{ "Event": { "published": true, "date": "2026-05-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-18", "timestamp": 1779148981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "cb3bed46-3fc0-40ad-a719-d66bf3b23d00", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9fc39c-5255-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779066096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066096, "uuid": "ed11d7da-7d44-4cec-83d8-a11c1241133b", "comment": "Malware payload", "value": "b4f6ed37b0af6222fcb281f01506ce8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066096, "uuid": "ff910a2c-5e31-4545-a849-64e2e80b9ea6", "comment": "Malware payload", "value": "0094c9465c7e996fad0b14db7e2b23132e8f1e114b22c98e0e265122a7507822", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066096, "uuid": "b245b0df-da9f-44be-9a85-bccc36f8c42b", "comment": "Malware payload", "value": "0a7c030ba42e04b4798c62151b73f31947632e37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066096, "uuid": "0d8f4452-f53c-49a3-9599-8f060390759f", "comment": "Malware payload", "value": "babf0814ef3bcbe22f938833cf74d425f02078110c436fa32cfe0c1ba948b1222457b4f73086a0b4e914ba0febb15549", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066096, "uuid": "d7b055d6-f724-4453-a553-d15af19bdade", "value": "T10827CE77814338E9E5A98DB4D41025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066096, "uuid": "4e03ddee-514c-4583-93aa-894cc66022d4", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQI:cqYUQuVDt0TZE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779066096, "uuid": "fff5a8b6-242b-4f95-ad78-27c414d401aa", "value": 20840448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779066096, "uuid": "fb318360-e28b-4fa2-a7b8-f0bc43b89bfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066096, "uuid": "4672e093-c72d-482e-8b7e-eedb443504d6", "value": "0094c9465c7e996fad0b14db7e2b23132e8f1e114b22c98e0e265122a7507822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54825c8f-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1779089809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089809, "uuid": "f8ca408e-a33a-4411-8623-d8d3cad088a4", "comment": "Malware payload (OffLoader)", "value": "20530d4a5415ab528bc69b3e97434efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089809, "uuid": "ccdea36a-7f32-4402-a11d-51c9b8f8b371", "comment": "Malware payload (OffLoader)", "value": "00db15cb180d1cfffebffc9765dd8a6e2055cd90da8f8b5cba251a084622dfe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089809, "uuid": "7c023782-2403-4afc-8770-a3910a0837a2", "comment": "Malware payload (OffLoader)", "value": "ef82a7b9b012ee102bea1c17d848f9ad683163fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089809, "uuid": "a35978af-4d45-4da8-bff6-a1cc0a525590", "comment": "Malware payload (OffLoader)", "value": "1b14e9fc6ecfb5b900280def486a58212549600209b96b6c7786a46a7de8bc3a3e703efec66ee6e971a7944f221d3f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089809, "uuid": "6c9281b1-2a39-4031-82cb-a2ef05ea1ad7", "value": "T1ADA5D03BF28BA53EE06A1A367A72E110543B7A2165164C1696ECF88CCF751701E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089809, "uuid": "c1a3bff3-6d7e-4fb8-95ac-245e82226787", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089809, "uuid": "dce5e494-f2db-4fe1-b36a-15d412a61bd9", "value": "49152:RuI2h3Uyun/ggS76zvJO5WImt0XDR6KG4VqYqd:R5OEX/gL7kBO5WIw0XDR6PktK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089809, "uuid": "77cde6d6-98c6-4c48-b7a8-aac1df91dd4d", "value": 2097757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089809, "uuid": "a6d5764d-e199-413f-80a0-0d2935a38fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089809, "uuid": "819c66d4-a5ca-4af9-b230-fefb443c4a29", "value": "20530d4a5415ab528bc69b3e97434efb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca668b6-52d7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779122303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122303, "uuid": "4a3bc381-9b1a-4f10-a36b-90f95cad21f7", "comment": "Malware payload (RemusStealer)", "value": "aaf3cae6b7caf11761e62feff31a2e73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122303, "uuid": "787d2a74-cc1b-4999-803f-366b33ec1dab", "comment": "Malware payload (RemusStealer)", "value": "01204e3b31b0b173ffccce27e40ebcb6c1c54debfa64973b160dd31a819e8795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122303, "uuid": "105b67ac-b3aa-4be1-a77b-d9434d744478", "comment": "Malware payload (RemusStealer)", "value": "b017190733a26cbd34d5c4d5f73b00e210e78950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122303, "uuid": "37826a25-99d5-445b-b017-1e4ab3953255", "comment": "Malware payload (RemusStealer)", "value": "1224a70c9f3b4494cb28bc0d297a3db93917afc1a6fa07988c40bb380d3093b2069fe3143cfc8bda4aab1c3ef31cef92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122303, "uuid": "babc74b8-7d2e-4310-8a49-da90faba6043", "value": "T1D1D55B03B89208F4D0D6EA39C5296052FE22B8885B3477D31E54B9752F3F7D0ABBA715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122303, "uuid": "86a5f59e-3a1c-44fd-bc52-1cbb539d79bb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122303, "uuid": "ea42b6e1-3ae5-4729-8a61-0