": "3b9d4739-3ec1-4b98-9bb6-2fa119d80919", "comment": "Malware payload", "value": "a30740893a0156b4975b459d05b6c502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703454, "uuid": "01384979-6459-4c28-bd8b-b124768a70e3", "comment": "Malware payload", "value": "dd8c9ddcb52e2c733b37a4eec2e00fb39e8ccea196a6550d298621b85d3bb2e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703454, "uuid": "044c55bf-5cc2-4646-a442-f4e35a104226", "comment": "Malware payload", "value": "90713d4db874b6a03b2982745e07ca47b331f680", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703454, "uuid": "aab66c8f-274e-4b32-bce2-351f25195ca5", "comment": "Malware payload", "value": "50833b9a2d66aacf31dcdeaee9cdcce3a311c50c637dc8d21466fd085399d423ba08910d4d53dfe28b4329810ddb37ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703454, "uuid": "e4c19b25-6874-4f3e-8b13-a0bb95f90d23", "value": "T13CB5F857F49590E4C0EEE174C726A213BEA13499073437E36FA19AF11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703454, "uuid": "e94b982c-52d9-41ed-b94d-50d85d8103a0", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyE:cqYUQuVDt0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703454, "uuid": "08e55e30-0a13-4261-b02b-0ed9e08bc7aa", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703454, "uuid": "c0422cb4-6ef9-4a41-9506-248cee9a0d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703454, "uuid": "24cb81a8-9450-449c-b59d-d723ebb644dd", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fbbfdd-18aa-11f1-a769-42010a9c0008", "comment": "Malware payload (MythStealer)", "timestamp": 1772725718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725718, "uuid": "fb389fff-edde-438c-88ee-2259640a558f", "comment": "Malware payload (MythStealer)", "value": "85187d040a4236df6d25bd2c1fcd627a", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725718, "uuid": "ba2b978f-5718-4c73-8a4f-3654d58da62e", "comment": "Malware payload (MythStealer)", "value": "df1a763ffa0ff40e18d51cf698b86c230f7a746a9a6193532607b8374c64636c", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725718, "uuid": "d5fadfb2-c22f-4cc9-bdc9-9a239cffd30c", "comment": "Malware payload (MythStealer)", "value": "e4c0bcb88b378941509d78a321d8ab9559726788", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772725718, "uuid": "6b7a03fe-1d11-4fb5-b106-c46bc6c6193b", "comment": "Malware payload (MythStealer)", "value": "26d8840e8b8707721dd9a4a04fab90712842127af812efc5763688692a088dfd54ea770af9df3421b1eefccf6472bc9a", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772725718, "uuid": "7dd0016d-bd67-4e5a-bb73-d51844dea417", "value": "T13EF7338046CBB68D182A244A18EDA856019F8CEF9C6D6E387131FBEC84D6DCF941DF75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772725718, "uuid": "3e9afc98-bf9c-4e49-a7f2-c22742fe5b36", "value": "1572864:asn7RXOUCowuSoPCwFhu0jb2Buf3jvM3U+CKOjgAmX1nj/Ahuzd2tFhEsC:asn7RXOL9As0P2Bk3jvgeKAInjI4zd2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772725718, "uuid": "72dd1480-b64f-461a-bd9e-ca19cacd8fef", "value": 76794917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772725718, "uuid": "0853eafc-ff12-4f61-8430-659e01f6511a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772725718, "uuid": "a6e446fc-023b-48f5-8ef1-835a7e880da7", "value": "Loader.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19878a94-187c-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772705670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705670, "uuid": "bba16d8f-5d6e-4a38-95e7-dd68c24499b3", "comment": "Malware payload (Stealc)", "value": "07523efd09c23e5ac85be6587dc91676", "object_relation": "md5", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705670, "uuid": "9d441493-0a24-4bf9-af7f-77addc3ba501", "comment": "Malware payload (Stealc)", "value": "df5b323bb253bc882cadb9c009e4498f6ff5d1b1577a4e861337f153077003ff", "object_relation": "sha256", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705670, "uuid": "5d08bae1-3cec-437c-b405-1f1a6474dbbb", "comment": "Malware payload (Stealc)", "value": "7afe056974886cab5cccff2069d95dda9cc79681", "object_relation": "sha1", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705670, "uuid": "b6d9dae4-2f22-44f9-b5d7-d60e093fb2f3", "comment": "Malware payload (Stealc)", "value": "2ff08ce732094c3bfbe30b6957953df63dce4094c44422ad264d48b7fef18fc3da8908d4e79fba42db1c9acc1e1fc8be", "object_relation": "sha3-384", "Tag": [ { "name": "blankeyeo-com", "colour": "#071FEA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705670, "uuid": "dfbdd546-20ed-43c9-b106-55203c09baff", "value": "T17C245D747E426EFB5BBC608248C6810C5A386175DA192DE57ACF0C922F0D77A2BF7970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705670, "uuid": "6945185d-8a53-4f76-b2ed-1972ac36dd76", "value": "6144:jAovrS30RJ9oF01DAn1qlc9p/gZNUTh6t2:jA2rS09AnPTww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705670, "uuid": "d49d12ec-2d16-48f8-b8e9-2caeecb04437", "value": 217842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705670, "uuid": "cf428e7e-d3ba-46ae-90d4-da76248c3171", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705670, "uuid": "21fe3983-1502-4adb-9a0c-17e3b7595525", "value": "accessibility.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c58803-1872-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772701644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701644, "uuid": "419af24b-0e2f-4991-a241-00b1cdc1aa51", "comment": "Malware payload (Mirai)", "value": "d98c5dba989529267e403109cd2b5688", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701644, "uuid": "8da6457f-2aa2-40b1-a606-c5ee44cee164", "comment": "Malware payload (Mirai)", "value": "df84808bce1ddb59a65007b05de307a2c70d7a18a9057c24a6cee78e9cb61a63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701644, "uuid": "b0fdbee9-17ac-4ca2-81bf-bc27f90c35e3", "comment": "Malware payload (Mirai)", "value": "9190302d470fee3aed6db4ead43bb82b21cfc08b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772701644, "uuid": "95e9c287-5e96-43e8-b685-9992bb71fa70", "comment": "Malware payload (Mirai)", "value": "71c2021d334eb73ca2617243cf4a27b484ffcd840085a1452753f56724d709305c100f6308c813074186665212e8418a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701644, "uuid": "e8a1bdfc-958f-466b-baac-14c642832620", "value": "T138E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701644, "uuid": "ea9bb9b1-0e83-42b6-a4e6-5a44a3b1ac99", "value": "3072:0xjJw1Cc/0s6YAPwenUr48pzfR+JonCy:0xlw1xAop0YfRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772701644, "uuid": "5b751dd7-3156-4f55-ade2-f2764e768430", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772701644, "uuid": "1d160ec8-5118-4dcf-b9df-ab5b7462c149", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772701644, "uuid": "88dd93fc-ab96-46e3-b36c-812973df54e3", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e347991c-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707727, "uuid": "43146eb9-ff4b-40a7-afb7-176ff43d980c", "comment": "Malware payload (Mirai)", "value": "f2a3ed4921218e1ed0706cef35060b5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707727, "uuid": "c406d0ff-0ef4-40fb-9044-ee17f9fb40b1", "comment": "Malware payload (Mirai)", "value": "e029a8b2196281527fd3e1894ca859dd4cab681d038621b32fbbeb65b365e8a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707727, "uuid": "a066fb19-ca1c-4e4b-be01-7e909fc1bfdd", "comment": "Malware payload (Mirai)", "value": "6d3782975e0c530d4bcfacac04f28d29ac271998", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707727, "uuid": "4d807d31-239b-40bf-9420-968fcd229f7f", "comment": "Malware payload (Mirai)", "value": "e6e581a90208eee224c26e8876eeec707453f82b63b48a0b9ea5ab9cc4c2fdff8967583fcb873daebced19b915717cf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707727, "uuid": "58a05085-f55a-49d7-aa84-95647ae5dc10", "value": "T1F5A34A0275C14CFDC089C17516AFA936EC21F1EE1236B1A767C0FF266C4DC22AA5E969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707727, "uuid": "0204fa09-4969-4414-9320-d97fadcb873e", "value": "1536:ObHRn+vygsOzspi/urjaRL8dUaIjT7iHFxbwXYP5WhDkL+DHWqnaYJiwbZnfZ:YniNgp7XSbaIjyHFKXYGDkLgWKkwbZnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707727, "uuid": "16c22d74-e04f-4a83-94de-7ec642bafcad", "value": 98208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707727, "uuid": "d194e0f8-3a49-4652-bc16-f509d199487e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707727, "uuid": "f0047114-77c1-4b3b-803a-f2e4c55a1e3c", "value": "5r3fqt67ew531has4231.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e4c672-18bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772734709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734709, "uuid": "ef5e8b2d-3042-4ae8-afb1-e02d6a4abf5d", "comment": "Malware payload (Mirai)", "value": "8577a0c1e1a8745e52b51390cae035a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734709, "uuid": "e95c146c-d9f6-42da-b9cc-2d0f8bf44451", "comment": "Malware payload (Mirai)", "value": "e091cf159b8f61e76e48947bcef96fb1dba037487bace02f7cab7995e06c94a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734709, "uuid": "eac6101a-6b8c-44fe-8e13-a91c3e085f55", "comment": "Malware payload (Mirai)", "value": "3e3d08ee92d9b30700b69bfab89793ca6e89fe43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734709, "uuid": "998c2a12-0a65-4928-bff6-ea83112639d3", "comment": "Malware payload (Mirai)", "value": "e038b8dd820a0a16314a716faa4a62892b0a629c231e6387ae7bd5be740c8f1cdbc94b5378ecda0f7a1960f0045b94b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734709, "uuid": "0feaeacf-5730-4e11-94e3-1a037e5e038f", "value": "T1AB230981FA47C4FAD8870D7104F6F2BF973298AD5026C76AEF48A936D52332052597CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734709, "uuid": "db65b358-8f84-4cf5-94be-8084d453109c", "value": "768:7u+CoQ87+SAQY1+xotk+J9DQ+Cx2N+mZp0dLttAjjcWW8Tbh0H0/KlFNAkoWqQKO:S+CoQK+SAQg+xotk+J9DQ+Cx2N+mZp0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772734709, "uuid": "3b0f66c0-8cd1-4a81-94b0-047621785c9c", "value": 46192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772734709, "uuid": "18caf391-63e5-4cd9-9d96-10cd6ce4cf3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734709, "uuid": "860ddcd8-1807-44e3-8398-aabd4ff7c66c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4da852-1876-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772703202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703202, "uuid": "6798bd5f-4044-4d96-81a5-a3bac2b0baa5", "comment": "Malware payload (Vidar)", "value": "ebfae8030a8d2fa0a66a73dd743b7156", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703202, "uuid": "3bb81697-5b84-4baa-ad53-435c49172a03", "comment": "Malware payload (Vidar)", "value": "e09b9dba9ac0420328c24d903008f88ad8274788fbf82fa64732b24413851298", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703202, "uuid": "74771084-34d3-41db-9f32-1f3568b0e892", "comment": "Malware payload (Vidar)", "value": "86e4c3bafb9d5f4dfb1df9079cbc842d50c70115", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703202, "uuid": "3d546262-6a7a-47cb-8873-84182984a54b", "comment": "Malware payload (Vidar)", "value": "4d7f89e335c7cf5cc4f1976cfdd94c9b9d6e1bad2ed9e69f874b7e623c0d9801099217a59bc3bfb8aef2886ec9026572", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703202, "uuid": "c22beada-b947-4234-977c-7886822edf2f", "value": "T17FA616AB27E78168D39DB23BF1929F42B4F375340723D2D302510BE8DA615D16E7BA60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703202, "uuid": "5bc31037-8c5f-4039-973f-bd9e3c9a83a5", "value": "c777c0958f1392e5aefc182510e58608", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703202, "uuid": "a4fee838-ed10-461e-8010-e30d3893322a", "value": "49152:7sx2id0vJ038GaE05/uzdQ/7KzsSwFYlPZPyen1qFxIjPpSCoeolHkRAPKsuSB4d:6DqMPNoeolERHsuSGMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703202, "uuid": "fe3ef665-54ef-4fd6-bfe1-9d48a031652b", "value": 10191360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703202, "uuid": "880ddee7-2b30-4baf-a798-108fc5c10039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703202, "uuid": "cd2944db-950a-453e-b1e8-8ad4251a64ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa12872d-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772698182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698182, "uuid": "b37bb513-70e2-4f5f-9e41-7286b700caad", "comment": "Malware payload (RemcosRAT)", "value": "ff57b297af79ec58069bc87d89ef1353", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698182, "uuid": "b8658761-c4c4-42f3-8cc0-27e927ac6c62", "comment": "Malware payload (RemcosRAT)", "value": "e15d51f4373e31458edfe4e25d55397d7e26a688c062c44f68fd8a22e9065d8c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698182, "uuid": "f99d1601-9aa8-4c7b-8d50-850d0c72a0c7", "comment": "Malware payload (RemcosRAT)", "value": "602899990b319b7fe0ee3a761e119c69fad60908", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698182, "uuid": "7e12a101-5407-4988-b9ca-afdb12e6d110", "comment": "Malware payload (RemcosRAT)", "value": "cdcba97ecc6a793ac21d8c8a25ff366fd66d504d1048e3fef5d191a1735eb85f9f903aec2705db4c22a63a5457636ff4", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698182, "uuid": "5389d929-772a-45ed-9cc5-54b15146a962", "value": "T17DF3122AE79643A8C27FAEBD9FE6BA7C78E15215913E804F20C41D0F0F04D28B51DC56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698182, "uuid": "bc30ebc4-ce2b-4dc0-ab60-a5d25134e0f6", "value": "3072:0PfvaC/R8pEPpMrftcl2EGqNNe7CPu2/HmhBMBKLUvJF9ItpFXOq56VGI4G1brR9:0CCepEOftcMDqNHPuyHZQQR2OqQL1nR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698182, "uuid": "4a8bb475-563e-4bd7-b78f-589be595c557", "value": 161066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698182, "uuid": "459e2a0e-eaf0-458c-8d53-54f467ff0305", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698182, "uuid": "32067fef-efc5-4506-9e9f-34cec2d6d134", "value": "Response_Data_001639774.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5157145-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707649, "uuid": "ce3a11b0-9836-434a-b23a-8c14147202c7", "comment": "Malware payload (Mirai)", "value": "5013d4923d0220c0747a83b0b64eb5ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707649, "uuid": "011bf425-d9f1-4249-a7ab-1ea7d4801acf", "comment": "Malware payload (Mirai)", "value": "e1bb7ff5af21a40f17d5b897d92e45f927cc2bf54f3f0227ff82546dc8cf3186", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707649, "uuid": "5c586b74-933a-415c-8101-3e64fe882f92", "comment": "Malware payload (Mirai)", "value": "02129aec34796cd80b7bf31d0a1fe47d715373f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707649, "uuid": "f2efccc1-b06e-4a25-92e2-3eee531a0547", "comment": "Malware payload (Mirai)", "value": "95b70ed4267b55f9e0c8fffc37fe8caaba9cd304398d05a2934201bc2fcc82554ce59d3f7f6af8bca41a37083e66cb50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707649, "uuid": "422d9123-e9d5-4506-be97-bc4f9dd65c4d", "value": "T15DB34B31BE762E23C0C5653622FB0725B5F683CA25F4C62E7E710E8DEF645402266AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707649, "uuid": "81ed2a68-f8ec-4836-837d-3a0f7dcd709a", "value": "1536:FjUS8Usq4LaKoz0kNaVd8dpVFirOKjZQtm9JiE5Kltln2OZwbZn7tyY:phTIkl9PujZQYzi0dIwbZn7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707649, "uuid": "3532b9c1-073f-4ba9-a886-82cd035d7d43", "value": 107904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707649, "uuid": "d9c5d8f9-580a-4e4f-9761-101a609ab0cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707649, "uuid": "5e1451ed-c5dd-4a08-8c19-726b60fda57f", "value": "5r3fqt67ew531has4231.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aad4bc0-186c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698800, "uuid": "d186eb4d-b538-49e1-9c4d-46999fa64077", "comment": "Malware payload", "value": "18a886ca42d0844f893f1b942e9ae03a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698800, "uuid": "f2739196-67f5-45c8-8e86-cbe2774dfdfc", "comment": "Malware payload", "value": "e21eab991273b94cf73edef3e4bbc5c709ead160731db13c4068124938db402f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698800, "uuid": "12d81af0-cc85-41b4-93cb-e541220c3c4f", "comment": "Malware payload", "value": "fc172b3d25de46d8a7cfec1f22651f6fce34a021", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698800, "uuid": "f6c55474-9a2d-424a-bdf5-4fcf7488c012", "comment": "Malware payload", "value": "7d4b4d5b1eedb6cb48a38b99f40155da616d28d0d1b2a3f79b8df7d495ba9194c71f87e0e66ec9ed0a9630d0749f7d28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698800, "uuid": "0aee678a-dc78-49ac-bf64-92c1f79dfda8", "value": "T1C8E3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698800, "uuid": "01ada81a-d062-4a6f-b923-6d851df99e74", "value": "1536:p+pTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxydbK:pGlybKpzEOfGQ+vEubTt4ouftL4+dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698800, "uuid": "b868cb31-d41d-4d5e-b1e5-3e84850c5452", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698800, "uuid": "36b12164-3b79-4cd1-9240-6ece1dbd4a52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698800, "uuid": "dd2e9c0c-a6d2-4386-b3b1-f4ae2063f832", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee0db13-18b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772729328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729328, "uuid": "ddbbdc59-e08e-4e26-9035-c06d1971cf5f", "comment": "Malware payload (Mirai)", "value": "afd172d67c2ca4cdfb80027735e9f500", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729328, "uuid": "e2c4eca6-83fd-415b-bb19-f6b9a13b524f", "comment": "Malware payload (Mirai)", "value": "e21f851bc0245daa279ea6c477cd8d07bab9335cdbc7104556f155980741de60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729328, "uuid": "aea00dbb-4457-42e0-8a44-714be3959ffc", "comment": "Malware payload (Mirai)", "value": "9b3468c8b7ba84bcc8cd5e6002490f9d91fa26cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729328, "uuid": "bb8f26e6-6544-4962-8ac2-89bb5c539c61", "comment": "Malware payload (Mirai)", "value": "78cd6e06c4ab5571572809583a405ba8a7e48bdf79890924824060ceba81acfed12b710a3b2073fc9f22fcbf8f7871ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729328, "uuid": "fdc31763-12d6-4f9c-8551-98530c0c203b", "value": "T1ED3319B51516F2BCE9E22078F40720F529530A1C3ADCE2D3B0930579FFB5B48B96AD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729328, "uuid": "321f61cf-5cdf-4261-9422-d18ddef32c07", "value": "768:zMClhMqB0yBuKw3GoACzQyZRtlkABYxQeTUnRaww31:zF0vZ2oR9DtlksYipvs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772729328, "uuid": "985ed06b-345e-42e2-aede-73bfe5036717", "value": 50632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772729328, "uuid": "bb1d1ec3-218f-4184-a45d-019c8239ce91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729328, "uuid": "e0d71ce9-fc52-4a0c-bfd4-c5662e08121d", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d14845-1881-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707894, "uuid": "30755f66-5b56-46a9-9f6a-313886fa1b64", "comment": "Malware payload", "value": "5f6a4dec117aae7328f028dec7fe841e", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707894, "uuid": "8f0c55e3-dfe1-4911-b9b4-f2017f2d1179", "comment": "Malware payload", "value": "e25a6940acbe970dd449fa92d0c1dbb0a923c3cbd76e152b56d904ab8e7ed01e", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707894, "uuid": "e7d8fe46-a2b2-49ad-b50c-510c7f0dba12", "comment": "Malware payload", "value": "9385aff1e372b2cd8fdfa694c6f6450c300eed3d", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707894, "uuid": "0f772299-b96a-4af9-ac9c-3cbf55dc006a", "comment": "Malware payload", "value": "04de25e1a69dc2b5913d5301da0edd328c8dfc28ba12edb3f5967db404c8a0a5c945e76d4538a284ccaed8386adc1ea7", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707894, "uuid": "5f9e06d5-3436-447b-bbd1-01ea8f69fa6a", "value": "T134D3A3913E13A08ED03B9F4F29F17C59E91E790B6AD0495F319FC69B5FB610A8C90878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707894, "uuid": "9c019a45-d1ed-4ac1-a2ff-bfd6d7e33a7a", "value": "1536:NGWTmKJ2XFW8/fpPtwY9vmVr/cllO0cmhwi:NNmHmrUTBCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707894, "uuid": "4d216ae6-6cc4-4fdf-8315-84bd027c733c", "value": 137791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707894, "uuid": "f82e44ec-077e-403d-888d-e21815a15d86", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707894, "uuid": "f34446c1-2748-4033-97ad-6fbd7acc6de2", "value": "14733_exploit.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92da3f5e-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (Loki)", "timestamp": 1772697713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697713, "uuid": "b2189224-08e6-4074-a7ae-93fea4578a5a", "comment": "Malware payload (Loki)", "value": "be0b9a2fe667db5e3659defab1460c41", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697713, "uuid": "3042356a-ed1a-41c4-9f5c-6bb29197a989", "comment": "Malware payload (Loki)", "value": "e283282b8c6f6ae58324eb1a25ff3462f99da5870349c246f83c7986eb756cc8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697713, "uuid": "1d070ccf-60b0-4fe4-8fdc-3879144b8261", "comment": "Malware payload (Loki)", "value": "7fe047683db71fef5e772ab551e6076b39854e37", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697713, "uuid": "6eb0e958-45cc-44a7-83c2-0c993f261148", "comment": "Malware payload (Loki)", "value": "0b1b5c6eb988ae2487a15e9e7df33addabc116dcf4d43972a2e6803e441cf131ed4c5841d569332caa1f96d3de6c17cf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697713, "uuid": "e96c186b-edf7-4832-9b7f-a4a413ef5b03", "value": "T1FFE21B22C9AA193F35358E30683CDC75DE1D691FB710DCE595EE0389921EC34EC6AA39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697713, "uuid": "a7651f8e-6471-4981-9601-93c6992b3495", "value": "384:nDyprr9w3h8P1NpVMdg0q6+yDdjl5hZz1qve2QT:nDyp/9w3h8P1NEdg0L+yDdjl7F1qvjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697713, "uuid": "9eb56727-6ec2-41ae-9438-880255c2f6d1", "value": 33985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697713, "uuid": "9f9cd373-3d12-494b-aa3a-a3008e6efcfc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697713, "uuid": "42b6ddf5-0fd8-4f21-b475-856230f52caf", "value": "be0b9a2fe667db5e3659defab1460c41.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f2e448-1852-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772687782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772687782, "uuid": "479b1d3f-08be-414e-ba12-9e9949a4369a", "comment": "Malware payload (XWorm)", "value": "6f2ea7b844c52b12c8a308686259e322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772687782, "uuid": "f3b53605-18a6-403a-8c51-40425743a46f", "comment": "Malware payload (XWorm)", "value": "e2b2fb8b0baffa0b3104ebd6da6de4f6b102b8f26d3828afa4e726e661be2702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772687782, "uuid": "5e89f265-5188-45a4-ae81-599293c6b457", "comment": "Malware payload (XWorm)", "value": "942ca2181f39462b654bd22e8d41feecfa3a6f28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772687782, "uuid": "ad6cbc4c-e5da-4a32-ba45-5807cf89b50a", "comment": "Malware payload (XWorm)", "value": "2f6f099bcbc52c77be5eba76af1c13ec5faabb3e4c2e1d65eb6da14ec01f6d183bedf41d93461ba74430b4c5f5127a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772687782, "uuid": "96018eff-d8da-4b2c-89a0-c64c62dbaf63", "value": "T1EB95D00573F442EDFEABE1768A13C507C7B178450677861F06A0AA766F33B716A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772687782, "uuid": "e5baccb2-2795-4d66-8519-956af5b72d63", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772687782, "uuid": "5ef0ca7c-6da9-4d16-b2fe-2f5fb03db7e7", "value": "24576:oCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrdtEDAas1cNUtwLID0Lpu8XcWJ8Y9iY:T1H4jR2TYrQbDTrdtEZO4FcmZMlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772687782, "uuid": "5acc0d8e-e503-45f8-a4d0-9e426eaf79e8", "value": 1902592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772687782, "uuid": "d81f4d5d-a5d9-49fd-9151-50c6c3e61bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772687782, "uuid": "0c3d4cba-3f92-49ce-846d-b322532c8f91", "value": "ISF form -TWN26030208 - TOPCON(USA) KEE TO LAX 1X40HQ.xls.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51abefa-18ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772741231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772741231, "uuid": "4b08080a-a088-4724-be1a-45d5e4b0e0ed", "comment": "Malware payload", "value": "978677489cf9489621fa47318c2b0ad6", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772741231, "uuid": "01273583-8d92-41d7-b213-71f5bca27325", "comment": "Malware payload", "value": "e2f0d2243a95db379dd75de57fb98ffbc421cd58e9d11a2ca5a842540db9ba6a", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772741231, "uuid": "c8d4b1be-c597-44aa-b75f-44254f652133", "comment": "Malware payload", "value": "0b43f41bc8aa789528233ca9ffb5015abbceb851", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772741231, "uuid": "d9a2c018-fce6-44e5-8620-12e2580d77d7", "comment": "Malware payload", "value": "e676a72dde196be0f153af4f3875472a4570f08c3dbdb869cb493419db2ac153b41d737f42ecdea1b1aec98aab1353ae", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772741231, "uuid": "e223ba3d-42d7-44bd-893c-6d6314cb4cee", "value": "T1BF08338BBAD8DCCAE657D837F0C33E9F89E14A79D594183D621E50462ACBDC9134E063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772741231, "uuid": "b5ef1ebb-2dee-42a7-a42c-834407019ca3", "value": "1572864:OZItblYV7dG8PbMMK33Hx5FZuDWj448RL5PnQ9kep4+QSzjvYD0ze0O11wFW6U:OZItblY1RPINnxYDx48RNY9kep4+/jif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772741231, "uuid": "28d53fda-812c-4b60-8413-93c4a8c1e525", "value": 81332137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772741231, "uuid": "5ac2ceb3-93c6-4d0e-808e-2245cd39d800", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772741231, "uuid": "c321b990-f431-4192-992e-d9db5f8c23f3", "value": "success", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68da6b76-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1772695066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695066, "uuid": "f5abf486-94f5-4553-abc4-ac6092d8271f", "comment": "Malware payload (Socks5Systemz)", "value": "d76952a98824ce3e40c00b62057368a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695066, "uuid": "536ce1f4-1867-47d4-a2f3-ca8de0e3a967", "comment": "Malware payload (Socks5Systemz)", "value": "e3aab796649a04a8cf4d9102264ba0bc4c69971d3b390fa8fd68d26abaf1ef2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695066, "uuid": "d3d3b960-6155-4c30-a848-87690a58c6e1", "comment": "Malware payload (Socks5Systemz)", "value": "87d361535989cf84979473681d3111d00dfa4fbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695066, "uuid": "5176675f-03a0-4876-85b5-91285df9e420", "comment": "Malware payload (Socks5Systemz)", "value": "f014719cd91b30abfffdb6616ee816faa4e7916a7a261f6da4ba48aa204a2fe8c2ca871b1dc72d36dc74a246a739107c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695066, "uuid": "d49c9d56-cf42-4792-b7a8-69a24f72e73b", "value": "T19AF53394E3A8C636C23B2FB92F999545CB5A381B15F452A472FC5B1DCE8FA47C4C8B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695066, "uuid": "9cbf5e36-8ce3-4f6e-baeb-c431d8218541", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695066, "uuid": "47223d32-d1a0-416c-8bd3-635381c545c3", "value": "98304:MaMgbNQYI+b9hBQ7fM5fITC9cXz0W0WF7:4mnI+BQ7fMZIuezlF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695066, "uuid": "6073267f-610a-4271-90a5-8d9d6828bfa0", "value": 3399989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695066, "uuid": "7096fb8f-5c9c-44b1-85ca-742c4495c4b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695066, "uuid": "4abde8fe-5f3e-494c-a4a0-d0eb4fab7477", "value": "d76952a98824ce3e40c00b62057368a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3476708a-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697555, "uuid": "b1d527a1-04af-4a31-81ad-4884f352f0aa", "comment": "Malware payload", "value": "7c91c4a82ed8e24937a113f8549630a9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697555, "uuid": "90744605-5c0d-4042-9d08-c03d32377768", "comment": "Malware payload", "value": "e3f1fba4aeef3e63d121359b654b2f7e8f5dd47ce85fd4cc70c68f89269de993", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697555, "uuid": "e09f5275-4cf6-4aee-9d7a-02a3e08f7c1c", "comment": "Malware payload", "value": "cd2d54038408ea36bdfcc44fb2c1b0c95a73c0b5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697555, "uuid": "f9eec31a-4466-4317-8cf5-f415850e288d", "comment": "Malware payload", "value": "a9872c75f185434fc3f489e72947bbea557bd9d5907492535a8b3a2891537e81a871b0ec2334b545d32ab67983b50bd8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697555, "uuid": "6ca86341-51f6-4d24-8e5b-8ebfd1a24d36", "value": "T11882842A891ADFF4063E3151B5AB6816A9104326B5383D0D7D4FC5AD3F3AA14CFE21ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697555, "uuid": "9ca092bd-1b2b-4bc7-8b6c-3b04661d343c", "value": "384:KxZd0vLnr95rQOoiFtRNbx8h4XZWxwno0809ZcEcWFNg:KxjMzdvi1e3FNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697555, "uuid": "6c28fed5-1364-424c-81f8-8d29b8d47035", "value": 17718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697555, "uuid": "e4f7ef17-154b-4cfb-bc5a-7ab90131e6e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697555, "uuid": "ef49401b-1230-4377-9ce8-714e8f1b7a71", "value": "7c91c4a82ed8e24937a113f8549630a9.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d30bea-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726741, "uuid": "cc267311-0988-469f-a889-81b4d767e4ff", "comment": "Malware payload (Mirai)", "value": "f16ffd4f10a538117dede22734cc60d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726741, "uuid": "98ec78c4-e4a1-4560-a570-d451c95c6ac9", "comment": "Malware payload (Mirai)", "value": "e42591d1eb8ea431e9a6bc395f8bda90204dbf7c6e02529876d8b45b9ca85b3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726741, "uuid": "d403527b-a79e-4112-8768-bc2251e578e2", "comment": "Malware payload (Mirai)", "value": "fab1046944649525c01ff8320df136ce474a8b1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726741, "uuid": "4978967a-d9a0-40fa-83cf-2f8ac6303743", "comment": "Malware payload (Mirai)", "value": "0fb6ec5c75420327a969569e0a0e74ce94d228c55d95ddb4214ece3ba64d420a08623674c3f503b4696ff9751cd9e64e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726741, "uuid": "1ca6bd91-0c4c-43b3-a07e-85c5e486cde6", "value": "T1FFF34B86EA409A13C4C61776FAAF014E3322E795E3DB33068D185FB43FC6A5E0D67616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726741, "uuid": "37eae9e8-73a9-438d-b2ed-0a3e4fb6bab6", "value": "3072:YahYNdE1qCcsa2PSziYqJRM5dGcNYnWh86i6j4GPf4CyM/94i58mr:FGNdE1qqa2KGi5gcNYnWho6FPf4nM/9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726741, "uuid": "ff29434d-9562-47d3-811a-326de7e06713", "value": 164754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726741, "uuid": "f3573c93-d20c-42e4-9dee-ce8040bd1d14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726741, "uuid": "963cecec-a94b-42bf-ac5d-9b1f7b25a0aa", "value": "MMaaRRiiOisecTanee.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd9e365-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697730, "uuid": "024c13f1-888d-460a-8148-7ee16a99c9a4", "comment": "Malware payload", "value": "f69d2ea3ad1da4824cee38c6302e3f1f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697730, "uuid": "209dc605-7fea-4745-a0be-887f4fac62f4", "comment": "Malware payload", "value": "e6e95a16044bc6977a235b567129f78aff278d52677681cac11b1141042cf08e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697730, "uuid": "d86ef37e-664d-477c-b647-e465a417ac5f", "comment": "Malware payload", "value": "1ff64e0b48c2ba6b03ba73b09805509816f6ffcc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697730, "uuid": "bd883747-2e20-469c-abb3-a0347b53acba", "comment": "Malware payload", "value": "06ab19b58f3300b553647091c4f7742bedf09dc991652d8fab3a90941c22450dbba5f7284a31440179aeef78df41392b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697730, "uuid": "7dc30ca3-8171-456c-b57a-084f64e4e8ab", "value": "T1E2E25C9D5D51C858C7B50ECF4884A9B98B17B34788E9034ECFE3E7AB90C654EC067B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697730, "uuid": "c9720794-4bf7-404f-b54b-aad3438c193d", "value": "384:zWfbUnkxM0N/X84kvwpMTjVTJQHfBKcvTlwFTUZfSO:z+M4kopMtTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697730, "uuid": "47aa10d6-af09-439f-8fb2-19b691c614a4", "value": 33793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697730, "uuid": "54dd2b64-fa47-4cdc-9890-60456c480196", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697730, "uuid": "e723c256-ac91-4530-91c0-aa06e7041c82", "value": "f69d2ea3ad1da4824cee38c6302e3f1f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61213659-1897-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772717387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717387, "uuid": "4fa08497-5f60-458b-84a5-515416a47e47", "comment": "Malware payload (Mirai)", "value": "143d63d934559ede204c48f1a3ca3de4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717387, "uuid": "9180de09-e54c-4aec-8f9f-f7c99cb0ca51", "comment": "Malware payload (Mirai)", "value": "e797d58ee2e5bb286b9dbe9d831d9d96ae9f446b81f8462b97b148b6476602e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717387, "uuid": "2c965ed5-d430-428a-9bbc-1e0098d4ad09", "comment": "Malware payload (Mirai)", "value": "50aa2400400ee8b612827b39537bd1d6b1bb6fa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772717387, "uuid": "418d775f-1e3a-4ac3-85b0-7628e0e1a81c", "comment": "Malware payload (Mirai)", "value": "438cc066ba43c354232532173f225578f2738efc52e6d6f0a559d5e4c031c582564730a76c7908b1babe57b588ff60a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717387, "uuid": "2b0de218-d16f-4f2f-9d82-8e9c7b0e514a", "value": "T1FBD33841B9829A27C5E123BFFA6E018D332563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717387, "uuid": "f47c649b-3939-40fa-b57c-552f01dc77cf", "value": "3072:snFif7apx6XS+kUgpjWXQQKMs0u29wzulziQSv:sn8ZS+dQWXQQK5s9TeQSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772717387, "uuid": "46243927-b9a4-444d-8557-50f3ce5eeb11", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772717387, "uuid": "ee4a8a44-8c60-45a8-b15c-3c67d2358e02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772717387, "uuid": "b8cde37a-cf6c-45e3-a340-40412496b62a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1259bad0-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697927, "uuid": "3bed8f38-e60e-48e7-8cca-208ac7234834", "comment": "Malware payload (PhantomStealer)", "value": "e0cade5c2275b4a36adbc14e765072f2", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697927, "uuid": "1e5634ea-cfdd-43ff-ac85-8e6aeec94c93", "comment": "Malware payload (PhantomStealer)", "value": "e80202c57ee8dde50530fabd1acf7023447ef45609c7c483ef185238fc959235", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697927, "uuid": "c1a9b359-277d-4191-9f40-f1ad37dd28a0", "comment": "Malware payload (PhantomStealer)", "value": "24000abca37b9079c62be2bb6c10e6f088caab69", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697927, "uuid": "1c5749dc-7388-43b4-8c21-e98ac4eb9df0", "comment": "Malware payload (PhantomStealer)", "value": "1fc6f847d5d08c276c2b2b12de2665cb7f87878ba539e23b1ec3b6229a674b5c222f30e0bc60e8a904459e2276728143", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697927, "uuid": "73b0841b-f5a5-4159-90e8-a8ad3677c321", "value": "T14026D0586BC42FF2F478EC2B06BB86E9FFA15A11811B388947B77B584747FA1900F065", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697927, "uuid": "1684d530-2806-43d7-9bb5-8065c0996d82", "value": "49152:qmN31XKcM0Z6uAWgL2RSwG56mJ/AyArcSK9kE:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697927, "uuid": "25fbc9a1-6edb-4848-b6b9-306ffaa51398", "value": 4689783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697927, "uuid": "3314fdff-73ef-44a8-ae95-8b0bffb233f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697927, "uuid": "82596835-9be7-4521-b634-3989b0481752", "value": "e0cade5c2275b4a36adbc14e765072f2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cb971a-1867-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772696829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772696829, "uuid": "da2aaae4-b774-4e9c-bc21-becae4cd4cfa", "comment": "Malware payload (Mirai)", "value": "413c551ec82a9776aa6f28dcdb019e3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772696829, "uuid": "1d26d083-f047-45a0-ba93-1d7a32c01854", "comment": "Malware payload (Mirai)", "value": "ea9a06383b15c216812545af427aafc5c55bb0b26979fd96314881f58dfbf5cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772696829, "uuid": "06b69df6-f9d5-48e9-bb08-968dd20c8c52", "comment": "Malware payload (Mirai)", "value": "927abb6a4237850e7cae398584033e10c95a950c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772696829, "uuid": "b1a95753-bf3c-4dde-98e3-798328db3c92", "comment": "Malware payload (Mirai)", "value": "8283e75092e4ef5f3b5c9209fcefc00a6402c95e7a5fa8a325ae7849f49663ca3a7b9eb011bff6e0288f3bf2aba597e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772696829, "uuid": "da52e589-b023-4537-8cf8-eb4118b3fd0f", "value": "T152B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772696829, "uuid": "67fc8016-6000-4b0f-8771-10c7af7f683b", "value": "1536:1UK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zvn:eixnUHz4Z+5ypkn3E8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772696829, "uuid": "b4c79bee-3e3d-4545-a43c-177f121b0049", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772696829, "uuid": "be215ca6-862b-4064-b013-639e19367f09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772696829, "uuid": "699d22f7-2611-4afa-bd79-78e110f8bee2", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f8465b-1895-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772716409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716409, "uuid": "34a0d6b4-80fe-4816-a1bd-11cadc37e67c", "comment": "Malware payload (Mirai)", "value": "bd62ce66a0392841f356f29f02452f4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716409, "uuid": "094d6597-147e-4d82-8929-7ee00350f254", "comment": "Malware payload (Mirai)", "value": "eb0e1082781de9cc7e2877eedbce57f407b1fdc37b4582dc9951ae320cf55231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716409, "uuid": "9a1e0911-5703-4306-9743-3184a65d9fd7", "comment": "Malware payload (Mirai)", "value": "00ffbfbac380e8d9b39dc11bf383a24fb460637d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772716409, "uuid": "7e1c9344-bde7-44d8-b7d7-11f9ad72ce7e", "comment": "Malware payload (Mirai)", "value": "88e5175c79abfa012f8feddf2f030c02378ff4c70b19a2b274fbbf92e80d070807b0ba7cad5d4b983f6fa9104b4e3aa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772716409, "uuid": "51bdec53-581a-4e0c-9341-ed729e88b6a7", "value": "T1CBF44955F8C09F62C6D52576F68E82783323477DC2D6F3069A148A383BD78AA4B3A741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772716409, "uuid": "4e0f9a5e-6815-4713-b916-2ff9cd01ca42", "value": "12288:9uI2wAeWdKeV46uS0XFDNo19jN+MlCKy5XYqTYd8pgr27RA6pXTuJ3/16BMx15R:OwGGK9OKy5X9G8pgrfb6BO15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772716409, "uuid": "c857a726-b386-44e1-9b96-944c4d30972e", "value": 783736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772716409, "uuid": "f3452b6c-ab77-445c-925f-0e199ec4730a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772716409, "uuid": "1f261326-299b-49f1-9994-06029a344d16", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0572e6d3-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772697906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697906, "uuid": "d59fa8f7-84ef-4fd1-abec-efc9d23c8e03", "comment": "Malware payload (a310Logger)", "value": "c8d8fd196e83294c35120c551b996c49", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697906, "uuid": "9681455d-6fc2-4165-9d4e-b7b040e4fea6", "comment": "Malware payload (a310Logger)", "value": "eb4687836d7f5cfb95bf1058d9b51fda819a0681b3fea2d009b4a3d891a3c4f3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697906, "uuid": "f490f869-e604-47c0-8c77-84f4061408bc", "comment": "Malware payload (a310Logger)", "value": "df6c703f0d7e4ff2b67add299b6c8dd8980bd2ee", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697906, "uuid": "5fc35d0a-f686-443f-b88f-51b75ebd41de", "comment": "Malware payload (a310Logger)", "value": "a21e0b1b16d75858be6454ebbcbb84fd6e657b6bc74b3a6296f83de046239a9878fda03a052f077ff4c11a1f34c867ba", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697906, "uuid": "f4112ed0-8736-4c6e-bfda-63f752ddfdb3", "value": "T14BD5BF6658DB7EC4EDCC3768053AD30E264209D1D58EABED34B8FE55B9C709F290A342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697906, "uuid": "34ab46e6-6284-4f43-9a1b-89ecc9d1fd35", "value": "24576:uzJVuMnnlIrjyv/awNJFE6SZkPrGp20O1BvQp1kTJhQ4U2F+jjc6W3pHHsWcfatW:0nlEiih6In10fUupHMWcwljS2zixJu7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697906, "uuid": "ff64f855-9c3a-45ea-ac32-baf555c340ad", "value": 2835679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697906, "uuid": "b92e53bb-afc5-4595-b30e-6fbc8c2ed9c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697906, "uuid": "8ca47b2e-048a-4dc4-a5be-b47cc54db3ac", "value": "c8d8fd196e83294c35120c551b996c49.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d866625a-1899-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772718446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772718446, "uuid": "7d6fdceb-e76c-4f39-bb63-dfa75700dccc", "comment": "Malware payload", "value": "d1fefd049dc859945b036c6f295ebda0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772718446, "uuid": "5c1f35ba-1003-4322-a66d-b76c267131c6", "comment": "Malware payload", "value": "ebb0add8e844f9628a62664a4dcef7a68775dd6253268e33c01618a554f1cf2f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772718446, "uuid": "d95324c3-c8d3-4535-b326-f031e6bdd63c", "comment": "Malware payload", "value": "e5c5d82f91a39b8cf70bf74454c87bddc2e2d058", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772718446, "uuid": "e825cd95-ad38-49c3-bdf7-08d1f5cf0a0c", "comment": "Malware payload", "value": "a555a03eb48e442d90aa7c89229226c201a70470c47cde559e61092fdc68f15d0273f0538012acedfb904f3d646b4d87", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772718446, "uuid": "504504d4-9f57-43bf-a93c-9268fa17640c", "value": "T1CF924CB506496C79BBC0DE799F3C7F0CAEE582C42128E39DBA1F39705A2065DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772718446, "uuid": "e5a94843-76f7-4ee4-95d2-e3a1b9ac6da2", "value": "384:kWncuxOLnVYMS+zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:kFuQL++zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772718446, "uuid": "25fa9498-42bc-4e7a-8d7f-27c277b97ac4", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772718446, "uuid": "9b76a891-f3ad-4ac9-afd3-ed20191deecc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772718446, "uuid": "12b450be-ccf2-4e52-8cbf-cbbf28990efd", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcda8e69-18d5-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772744223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744223, "uuid": "cfac9581-aaa8-4b83-9b82-4889c96f6866", "comment": "Malware payload (SalatStealer)", "value": "62d42b8788f958885cfd34428d29d7e1", "object_relation": "md5", "Tag": [ { "name": "ESPOL", "colour": "#9EFAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744223, "uuid": "a07be36f-2936-455a-b43b-50d0ec5f39a8", "comment": "Malware payload (SalatStealer)", "value": "ec2e071a6241ac4d12452070c37ffde5bd01650c6d9a5503d768cb583fea6756", "object_relation": "sha256", "Tag": [ { "name": "ESPOL", "colour": "#9EFAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744223, "uuid": "f51355b2-1b2c-4e15-8514-50a58bfee159", "comment": "Malware payload (SalatStealer)", "value": "3a0c59c4b26e9fdff15170f16d6317693b87ca5c", "object_relation": "sha1", "Tag": [ { "name": "ESPOL", "colour": "#9EFAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772744223, "uuid": "8287942a-cf9f-488c-b3ed-30458040f240", "comment": "Malware payload (SalatStealer)", "value": "893ec11adb913f6f46ad586723cdda1257a3520805030bbb194d0a444b3b12076d7ee1c5330b4966014628007e918f11", "object_relation": "sha3-384", "Tag": [ { "name": "ESPOL", "colour": "#9EFAF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744223, "uuid": "b9b2edda-3e11-48c1-85ae-e8c83ff98192", "value": "T183062308FA8365FAD5BB54B008AFF3BAC3325A094416CDF7DBC89D52F66B7111C68606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744223, "uuid": "55d74be3-6220-4fd2-8e93-8e923ce4f935", "value": "d8825d8e5bfdbb80bc14fc1af244d8f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744223, "uuid": "59d1382b-488c-4371-840a-5e85cedc7ddb", "value": "98304:kkuJhvcHdCmTqzFvrzNeIVPeOGbXHE3xXG/m1wSVSRJyf832F:du/cyvrYePFGb0BXG/mCnJyRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772744223, "uuid": "db245e36-02bf-47b0-a9dc-4b815da20737", "value": 3713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772744223, "uuid": "6da12cf0-bea6-405b-89ce-675015e8b094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772744223, "uuid": "a03654e5-374c-49a3-af8d-68335ab8cbfc", "value": "bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffa4920-1876-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703480, "uuid": "5a07f0c2-1264-4a95-9373-49bb8d6b6141", "comment": "Malware payload", "value": "8c59506e627737174f3ba1bac9180f96", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703480, "uuid": "4c48c812-6252-46dc-9ed4-8cb4f5f1d3e4", "comment": "Malware payload", "value": "ed8a62a9ab02182d0d1f806af9a21d785801c0aaf7c8e265e077682f053c6b67", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703480, "uuid": "e34ceb7a-b013-4b99-bdf5-1db46a9b743a", "comment": "Malware payload", "value": "6ee874e7277f8b95eeb224ea7caf3afa67905a0a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703480, "uuid": "1895b2da-4712-4934-855d-a1568335da7e", "comment": "Malware payload", "value": "7697cce7cff0de5ffe3035fcf4c9545f0122765303408128cef7c271a969d1f812938c4019dc9281ee1624cd276d90b1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703480, "uuid": "eb6bf6cb-7472-4df1-b305-534f478766dc", "value": "T16E318BD022538EBF7E8484DA6DC3C548655F01670E4C2A4DB9ADBB292F7C9A43730B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703480, "uuid": "ce6f6e74-eb3f-4a74-8759-1c7f7d80a1e4", "value": "24:fAku7/Gqr9zekjbQsQhm1/K21G+KYm8TUALtfzATDtFNfQLALGjDq+nkQ1ZAtDNo:fBcG+IkgsQhm1/hXKYTFeSlKUbKUT4uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703480, "uuid": "13b12735-2133-4989-b690-bed8b1062d20", "value": 1518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703480, "uuid": "48fedd7b-5ab6-4a62-840e-128b49bc4c80", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703480, "uuid": "1d9057e3-a316-4098-bb08-d8d0bf411f03", "value": "xoner.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fe82b2-1877-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703485, "uuid": "57edc42e-7041-4bdf-aea7-21b1a357b7b9", "comment": "Malware payload", "value": "15197f22703b738c730dcb6ade21b495", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703485, "uuid": "26609aa7-16df-407e-b8b3-acd4364506cd", "comment": "Malware payload", "value": "edefe6bfc651c6b2fe99e185b7a9bd0cc5b2edf3fee67f8ebf67eb190a9a1391", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703485, "uuid": "b335100c-b99d-4245-88a3-4480a4f40972", "comment": "Malware payload", "value": "4426ee4b0a9582ca0ffc195abe716b3699c070ef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703485, "uuid": "ee03120f-4afc-4b07-abf0-cc9ce0693ec5", "comment": "Malware payload", "value": "cbe100d2e5d8c07ee783df8c21ebc1eea3630210f725f6d3b1fcf7d3e68315804c212613b44b30979a993c6ae5751e13", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703485, "uuid": "715e8b87-1bd5-4964-bb24-bb61b290e03c", "value": "T17F31A6EE70618AA22A8D8F40B3F29548F8815A96E6F52F74FDE504D60F97604374C6B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703485, "uuid": "07eeac4b-5f48-4563-bab0-c9850d986ec8", "value": "24:nDdCfiiWXdXV1Xe58dbZwd/SydX3qdNAuRdnG5dlc6dR0yR0rJdRo8ROAdRbJRC3:nDLBDeqUdBqAiQ5/37q3TOA3bL43nkJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703485, "uuid": "f885385d-f5bb-4137-836f-56e85bbffd5e", "value": 1743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703485, "uuid": "9a7ad1b6-1745-4a07-a28d-2aa7c9ebb414", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703485, "uuid": "c5dc1ae3-dde5-4840-9430-1519492e8365", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b789538-1880-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707472, "uuid": "dc1d059c-2af8-4927-8ccd-1ce82c78ec79", "comment": "Malware payload", "value": "e66cda69bacc2c9e636dd1a6e0013b27", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707472, "uuid": "ce739ed8-5b70-41ea-9b94-1b5d5ab88fa8", "comment": "Malware payload", "value": "ee9eceda9522ae4c5ff3e07aefa523c61d50ebb9aca2808e0f4494a8c53498ea", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707472, "uuid": "05034ca4-a007-4804-9ebf-f08806ef2882", "comment": "Malware payload", "value": "e9ea0f0daba21d4c517ba6d90d21ebe369f5df17", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707472, "uuid": "348455c9-9d3d-4862-a9af-74597050a650", "comment": "Malware payload", "value": "4339cee361bde8d6bab5b269a34c555a6c4bc37765713b33f87b1d86fb5a0820f66109010b5074ef9c149f63f2732014", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707472, "uuid": "5e4ba6fa-2885-4971-a1da-22449cbbe31b", "value": "T109A63382F72A4A7EDC7741398DAA077123269D57CA52930321A5376CBC7B6D80F98FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707472, "uuid": "94f21617-9832-4e40-894c-e5aa7a3d7f8a", "value": "196608:xuXFs4ESQOXS7FGn65tLQ+dkS0y+bDKAMWWEknaPcBChamyk+lpgoLyStnwD:xu1REShSJl5zdkS0y+bDWWWEknaPimrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707472, "uuid": "9f34171b-6b76-4661-b805-8b9a9ef75d3a", "value": 10029313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707472, "uuid": "3557b8f1-f230-406e-8f89-b2999dbf937a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707472, "uuid": "2d45fffb-8af2-43c6-b27a-3b34969391d4", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd49fdc-1864-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772695581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695581, "uuid": "17f34586-eb79-422e-8e3f-8255c6453449", "comment": "Malware payload (RemcosRAT)", "value": "274b2c6dfc4335877d2700c90989c1e7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695581, "uuid": "77a0ff86-b903-4af4-a08c-fe758dcd0bb0", "comment": "Malware payload (RemcosRAT)", "value": "eeb42b531b7430889db6f1cd4add82eb3ebd78e748ae1b9b64023ed3a1bb1e6d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695581, "uuid": "2ecc0b39-a438-4896-87d2-6a327d4f8492", "comment": "Malware payload (RemcosRAT)", "value": "b4977580f804b3f38d0f7b7bcb5c2023e0aa4c86", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695581, "uuid": "e51bc688-8044-4985-ba43-bb4b2df9090c", "comment": "Malware payload (RemcosRAT)", "value": "fedfbf77a4a7ff03f36f6c88a9feb24a052739e9542e4ccdd6c476288a922318e3592996287b297737361e8b79009ad7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695581, "uuid": "052e007a-6d0f-4ac5-930f-7ef043cc2a38", "value": "T10602527DD6D1BCD0475B32C178AAFAC6104A8A17AE7B2E6CE5C501E10B10354EFBA68D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695581, "uuid": "baa9c8a1-ad6c-4da5-b46b-c7fabac9e122", "value": "192:w/Ezym9CKGwb6ZUVNrfspaNwow2ed9lgA8dGe3J:wZm9CGDVNrxNw32ed9yA8Ee3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695581, "uuid": "ecdce9a7-b645-4c20-8b22-30665cb45c92", "value": 8670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695581, "uuid": "9d27b680-a5bf-4c24-80d6-92eb48a0b1c5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695581, "uuid": "ef48b8f6-37df-415d-9787-be8eb5307b55", "value": "SOSTENER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25d8e03-186b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698706, "uuid": "316d584c-3163-4d6a-9aa3-2b1e4044f906", "comment": "Malware payload", "value": "d9b047a1ce2abd1ad07fdf70c9887a3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698706, "uuid": "669676e6-a55a-4b80-8b0c-0ff49da5657a", "comment": "Malware payload", "value": "eed0354cc2a950810ad1781757cc595109a0a2a8e835569b11359a88eb0e74e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698706, "uuid": "a5d476aa-8803-4e21-a8b2-a873ccb5189e", "comment": "Malware payload", "value": "90b87cb2d02b9629518674a04e8c190c94a3b123", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698706, "uuid": "480bf349-526c-4e7f-a8f3-47a611fa22ec", "comment": "Malware payload", "value": "e79c8763201b52224e2bbcd5aa70e912091407cbf4078b17091a1fa2af481a628943f5779ff640e444f890c3b8b45397", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698706, "uuid": "421a9303-5ecb-4c62-a795-ea4b55acca28", "value": "T1E2C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698706, "uuid": "8155ce26-95d1-4cb9-9c53-6ea7e9490b3a", "value": "3072:Cf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4bqe:Cf0tJBR4NSALD7rnCrheioqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698706, "uuid": "1bccddbc-3182-4fe1-bf57-71c4524b7d74", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698706, "uuid": "76afcab9-78b7-4bd3-a60f-017bb840850e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698706, "uuid": "f0dc7651-cce8-4e78-a902-7531caea84d6", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917acefa-18a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772724340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772724340, "uuid": "6137eed3-b265-4c11-beb3-021df534c5bb", "comment": "Malware payload (Vidar)", "value": "7c4f06753c0317368013e9b8e73385a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772724340, "uuid": "591331bd-e922-489f-a3cf-f3dba91998a9", "comment": "Malware payload (Vidar)", "value": "ef7cad4ee26218342fac6e02f21afc17e4926e2664cb2b1437a029af89eb4d6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772724340, "uuid": "6791cc3a-97da-46fc-8879-a51ab112102a", "comment": "Malware payload (Vidar)", "value": "cb65b29a7c245f3264d8f9dac8c7d590bbe7bc46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772724340, "uuid": "1e87a8e5-3352-4e31-910f-a18404a3179e", "comment": "Malware payload (Vidar)", "value": "e59906ad7c1f4bb05031db85e918de6d4385e7c8c78b613a3b00072c0d4eea395fd190e26fbc7dab8e3f5ca78a943541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772724340, "uuid": "fd9ff728-2271-4361-af10-e06f2e56deca", "value": "T1FDE6176B665D8528CD1D81FAF0A6BFC4ACF371B80776CEE7829003681E457DC4E7A624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772724340, "uuid": "dfaa6229-9b24-459b-9e82-34be7bf8092f", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772724340, "uuid": "0f29f6bd-3849-4917-a8b6-30da62a5c355", "value": "49152:3tD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUd:0xGLEUp9VDFtUdOTAApY6wdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772724340, "uuid": "c6a23ba2-92c4-4546-9282-6db59fb7b6ca", "value": 13880320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772724340, "uuid": "ad709418-4794-48c5-9f97-dfa8fefe79fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772724340, "uuid": "b9f2bce2-2e7f-41fa-aff6-f9827dc55ff4", "value": "SecuriteInfo.com.Win64.Evo-gen.28933534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54e6ea9-1877-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772703865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703865, "uuid": "9bc3005b-e14f-40db-b8ff-24897d22a738", "comment": "Malware payload", "value": "3765d9661e74897ee02dbbed8532c0ff", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703865, "uuid": "b5cc4b29-6883-4726-bb23-7d9d38a9d083", "comment": "Malware payload", "value": "efcd02eb478c43356d3ad1860ece5c0dde126882eb892a96b7526a16ae77d212", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703865, "uuid": "408c5cdb-44de-48b6-adc4-73a009ea15aa", "comment": "Malware payload", "value": "44a521528a273da936b9e4bf240b1df9c63e0442", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772703865, "uuid": "ea87c014-7c81-464c-937c-136e28cf7aae", "comment": "Malware payload", "value": "33b83c009414bec5f64098a7abc17c3370e8780e024a02c4b664b53a88cf574488d3b5496b2b7b9cd7cb0c338066f1ad", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703865, "uuid": "4a2ae4c8-3d0c-4307-8dce-dfa54c910d8a", "value": "T1B30250B6BBBD7288DC53B9B03DD2B607BE80BED13321BCE0145564F99E76A00A6645C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703865, "uuid": "e6393916-1735-41ca-94ca-f684049f72ac", "value": "192:1gUUl7ICOl7ICLl7ICol7ICTl7ICIBl7ICHl7ICxl7ICll7IC5l7IC6:1LUKrKyKRK6KNBKCKYKYKIK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772703865, "uuid": "c231cb4e-ad4d-4a39-ae77-efb26466f3f2", "value": 8650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772703865, "uuid": "68a209aa-16e9-47ff-b320-6163b57a1786", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772703865, "uuid": "a62c31fc-62ce-4a79-a826-ff98ead87fde", "value": "Soporte_Tecnico_Nahuel.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88df2295-18c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772736351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736351, "uuid": "ac414f87-6150-4743-b3e6-7a52268652da", "comment": "Malware payload (Vidar)", "value": "405956bbb3ff3f85698c7a83e743bac2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736351, "uuid": "37b2f39a-f2ce-4e34-954e-acd4f22abf0f", "comment": "Malware payload (Vidar)", "value": "f058c591eba924c5bd9d14e49faf7736216e56def403903243ad9ce74d9adeb4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736351, "uuid": "5769f98f-aa43-4fe1-9af5-7636ac68dd7e", "comment": "Malware payload (Vidar)", "value": "0c754a36f7624ad4a757b6fd22445e00f86147b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772736351, "uuid": "6bc8df37-99cf-490e-b07b-b6ae31d9890c", "comment": "Malware payload (Vidar)", "value": "2ce50bcaaba16970269aa39a92f66b8d81b5805095acd747a488c0e9d653e54c92e4455d077993e97faa6eb241b63fb3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736351, "uuid": "99a41e4d-de47-4bf1-9496-b98837d46b9e", "value": "T163C56B46ED915CE9C86E9335ACB756967B30BC580B3223E31B6676342FF27D06939308", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736351, "uuid": "80fc4a0d-83ad-4c47-9e94-fc227e6bd42b", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736351, "uuid": "fdcd199c-5a28-44a9-bc0b-dc8327cdf9cf", "value": "49152:LVPdzGdF52LD3kaf/qCj5sb7lwB349AVYlcB+awZl/CmLO0otz1:LVtoiKW67lyoCTz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772736351, "uuid": "6c9d9ba5-e103-4a89-b136-b724c7ab80ff", "value": 2660070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772736351, "uuid": "a2f0a279-6065-4b34-9a07-795857d48473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772736351, "uuid": "1557c068-5d61-4e2d-bf90-7089ea5b351a", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8261f21-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698179, "uuid": "b16f073a-c3cc-46f4-bb15-64fd5ffa5d80", "comment": "Malware payload", "value": "6c6d5e0e62404113f1e8083525c45645", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698179, "uuid": "7d1f97b3-5682-4c50-b990-e1d55335135b", "comment": "Malware payload", "value": "f0dcf60e6c9286f16a87cb8711f76e1f6c8643483b2c5b0741a2824d7375d6e3", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698179, "uuid": "96fdc5f4-8b7e-4486-ba80-5d414726f5ce", "comment": "Malware payload", "value": "330992a815066e4bdcdca9c4aeb555ce61cebb4e", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698179, "uuid": "22737060-6969-4b4d-8fd3-45e95fa40f61", "comment": "Malware payload", "value": "74eece3572f91eb4da6da975e967d72ece27103aa9eb8472804b29377e4734360f2a03092a0325138ffea6a5f0a5a2d8", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698179, "uuid": "6379008f-98cd-4685-abba-93bc9a79192a", "value": "T154052312FAA1FDABC90257321CD044E66546AC12C71EA12F3ED6376D64BBBA4F1C423D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698179, "uuid": "875d8863-ff76-456c-9f86-b65b068de9f8", "value": "12288:fAGtl1z3as93GhpsQYVngZG+CKjqL8Klxb+YiyeVld1vIxJMac:lX3P9qYdgY1LFrb/DQldKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698179, "uuid": "38b7a044-e45c-4a37-bf55-a36cbf8923d5", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698179, "uuid": "28845f7b-262c-46dd-b389-87dedfc7c920", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698179, "uuid": "e6680ff6-a7fd-4c05-8365-c95b218f687d", "value": "6c6d5e0e62404113f1e8083525c45645.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cebfec-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697581, "uuid": "ff49b662-be21-4a6a-91ee-d0537be4155d", "comment": "Malware payload", "value": "8f9e36291077198b1e534a4a1bbbca1b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697581, "uuid": "84e780f4-e3e0-4c8f-a23a-6b42aff2352d", "comment": "Malware payload", "value": "f18e7ce89629b6875a99f660bacd4d6b62e324f601d0faee4250cf446a0f7165", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697581, "uuid": "1354eb1d-3d83-4f32-be0d-1912a4de474f", "comment": "Malware payload", "value": "81c8e8b4ee58c97493eaf3b396ae713f03813191", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697581, "uuid": "1f76301b-1765-4843-92fa-719bfe6ce6e8", "comment": "Malware payload", "value": "43c8aa120d5548dec416ffe8875ed8a540b18eef0619c819a8ced9965d5cfd9fbca513ae55159820c94673a87cebcc32", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697581, "uuid": "986f7f6e-e7ba-4ec6-8f57-f624b50040d6", "value": "T1AC4518673B3774F039CE79C7291B0D758C64B8E9EAF46F1182AEAC3670E1985438B611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697581, "uuid": "9c591f18-01a6-4baf-8ff6-e5e0fe1d216a", "value": "192:pfVk+cxtdVKOoT3o6FUXah6baHzGaZ/DKawzUyWyAe7yNgCs1LzMOnsU0v1a:mV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697581, "uuid": "9da182ec-bcfb-4210-a48f-bbe4de92dfa1", "value": 1225405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697581, "uuid": "26758d7a-d551-4dca-b1a9-276247770ada", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697581, "uuid": "0d74da15-67f7-472f-9a91-b6cfb2131c23", "value": "8f9e36291077198b1e534a4a1bbbca1b.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbe0795-1842-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772680951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772680951, "uuid": "e1807b11-dbff-4b71-874f-2befea0951dc", "comment": "Malware payload (Joker)", "value": "682b3f88d5bf26d4693e30555b430ed8", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772680951, "uuid": "efe0173e-b364-432b-aede-f3b544159387", "comment": "Malware payload (Joker)", "value": "f19650ba92499d6fbcdb4f0d4215498b1bb4006746368cafd6969a95f732e9c2", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772680951, "uuid": "6cfad0d1-de30-4651-b99e-dbe7b72d27b4", "comment": "Malware payload (Joker)", "value": "fd0b47f53069360da647bfd1d62839f1cdcafe6b", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772680951, "uuid": "a98f0e47-4d90-461b-8410-ea042065c95b", "comment": "Malware payload (Joker)", "value": "dd1b58d6a8c9cf4939334fbd5def2c075479d0af8737bf156b986731837426bb57943ddd8b83225be23bbd240cc7c414", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772680951, "uuid": "57f140bf-8177-4e78-981f-c00d42bd5994", "value": "T19F27120DFF4DF82AD87B6079C95E8152723BAD9182808673712CB209ED736C79B197C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772680951, "uuid": "c446a919-7678-49af-8d09-17e08d9e6998", "value": "393216:QPLgX8zeJPkj7W/6S7uKgcsAkYNfZhJbMFCapb/qALCm6d:WLXzeNk+ySCKgcvJNhDMFBrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772680951, "uuid": "f6f8bc69-cb56-46ba-b66b-cc013072f667", "value": 22274569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772680951, "uuid": "b1457255-3efc-46f8-b834-4f86748bcaa7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772680951, "uuid": "6ccfc935-6469-4df7-8241-4d8779561289", "value": "com.cleaner.toolkit.phone_1.0.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd04e62-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772697947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697947, "uuid": "e8e2cb7c-4cf3-43de-80f0-964a7fa5cfef", "comment": "Malware payload (SnakeKeylogger)", "value": "134033289611af7078604b50f248ee0e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697947, "uuid": "50ca332c-9e47-44a0-98b6-26f70d754dd4", "comment": "Malware payload (SnakeKeylogger)", "value": "f1b6700c72533aafe400e8426a32647c44370589963c29030fc8231ab41d99ee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697947, "uuid": "0ffeca3d-c358-457d-95ed-e3acb38034a1", "comment": "Malware payload (SnakeKeylogger)", "value": "1049f832eca4e517298144dff8b4e77e8a57a46c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697947, "uuid": "5d21e1d9-e29b-49f4-971f-dba8c3654157", "comment": "Malware payload (SnakeKeylogger)", "value": "928f483480c4e56e2bde2d9b3e3c7048306f7480f9eabc1841e04d898359e957b69a62d8301a4d2bc3264016ac4b7db8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697947, "uuid": "6d7c36ca-a971-4125-9003-7aff67f169bb", "value": "T14E75AF13B7D13534AA6CA048D0BE081E0FF6DA6659157FF4AB213B2D1F82AC51F1BE19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697947, "uuid": "288d7651-35b4-4a97-be49-f3b574c464df", "value": "24576:6Mo4jKwQCFvEPOZa7f1Uzj5acakLSfqpiRea2QaVGk2i7IC1gHIIdd37f21bEXJu:q4jey0NC37XmHvd37ulknMFmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697947, "uuid": "fca26ec4-dbfc-46fd-9e7e-100df0c89431", "value": 1647643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697947, "uuid": "14f57113-8d34-4480-9964-aa4ba92cf6ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697947, "uuid": "a552ca59-809f-4893-934d-f2c23c335faa", "value": "134033289611af7078604b50f248ee0e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74637934-1881-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707970, "uuid": "81e3724e-af0a-4c62-a5ae-4ebd5cac73d4", "comment": "Malware payload", "value": "317b5508a4ee9cf07e0ce1a2c39635d0", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707970, "uuid": "cb983885-871c-4ad3-83c3-a16ca63cf62b", "comment": "Malware payload", "value": "f1ef7feda705fc6fbf306a62ca98128c0022538512e84a39a9b8bb6e1decef6d", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707970, "uuid": "87e9eb4c-49c4-4023-a91e-9e1ad75b7841", "comment": "Malware payload", "value": "9b4c4df1dee5cbb3197fd0738ffc4ce425e89664", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707970, "uuid": "d4f39263-84d7-4f57-bc3d-8b416491eb39", "comment": "Malware payload", "value": "0c89cb6ea1ee13791094b73306468d9ac0be41d5118c362bc5657da5169880a867907fd9c84ef79a4dc1ece99e671564", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707970, "uuid": "62b1a439-b692-4757-96ed-c6e34ff40add", "value": "T14091760369A808720B0B28FD8C6F7722A6365B0B52D2B936B11CA5AC5F0C126C0D779F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707970, "uuid": "40024639-2468-43c2-b052-3b0d496d8424", "value": "96:FEyQCtQCjQI7IpI35+ZnTuBZx32YujJHZTjfon0uyZkZZuz8YcWCZtVq70w8uF:ZQCtBUI7IpI35+ZnT+ZxmYUJHZTjf20R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707970, "uuid": "df1c1736-d297-479e-b5de-b49e713c4515", "value": 4576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707970, "uuid": "e8088f50-3a2d-4fa9-8efd-ef965d0183ec", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707970, "uuid": "b372af61-8699-4a38-9e65-88eb6831e545", "value": "CVE-2026-21902.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1028ef3-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772707723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707723, "uuid": "0d66e01f-5841-4329-ad82-0c6bef5c444c", "comment": "Malware payload (Mirai)", "value": "cdb7e44e0f23422f4faf7a76a6b90d5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707723, "uuid": "f8cee9dd-e1fd-43fe-9d51-5dda787c3fa1", "comment": "Malware payload (Mirai)", "value": "f2403958bb3da1135d903f87ba65389274557be48809d91969986f6f4a66a585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707723, "uuid": "ee5ea7ba-0649-4798-9ff3-7b22fa5d2900", "comment": "Malware payload (Mirai)", "value": "b2b2c106f901fa8ff3674e4b67fea2013788e253", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707723, "uuid": "62b1f79b-7c94-4344-9a74-0d7d7b53a0bb", "comment": "Malware payload (Mirai)", "value": "cc0f0b014185bb2938b13b166195af4a2814aacb867595bc91d8844f8a86aed3fdc05926b9126974822fe751fbd9c62f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707723, "uuid": "c01a665d-0c41-4401-b2ef-d2e1a621a1a7", "value": "T1E3A33A02B7180B43E15B0DB02D3F1BC1B3AADAC012F5B989795BAB46C1B1E771546EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707723, "uuid": "2f55d5aa-576b-4f94-acac-d3c96c0907ee", "value": "1536:Q8Pr0PMoxAeR1aZ0Qi4LBt4QQtPkYOT935OnU5hwbZnDF:Tjecm6ZlYc91bwbZnDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707723, "uuid": "789a76d0-c40d-4764-abe3-1117721608ec", "value": 100036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707723, "uuid": "1d4d96ee-3030-4ebc-9c4d-1ae154ea517a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707723, "uuid": "81d43d52-27ef-4e19-a2cc-9ccf2c3c2e38", "value": "5r3fqt67ew531has4231.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1904a4-1864-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772695394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695394, "uuid": "029b1f30-4e18-492c-a6f6-2a60c3cb190d", "comment": "Malware payload", "value": "36f94ec5083774e29b165bfc1c415c3d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695394, "uuid": "643246c1-adc9-459d-8bbc-000ccbfbd51b", "comment": "Malware payload", "value": "f27704629a4b9f59c0c17c892c783b874e750c3de4fbfb306e1712bceafcce7f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695394, "uuid": "f9a7be57-ca23-4a41-84fb-8bfeead882e7", "comment": "Malware payload", "value": "6e7350b807fc20098e6390d5ca6319da2374b446", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695394, "uuid": "4ae46e84-6321-453e-9d4d-e94884cf9d51", "comment": "Malware payload", "value": "ef88adb4c43205085785a7d9b835d57d729793acf5e1bae2654f35842d3954a81d0b803b93b9ad533c3bc6d0e810cc0c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695394, "uuid": "1c649d8d-d4b2-42d4-94cb-15b92255894a", "value": "T156118011DC0278E75F57B2F4CA131A18DCB9F93B4065A84DB714CD491E359F8B1607E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695394, "uuid": "48657ae1-8816-4f06-9bc7-4917d2600cab", "value": "24:KXnAKqahwAW2wc0K5NU9RGUimUwn/zii9nJswC9KVk6Uwn/zii9nJ7wC9vZ44:NBW50YNIGfmdJJC9KVk6dJkC9hT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695394, "uuid": "8371d664-7389-45aa-a190-933d1e7d797a", "value": 1102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695394, "uuid": "83322158-10a1-4f8c-90fd-1a697c433dbb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695394, "uuid": "c5f98713-f0c1-4618-a3f6-8df7b05eda6e", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2658ed27-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726737, "uuid": "57d74ff0-dc29-4732-ad4b-6604d9fda7ec", "comment": "Malware payload (Mirai)", "value": "dfcc31a96fb54ecc4cea54fc46e38590", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726737, "uuid": "398547cc-0a3b-4ddb-9107-fde52b966352", "comment": "Malware payload (Mirai)", "value": "f2b2dc3409b73beec0ba5a194bf0b43b17d504ce49723d0e68cf76f4a24516b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726737, "uuid": "98a0b4b6-7f7f-4e09-aa60-4214945655df", "comment": "Malware payload (Mirai)", "value": "13f80788ec511906d02e6e81c012d6c9af17e5c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726737, "uuid": "eaceabcf-02e8-44db-87d6-2635798ebd1c", "comment": "Malware payload (Mirai)", "value": "e01f1446f9f4f1de45cb7861a8028fe51879f34537ee9a808bb937791293e0571a14acb17c1c36090bb726e9902ab939", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726737, "uuid": "a25fe5fb-ebeb-4ece-8a85-2354f3b850b4", "value": "T1B3A33A82BC819A11CAC507B7FA2F108D330267A9F1DE7253CD151F64BBCA85F0D6BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726737, "uuid": "c725e59a-50d9-45ff-8ed0-fbd964942439", "value": "3072:CE0nHs2uE5OtQAURL4gzYqJsVT3MRmS4:JYHs2uEqQAwLJYTMRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726737, "uuid": "76745543-5ca2-4fa1-9d1f-2b3f0468d63a", "value": 100356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726737, "uuid": "93abdbeb-98f2-42d3-b193-2c8c8d007c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726737, "uuid": "95346f42-05ad-4cd7-9cbc-33b751ccbc36", "value": "MMaaRRiiOisecTanee.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c18bbb-1881-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772707973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707973, "uuid": "c9164940-f7b9-4325-aeda-5f8d9279665e", "comment": "Malware payload", "value": "b25fa7eddd166bd1cf1bae07e97c06ec", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707973, "uuid": "365f4c24-937d-432f-b287-9879d37a87a2", "comment": "Malware payload", "value": "f2d4913bebd5c9a33db70214dea70a5f9046d993bcdf7ca017e3f9194e796733", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707973, "uuid": "7a726170-614d-4d96-b969-628b6c9a89e0", "comment": "Malware payload", "value": "5a2a9aae9e1f26c3f32e6a5b8130d62dec19734d", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707973, "uuid": "a9e82fe4-29da-4996-afd5-1959b3b3d5ed", "comment": "Malware payload", "value": "fadea5f61c6501e30c6113a5eeb7e9ba2461f633d7b34f469fb610125da5929814ca8cb37d580972051927f241003950", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707973, "uuid": "d054b802-5fdc-4178-9a67-5f66c76baa17", "value": "T173D1200169A53450C3A79CAECD91A813B31F7C1702091C3979AE52D8AFA4675D3B4EFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707973, "uuid": "290c9388-180e-4714-85cf-321cfb88b1ea", "value": "96:aoape0vczwpJ4kbxCjH9HRrjk49PexhW60TRIit+i:a9c7jLBWx6N+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707973, "uuid": "8de708e8-364e-4da3-b959-58945c7a37ce", "value": 6640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707973, "uuid": "c5f41699-9f3f-468a-95ee-00aee89f6012", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707973, "uuid": "01bb5d24-310f-4e13-b9b9-dc987c0defc2", "value": "CVE-2026-24061.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0f5a78-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697570, "uuid": "77ebb5b9-0918-4489-84d1-1a0d580d4d31", "comment": "Malware payload", "value": "b96d0188eccccd5fd428453a713397fb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697570, "uuid": "2c84605e-ca4c-4bfa-a145-0615f536b293", "comment": "Malware payload", "value": "f314dab7649ea7c4475ae73c1502315a02dff896a78c72214ea9dd1cd405c300", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697570, "uuid": "749bbdde-a779-43fb-8a84-fb7b03d296dc", "comment": "Malware payload", "value": "6201145bb2df010495113edab27c73b18bad005f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697570, "uuid": "2d90f769-0677-4bcc-a49c-cf81f00cd5c5", "comment": "Malware payload", "value": "4943240bd79a9d485207f907d9d01ffa7f07d066ac3d78a4f372112cd63002a2cae3300a495bafb26de0fb16202618fc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697570, "uuid": "7c31adfa-7344-49aa-9fbd-d1431d93e944", "value": "T19ED502DC525D99B059B638231CCD7CA2F4F82A253E2A7414CF92E6E4509AD1F23B4EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697570, "uuid": "b4d0b2fc-669e-445e-b5c0-eba71d5062af", "value": "384:EJp8JSRHYBSsfMJgjPirNRIk9eEMPj/LOfZJ6B:Op8J4HGZfMLrN2k9RMPj/LOfZJ6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697570, "uuid": "d94db788-973c-47b4-8a5b-bf783ed32022", "value": 2950329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697570, "uuid": "115ff2df-8720-42a9-92e3-6c71088998d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697570, "uuid": "b6fd2ff0-4814-4bb8-b44c-e3c33dd4afba", "value": "Plugin_Planilha.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a45732-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772698169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698169, "uuid": "ade67f1d-84e5-4ad6-bef8-bcd71b6667ff", "comment": "Malware payload (PhantomStealer)", "value": "478e3e4c7ccccfb6024aaa14b4cb022e", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698169, "uuid": "da7da50c-4cfe-4c3b-8ed8-99ed033dc28a", "comment": "Malware payload (PhantomStealer)", "value": "f42d46aacd191bc4a61ca63ad4adb74898ba642054d981034a52a52199bef786", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698169, "uuid": "b37073ae-bc24-45e0-9400-8337aa8b8072", "comment": "Malware payload (PhantomStealer)", "value": "710b93f29f4d5a9f255c2939618b9b0685afe4e4", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698169, "uuid": "05d3fdc9-8509-4402-9a9a-9f5ac119f07b", "comment": "Malware payload (PhantomStealer)", "value": "de1891608b524fedf9db3eecbb653e4430448efd4051e551a8d5379a3473a8fde3035e99386ad693bc6d2601ea0bbf71", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698169, "uuid": "78a66cc8-32cb-43a0-891a-09330bf7149a", "value": "T10226C0912FDC1E99CBD18808E09926AF126186930CED7F49B311FFAF5853A4DC78166F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698169, "uuid": "a928f8e8-fca9-4e17-b91f-eed7aecf46df", "value": "24576:3EAQj6uB+3avpz+rOBlCV13cNMq+oVMMRkYw/SXP6QqzGzJff9rxsliyaN6JIkNI:UMMF/JKYf/DWLNvvZQXeOcplPp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698169, "uuid": "3b2b9272-4330-4d82-ae6a-d738f2aaa327", "value": 4604554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698169, "uuid": "8a879552-4f49-4dd3-924b-d309589a88fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698169, "uuid": "1537e9b5-0544-4434-9e44-28228c250133", "value": "478e3e4c7ccccfb6024aaa14b4cb022e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61712e5e-187b-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772705362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705362, "uuid": "781c8227-0580-4ea6-b4a1-5f74dfe1b66d", "comment": "Malware payload (PureLogsStealer)", "value": "9c79adcc038c37cb9153407004070fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705362, "uuid": "616ac75c-2cd0-4586-8825-d3912b80c53c", "comment": "Malware payload (PureLogsStealer)", "value": "f6180e106255132f780680c62d9ec6edb5b20cf805a56173c4aa45df04e6dc41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705362, "uuid": "6d19bd34-f6ea-436c-aae3-1d7ccb71fd03", "comment": "Malware payload (PureLogsStealer)", "value": "d28b42d6d78cb8848af9816c543186889daf8ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705362, "uuid": "e9ad3e98-b8d6-475d-a53c-4e8c08493409", "comment": "Malware payload (PureLogsStealer)", "value": "619e1c3d7774c3a5e4b8199dd1efb6800be68c293add0cb34d386f235246ac34ae69422e4c8c9fdf53fec65b8d38f9c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705362, "uuid": "7d95d31c-4b46-403a-8e9a-c626fe78780b", "value": "T141E633857329790EEACC807C9DE270D1CE271D28CB5D0D936BADD11F6836758C8B8A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705362, "uuid": "a6a9cd54-2513-4f0c-bc0c-60c9693f7576", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705362, "uuid": "a94384b1-588b-4c07-b5ca-4d073edecfd3", "value": "393216:qurKBVmOkAO12ouaZ8MOZ8phTTX/KiGPgkHoZx:3rAd7aZ8rZ8zQokHoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705362, "uuid": "c4fcff22-b38b-442f-bb6a-b3868552e831", "value": 14788608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705362, "uuid": "db09645a-2613-4aca-abf3-d4029203a721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705362, "uuid": "57aebbd8-d9d6-4c46-916a-566a93796be1", "value": "Installer_v1003_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f304a1-186b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772698339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698339, "uuid": "a0f8649f-aa08-4261-964e-0791daab82ff", "comment": "Malware payload (Mirai)", "value": "d8893e124a137ecc709da3fbe77b66af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698339, "uuid": "767abef3-6ad8-4030-bc61-18fca926e5fe", "comment": "Malware payload (Mirai)", "value": "f6e44e89ff63ed932dc4669423e468f9dec89174fb83b5806d2f4f567743f501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698339, "uuid": "a82abe89-27f5-4542-9628-5d9b7206052a", "comment": "Malware payload (Mirai)", "value": "0b62a84767d17cf62575fdacb1c5dfd7f1194207", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698339, "uuid": "7d4843f2-0ba2-4e5f-a88a-0e065173774f", "comment": "Malware payload (Mirai)", "value": "9b53b60e075c4ad8be926fa703a5e24f7edd75d4e2c90c8e2ac24fccf68e9fa55352a4a880270119f8c087fa8be65428", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698339, "uuid": "ae59fd32-79fa-4fa6-87db-4cce74b80646", "value": "T172F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698339, "uuid": "cf9ba536-7b2e-4b19-9b36-e4ba3f512346", "value": "1536:ZdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMp3En5p5M/LW:Z7vDtrnPTR71gmX7Dy7fMp3xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698339, "uuid": "d01aadba-2984-47cd-bb07-e0d7204d158f", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698339, "uuid": "5d653af8-ef46-4385-b8be-c6f20d038b77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698339, "uuid": "a8d66f47-c315-4576-ab5e-ea792f263d00", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56580f6-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772697798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697798, "uuid": "90e24084-5471-47e1-ac6b-6cfa0805f11c", "comment": "Malware payload (PhantomStealer)", "value": "ec57a3cd2ef8e086d504e21a76bb109e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697798, "uuid": "4c11e5f6-fd31-4606-8cc9-f0c084408d6f", "comment": "Malware payload (PhantomStealer)", "value": "f85b63dd4c5f303f9e9c0ceb75c0fede013542c12e13590f93c08ef6f316c048", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697798, "uuid": "46153ad4-a6ec-47e9-bb51-7bce1ba8d814", "comment": "Malware payload (PhantomStealer)", "value": "a55bfb77b83a071f2386f608d500d5a652d1f2e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697798, "uuid": "4ef6b25a-746c-4934-9d32-ef8da9426c5d", "comment": "Malware payload (PhantomStealer)", "value": "41f683e5cb53bef1caeb43305e8b2be8aa53ba1eee7effdc4da17b89ebc7dec52eca49efbcf153842ee82fdce0e61507", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697798, "uuid": "15ff680e-a550-4b4f-b39c-547533869734", "value": "T16726BF94C2CCABF9DE1CBF2940DD525B635194064F33464D3EE3BA8E7A73A2651603CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697798, "uuid": "4a88cb0f-7449-4066-9af8-335a7693b2fb", "value": "49152:xdxfiF5BMT3Y8S6HTUm9yQJmIgCAGbeo3eCwsdhVV3iQf:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697798, "uuid": "d7fa9fa0-f28f-4702-965e-24e3f64493d3", "value": 4599286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697798, "uuid": "f321b75b-0456-489a-adae-b270cb890859", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697798, "uuid": "aa8a076e-7a15-468a-b4c9-dd1fbf60da2c", "value": "ec57a3cd2ef8e086d504e21a76bb109e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660a6015-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772695061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695061, "uuid": "9c76a109-200e-410f-887e-5916e7f265bc", "comment": "Malware payload (Formbook)", "value": "37675e343d5be742b77ff7e17860744c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695061, "uuid": "36ad90a2-ecbd-42ac-bc15-1dd7fe9818a9", "comment": "Malware payload (Formbook)", "value": "f939ba21028cbd05c2312a6f62f3d54b4b01dbf3f7097c6258ff29a6451c6dee", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695061, "uuid": "ae67f836-cefe-49a8-b806-ac3187f4fd0d", "comment": "Malware payload (Formbook)", "value": "a6ca507f5ca596ec4fcceeabb21ec96f8b033b24", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772695061, "uuid": "cedaec91-ad7b-4240-8bbb-d463963859e4", "comment": "Malware payload (Formbook)", "value": "70fbf2865c9925731f29b2a3232dd0eb5fe37916594ddad3e8326f649dd9d9224a72aa0683a2dcb50922687a30810a7e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695061, "uuid": "d5bfc224-e64f-47d0-9f49-1c129092ef7a", "value": "T1F2C423735BC9BC7DD82D84F3A4437834B2158E4789347A66164B27DD4E2A48D870A2FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695061, "uuid": "400db8f7-0b93-47c9-8e51-898eb89e0c9f", "value": "12288:lktl/NXlQBkUK1DvgdebZlRps4euPbY/G1ZClt7voIxygNcpOWN:Ax6k71D4Yls4ebQCltrJWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772695061, "uuid": "883a14a6-5f50-46eb-809c-f05baaa555f2", "value": 550977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772695061, "uuid": "1c2b9214-56c0-40d0-8ebc-3c72997ce267", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772695061, "uuid": "3b049b3b-cf57-418c-ab4b-8e21affa7908", "value": "Packing Summary 563538D.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ecf4a8-1880-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772707416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707416, "uuid": "1beb8be5-447b-4da6-b7b1-f0836f9d0051", "comment": "Malware payload (ACRStealer)", "value": "37c6d40ea2ccfd5af15f160c89fd5cf2", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707416, "uuid": "e45f67c0-3836-40a2-8490-481641b336ee", "comment": "Malware payload (ACRStealer)", "value": "fa3cceac6cd95a0dbb19134c54c2d8d3727ee06c848df0456ed442bd451f2f73", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707416, "uuid": "bb57e05d-56c3-4da8-9bce-51168a9b9d49", "comment": "Malware payload (ACRStealer)", "value": "4ec955c586cff579f8e71fd2e5835fd45b9243aa", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772707416, "uuid": "6b8c9c53-5ddf-4b30-8233-b99fc253868a", "comment": "Malware payload (ACRStealer)", "value": "88ac98a651e4cdadfbc2597b6de329bd0e0d5a6b57ee41f508db602551fbb0f053ef14b1c6bfec0e9927c906c2771ba7", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707416, "uuid": "c665da38-46d0-4a80-b04c-6f2592d5a617", "value": "T176B73394DB6C4144E352DEB6A4CFBA3DA4E0C80A8B6AF05F5BA418416D533F51B0FB27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707416, "uuid": "1d68d901-0a6b-44f5-a488-73415ccd7f5f", "value": "786432:tvBhhkjWLX5v9TuVBHmuCU2ekJr7qNsoq64No7yMGBC7/bTiBRb1ziodyjUx9mS3:tvBhhBvNSMxRfNgsoqoUsfTiBR5FXjmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772707416, "uuid": "09c688d6-f38a-4ed8-96ec-ba9109a1d6cf", "value": 49378945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772707416, "uuid": "451f66b0-41f6-4d7e-abf4-a4feb682286b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772707416, "uuid": "c630742d-837d-4ea0-98d2-aa611ea77d45", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f800a168-18bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772734820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734820, "uuid": "39f397ac-92dd-4be7-b63e-3ec242c80805", "comment": "Malware payload (Mirai)", "value": "1cb5396e94736ac36774766f1705078d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734820, "uuid": "11f898c6-64dc-43e9-8692-cfaba2b9f9ad", "comment": "Malware payload (Mirai)", "value": "faadaac74225213e78bd610c1ecb834a5a44b83dd93d9b4ce40b4aaaa87746e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734820, "uuid": "36f17abd-77a8-4fc9-8d8e-2213078233e5", "comment": "Malware payload (Mirai)", "value": "2688916cd454300f11eb2e25c657aa1406ab0850", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734820, "uuid": "fef89319-66aa-4deb-a360-862b6c14e8f3", "comment": "Malware payload (Mirai)", "value": "efa4e6259163e827a8a33aa4a646c77414eb0be4408c83d2b4e4b8e10407d180822070a1b667a294a94829a3f5c46e68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734820, "uuid": "da6d632e-942d-4596-94a3-62a5b1678104", "value": "T13B231795BD809662C5E415B7FA5F428D7B2203B8E2DE73139D159B303BDBCA90EBB401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734820, "uuid": "d43f3ff2-b094-4e7c-b0ed-f2291c417f16", "value": "768:V6cX6+NXdX+6byMzPEbkPH6b9Hjlbj2cVbMm2Ebqv2qGNzKX+jUAfvYemMabRNOS:EcX64VHymikPg9HFj24MmxqvLT0z9abu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772734820, "uuid": "0daa599a-5bcd-4702-8b9c-7f1ef4f4bf57", "value": 47768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772734820, "uuid": "07fd06b4-d244-4224-aad2-90b34ec3fecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734820, "uuid": "3683c3f5-4c60-407f-a049-743045208e70", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba2e3c4-1863-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772694990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694990, "uuid": "cb863eb9-3389-4d3a-95ed-6f6417c4e6aa", "comment": "Malware payload (SalatStealer)", "value": "4950ff33406e803ac6a88ec1713afadc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694990, "uuid": "cd7b1315-d76d-4ce2-8b33-43b8e46dbf3a", "comment": "Malware payload (SalatStealer)", "value": "fb6f01b3737c81d467b20af90b069b622992d130a09fedc30985e498a9f3a46c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694990, "uuid": "ad4ba8ab-28c2-40b3-b2b7-59c4548a28ec", "comment": "Malware payload (SalatStealer)", "value": "f7d39249c624bcf37d1f7106dfb3bfb173239d0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772694990, "uuid": "bb5311b4-3e3a-4ea6-9ce8-ebc175c41d67", "comment": "Malware payload (SalatStealer)", "value": "0d0845b5e987368b78b858ac77a311f5691eb89f3a1044bb991d919852740bd303783139ef68cab3eeba58d6a1f39fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694990, "uuid": "d63d8301-a9db-44f7-b622-d252aad6701d", "value": "T1A2C64A11FA8B58F5E9031831415BB23F33355E048B28DBEBEB547F6AFC7B681196A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694990, "uuid": "0f120a8b-c1c2-4b91-aeae-14bf1b8bfa6b", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694990, "uuid": "818cffc7-5ced-4812-ad83-f527cb6556d3", "value": "49152:+vRVDkut9hMVoqRB1b2Ujz/DOvkUnlkpKPMhq7vANv+/0jLKq+T6JEpxO1FxUnSm:cvDkuWovIxq7m+/G6WJGgeeC++zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772694990, "uuid": "9cb87c4d-5b09-4537-832e-fc23d2a30ae8", "value": 11670016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772694990, "uuid": "7ca79b46-dc74-4911-becd-213c086677ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772694990, "uuid": "c9f83c75-8f32-4a7d-a0ce-2ada57ca2e06", "value": "6fb4745109e3d0b9a430011be1cdb4d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8307a4-187b-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772705326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705326, "uuid": "031d7e3a-33f4-4408-805c-c09257cb1db2", "comment": "Malware payload (PureLogsStealer)", "value": "9caf18c68d8ae022e242d0a2cb07edd6", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705326, "uuid": "2d1ee6d5-92c8-4656-87ab-12fc862bfd7e", "comment": "Malware payload (PureLogsStealer)", "value": "fbc0e4ee9167fa137e0e4a43eb903066e299007d26d3e6869be1ffaee6451f6b", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705326, "uuid": "948c226b-aac7-4d31-b284-5925ae6110b8", "comment": "Malware payload (PureLogsStealer)", "value": "b71e6d9dcc81e28ffa411ed7564fc66d8d1f386b", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772705326, "uuid": "e876bbdd-8e7a-4f98-be0a-de65abe41a4a", "comment": "Malware payload (PureLogsStealer)", "value": "d891aa8910ffc724f4d8da9fa8ca0d752d0909100803ebe3a418653a1bb4a386ad3a1096cb297e0dd5dae25fb5140e2f", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705326, "uuid": "b9711fb8-835d-43b6-9885-ce0d4703f919", "value": "T145E633857329790EEADC807C5DE270D1CE271D28CB6D0D933BADD01B6A37658C8B8676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705326, "uuid": "4f19c67e-ea48-4a54-9794-13a5c262ba9d", "value": "393216:8urKBVmOkAO12ouaZ8MOZ8phTTX/KiGPgkHoZx:hrAd7aZ8rZ8zQokHoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772705326, "uuid": "7e61a4ae-086d-42ef-9a11-1cb1b78ae6d9", "value": 14841856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772705326, "uuid": "9836f3c4-3014-4c9e-a87e-c42a1a30df3e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772705326, "uuid": "971607f3-02cd-48c9-97ab-e2db76da2607", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c6de88-186a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772698071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698071, "uuid": "4025ebee-d76d-4375-a442-83441f8ccc21", "comment": "Malware payload (RemcosRAT)", "value": "314ab2acb697a0d60c776232fb92e3a8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698071, "uuid": "cbf47493-5ee3-450d-8794-b08d5f2a12c6", "comment": "Malware payload (RemcosRAT)", "value": "fc08a4325f2d1b55116fed1582a593f4fb9e53b8c1605029b2288f3870e16418", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698071, "uuid": "e1609db2-bce3-4780-80b0-7c90d60b2168", "comment": "Malware payload (RemcosRAT)", "value": "ff20782a9ab91816ad9aaa6a94f76de5582720d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698071, "uuid": "a935c6e5-0dcf-404c-b4b4-433fb2301ed6", "comment": "Malware payload (RemcosRAT)", "value": "e4fe1b9f4f2fff7fb4f016782314b1eb26550c718f5478053da978ed5ba0ca9fa2ff4ffa9796703ca72645752b699186", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698071, "uuid": "a56d0235-2bb3-4b5b-844b-60ecd44f5d82", "value": "T1EC450AD6C3772A96424DB704B495B111EEBF64F02A57003E275EB2FBD48B94AC1BED20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698071, "uuid": "8f7d3b29-3b02-4bc7-8744-f8fc938e1c30", "value": "384:G8QOiZnaaANXEL0EpGgePhW9RpCupHo6EvW3S0i/GqUHYEv+NRVEOjPCPQIwXH3M:fr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698071, "uuid": "6ba8bfbd-b1cf-420c-8f65-aae0c667d1b4", "value": 1221411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698071, "uuid": "01b75965-2502-4715-9ad8-83b90d2e825d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698071, "uuid": "8b18a8f5-0c63-4d36-b545-71424a8ef936", "value": "314ab2acb697a0d60c776232fb92e3a8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2aef65-1869-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772697783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697783, "uuid": "30079b10-f997-4ac8-93eb-5f7e3cae36a9", "comment": "Malware payload", "value": "6cb2176b05f8fc25576c324067f129c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697783, "uuid": "a405f939-fe60-434b-b1c6-9b2e4a794da4", "comment": "Malware payload", "value": "fc46724a74c92493a54f03115fef8540b7a16d77464d97cf42fd900f3993a67b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697783, "uuid": "184d3a14-fa94-49bf-98f9-74d95f659b3e", "comment": "Malware payload", "value": "9f220a17e5580195d4bc639e1a9d4c93aca8dc77", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697783, "uuid": "a7bc1167-4f0b-4648-9803-abc9b952b973", "comment": "Malware payload", "value": "5577bd25358923149569fdfcf82613b90f776fd5eff7c312eed39f2efb6c8b35ab3410ee7f9017381d25edc83e22dc4d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697783, "uuid": "139c36d0-f0a9-41e2-9216-934075b12a50", "value": "T1EAB59F8A48DD259C9DB9732D11FB80441F1A44E3C621A5DC9D6FF72EB7AA8C2139E307", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697783, "uuid": "8a30c1ae-a882-4fa7-bbcb-00e59c5fc629", "value": "24576:0dawVBDcWUqcw12coHvCNSjPZZuC+wBnJ8LkWdn/ajxeSzO4bGLodxNirmVC0Uzb:G0ba3p6+a7WKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697783, "uuid": "2dcd7242-d0ca-4637-ae81-8cd5c2c02fb6", "value": 2290658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697783, "uuid": "80c3c1d9-d329-4ac4-a257-f7a0f96a69a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697783, "uuid": "753715fb-8825-4712-a44f-d4833508443e", "value": "6cb2176b05f8fc25576c324067f129c7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17124b5f-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772697506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697506, "uuid": "07f0e1c8-e21d-4219-8701-bd3ff5ca449e", "comment": "Malware payload (XWorm)", "value": "e425ae44d783ad1872d75bd3ebc0f5a6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697506, "uuid": "0ec3fa87-8ce5-49f3-9a09-bae15fc9ebe1", "comment": "Malware payload (XWorm)", "value": "fca13027c7afb6d3eb54b704189f974aba0a8bc088209936270e4a11e6a826de", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697506, "uuid": "d1adfee4-874e-417a-98e8-c8212604394e", "comment": "Malware payload (XWorm)", "value": "e1567148bfe657f5e62293c233a4072765aaf7a1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697506, "uuid": "086a9822-8c75-4554-8fc9-39803b3af2b7", "comment": "Malware payload (XWorm)", "value": "1d0ccb69223894549c8842fa59461974c6d468161ca8a65c6f75a9a59aeb5055eb5b971f40038ad6c365f18eac497a3a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697506, "uuid": "eafab3bc-4de6-4216-b66c-97691570359d", "value": "T13F82A52A8D19DFF0067E3152B5AB681669100366F939295D3C4FC5AD3F3A954CFE00EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697506, "uuid": "4456ea48-834e-4b86-b2fe-88630fad62ff", "value": "384:KATdGphUvfTM2f0MNO7dNDwkshDiUf+k87sTYm4mXl455v1lHG:KABSILcjSxn824plHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697506, "uuid": "020b8d1e-569a-4bcd-8a38-4c710217f40e", "value": 17730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697506, "uuid": "0550a2a1-537f-4acf-9381-e0bece3007b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697506, "uuid": "173f541d-2b09-481b-867b-f752216e370d", "value": "e425ae44d783ad1872d75bd3ebc0f5a6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3806f9-186a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772698164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698164, "uuid": "796b3277-64ad-40dd-8420-7a2296a1f417", "comment": "Malware payload", "value": "feb23811886920bf35b414ff3120ff8d", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698164, "uuid": "e9396978-56bd-4e5f-ac0f-1a35e9bd2728", "comment": "Malware payload", "value": "fd136b7a709eba27b7ae4fc976999cca36388e93e41ef6469d4f2f0f30abf85b", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698164, "uuid": "cf0dcbd3-b80f-4ed2-a458-00e8772d9d96", "comment": "Malware payload", "value": "e331e2808b6607d97b2237d06846ae12132bab33", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772698164, "uuid": "6fa310f1-7277-4639-bbc9-015e328cca5c", "comment": "Malware payload", "value": "5c02be26f6a5e0eb45764b3635c8413218f4ce3fd383639d3ba1f147f589234a08c5e68d6e28c4bbed3f37899dee12b9", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698164, "uuid": "b4b43c4a-7eec-4101-b416-0066ffe79866", "value": "T1BCF225D5DEACAC76D0974E93B64F2C608CDC7D51BE44309C43E1E8C9C9886726C6EA1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698164, "uuid": "74b76f39-4f1d-499e-a51c-7848dacf5c55", "value": "768:ckkK5KAfeRvGMo2R9JTNwSR84nFDo0NlPRKPvnnQi19QD1gvamlV6loff9hPE8e:ckkK5KOeRvGMo2DJTNwSR84nFDo0NlP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772698164, "uuid": "105513ef-f59e-42bb-a4d7-6f41ffdb71ad", "value": 35793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772698164, "uuid": "0ce12400-2518-4b6d-ba73-2367ddda8000", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772698164, "uuid": "880fc905-e119-4992-b19f-84323ed4405c", "value": "feb23811886920bf35b414ff3120ff8d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b813bae7-18bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772734713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734713, "uuid": "b6446888-0ca3-46a9-a962-f0e289054636", "comment": "Malware payload", "value": "33726eb505b3be15cd07e5f52280a759", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734713, "uuid": "52987834-9f7d-4667-918c-cd97d224d037", "comment": "Malware payload", "value": "fd9f68651ab421a396a4937396aee15be15432de62733ec5bd892d5b913d531c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734713, "uuid": "db09e3a4-5dbb-4a33-b8a8-d9e9bc308941", "comment": "Malware payload", "value": "1b3fc420a9558cab3b48dbf37aa4f65ed564dc7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772734713, "uuid": "095e9cef-e031-46be-b98e-7ce1fea7a45f", "comment": "Malware payload", "value": "8f103fd440be0e4eeabacf5105eccd4f11025604fc64bd3419d2b194f6335bc6fa237b8af2c91fa0325daa47b892920e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734713, "uuid": "5fb7ec26-ac01-4470-966f-4a96c61c22f9", "value": "T1C453C85E6E618FECF7ACC33447B799216359338633E09689E29CD6105F6024D681FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734713, "uuid": "75be8194-f2a2-48b4-a23f-37ed62966206", "value": "1536:lq5RThRNhRhR/RuhRF25t0JQ0oaeHkncHnK:0tSQ0ouncq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772734713, "uuid": "9042e375-4f37-40c2-9e2d-7fba1c95f6ff", "value": 61292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772734713, "uuid": "b70e8041-ff39-424e-ad5a-877c8e071bfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772734713, "uuid": "a14fa3a0-6b93-47c7-94a7-3c9882bac19f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf149c02-18b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772729141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729141, "uuid": "24bbb331-75d3-4308-9ed2-a7116cd704ff", "comment": "Malware payload (Mirai)", "value": "debed8cda41974d81ed90cb204e185ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729141, "uuid": "95d4c5e2-1041-4b35-87f4-cce6531db97e", "comment": "Malware payload (Mirai)", "value": "fda1b5765429ca0c88b49c4e1a749228909c33447224871859c01d548be288a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729141, "uuid": "e64bacd9-d2e3-49f6-8e75-940bf1a8f287", "comment": "Malware payload (Mirai)", "value": "02a7af71c426154d25f73ba86ac15c3b84d8787f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772729141, "uuid": "0699fc24-34fc-4575-aacc-32b7a47c3074", "comment": "Malware payload (Mirai)", "value": "0871cca94a42d6b5bdb7c8f9b5cdb0bda1e1edab6fb1b4126de5e3b80f6ff4b90625892c14ffac959921fcb1d9a96d54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729141, "uuid": "e1593891-7ee4-496b-8f34-133032e73a41", "value": "T13453831AAF650FFBEC6BCD3745A91B49349C640A12E93B367934C818BA5B20F45E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729141, "uuid": "da88b25a-9664-4b4b-8218-8e581b0296c3", "value": "1536:yGtQ8AKyjOz8lIkDXUAF4MSL3bKL2LZgsF8qD:yM6KyazQ1DU8L2LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772729141, "uuid": "61df4e87-d444-4836-bf68-16a7fbc6543a", "value": 64380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772729141, "uuid": "213532c3-a386-4f9d-91b7-698d3a52f1f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772729141, "uuid": "badc4888-b9a3-46c1-8346-ef27927d0ed2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212f60e4-18ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772726729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726729, "uuid": "cda5ae5f-1a40-4dda-8ff6-4309aebed543", "comment": "Malware payload (Mirai)", "value": "0257c05ffcb375940e2e095af6148f9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726729, "uuid": "433a1d5f-08ee-44ff-afd5-3db39477b6a6", "comment": "Malware payload (Mirai)", "value": "feece25968226c60293663e1c1b134ec1aacbd8a3e5c998618cde8a1b995593b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726729, "uuid": "2dbfa450-7b2f-4056-8f6d-112ed5c34166", "comment": "Malware payload (Mirai)", "value": "bba0eec0881a28106580c3d839fd05c5907cbb31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772726729, "uuid": "3cfb5d80-61b5-4e6c-86c4-60a92fdf2033", "comment": "Malware payload (Mirai)", "value": "3a463b7dc7843ef6be4a20830a5d20dc1377ae4dbb28119932fcf98ad01fc447b5767457b9292c28c60297510a57d9f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726729, "uuid": "6b4cd67a-5eb0-4014-82d8-d8c49fc58dab", "value": "T1079329791945F22CDAE65039F45329D629220A083FDCD2E369C3047AFF74B88B16DE5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726729, "uuid": "b6640e2c-acec-4a9f-bfbc-ff3fcb03a0a3", "value": "1536:r/t3w7cz3KPfDsFElwBLlNBwUBcEKLvNUIV/NVBIVCCfy0K9eleQ9:27czUsFlNBwtJvNZuNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772726729, "uuid": "9be3410e-1d25-4926-b4f0-23a0e29eb934", "value": 91524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772726729, "uuid": "abb92de1-d7d3-4408-9860-41c8d9ce76bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772726729, "uuid": "5a21c9d9-03b8-41dd-a411-339abe8fd582", "value": "MMaaRRiiOisecTanee.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9000cd61-1869-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772697709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697709, "uuid": "bf7ce83b-cc8b-4400-90da-58209fa8d1c3", "comment": "Malware payload (VIPKeylogger)", "value": "1bfc24d873c11c05e35a3a1db01b5768", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697709, "uuid": "1bac29de-d01b-4c3c-9e9c-36fe9003513d", "comment": "Malware payload (VIPKeylogger)", "value": "ff06f74b3eaf2232c7886259f8fbca54f5e6ab944027b9449f77c7279958416c", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697709, "uuid": "b8ac070d-7d61-487f-b103-ce19c4bd7456", "comment": "Malware payload (VIPKeylogger)", "value": "d2cf720f1459353e1cbd25993b848a071dc9585e", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772697709, "uuid": "5140250e-9885-4d80-8984-0c27eda9d46e", "comment": "Malware payload (VIPKeylogger)", "value": "3270199c4449b188d0f06c1018a3839925bd8a14eef6556b9155a38977cc955111e4fa626359833a71399ffde895d534", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697709, "uuid": "35a63c3c-1402-4367-9970-e4e9693cd246", "value": "T19A4523241423C8B90A1E1700DB73026ECF8BE46B65BB6069DD3D89FFDD312582A715EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697709, "uuid": "ac70ac9c-1955-4961-9152-758fb340dce9", "value": "96:L55555555555555555555555555555555555555555555555555555555555555w:WTQFeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772697709, "uuid": "989f66ff-e082-4330-ada6-522714744751", "value": 1200138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772697709, "uuid": "3044f573-457b-49db-8c7a-90381e12a392", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772697709, "uuid": "af54a66f-0f21-473b-a01a-9f06eddda83b", "value": "1bfc24d873c11c05e35a3a1db01b5768.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d582121c-1890-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772714576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714576, "uuid": "2ed3403d-6e93-4365-8cb1-f3485ab0c6ee", "comment": "Malware payload", "value": "1d267b11df4cbf6bfb43364bdda20799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714576, "uuid": "8ed00e6e-ef9c-479a-8454-89b135cb474e", "comment": "Malware payload", "value": "ff8532b52c5d68cc45710dace36a2b9ac317159ba2cefd8e1c78269e1d13afab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714576, "uuid": "28df5377-42b6-4c14-af72-780f7fd10471", "comment": "Malware payload", "value": "b9a521c3c49e4b6db0dd975703df2bfabba7c2c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772714576, "uuid": "8139d8a0-a393-4ef1-8801-51e42d599b2b", "comment": "Malware payload", "value": "fb994dcd77512600dbb0874b8df65de6b20ed7bb0df6a59fbafae7bb95c7bc7f7b4407b72147aeb3ec5a29b6598519b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714576, "uuid": "4419991a-9d07-4651-884f-1b3951ae57fa", "value": "T1DED6C056E2F900E8D97BC0B8C6575517EBB1384917309BEB56A48A692F33FE06E3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714576, "uuid": "6403aae0-f363-4a88-8d10-1a1c49bd8e04", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714576, "uuid": "c6ebfd0a-73b3-4e03-b0a7-54a46e80c376", "value": "196608:Ozp5XkrKI1dc95LhNG5GC+FkI6uBh7X04uu0/RDsM:OzfaihPdWInBh7X0K0pD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772714576, "uuid": "20ff6ddd-839e-42df-9a45-03d51946e281", "value": 12649152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772714576, "uuid": "336545f0-5170-4287-a8d5-c1092a5cb003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772714576, "uuid": "2e090bbc-9dcd-429a-b81f-cb72afc277b8", "value": "ConsoleApp1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcac1d3d-18d9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772745887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772745887, "uuid": "b314f1c7-7925-4bc1-997e-348d61912404", "comment": "Malware payload (LummaStealer)", "value": "700f01682e621398d0fa106351351ed0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772745887, "uuid": "70b0a7f9-2de5-4aba-add8-e4aff0b4e6f3", "comment": "Malware payload (LummaStealer)", "value": "ffbf90c8152aa811d239198cad7f125eaf141bb431c55215431895808fdad7c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772745887, "uuid": "da635977-2d21-4347-9758-c20ea0ddf41f", "comment": "Malware payload (LummaStealer)", "value": "127064e41ddcdfe6b913d5523ed381f621000d4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772745887, "uuid": "da47d1bd-d69c-470b-b08b-a442a90f2c7b", "comment": "Malware payload (LummaStealer)", "value": "b72374ec8817ce6920446fb50c5aea2ccf60611f4e1e70c362ec05dddee2d31f7111db593487f5b2aa9ba49442a80656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772745887, "uuid": "3dab585e-3649-4db8-94e6-713750ea3e12", "value": "T1BEE53B72BA09A1CFD88E1774D927CEA7D95D03B94B1049C7EC5CA47A7E63CC111BAC28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772745887, "uuid": "06361a12-f719-41e5-8892-8ce9a3e88d09", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772745887, "uuid": "a984f961-910a-46ed-a617-6a6a27516937", "value": "49152:vLy78p4fDfQf8NSCGLjFfZl55Wvv+Qs5MMzx5wh61m:vX6fDfQf8NSCGLhf55W6MMzAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772745887, "uuid": "0d5c1cd5-29eb-44f3-bc2d-d909dae1f307", "value": 3173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772745887, "uuid": "52166ac3-56c1-4935-9683-480b541ddd79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772745887, "uuid": "ce18c73b-d8cf-42c8-98a7-6b9695c86320", "value": "ffbf90c8152aa811d239198cad7f125eaf141bb431c55215431895808fdad7c2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }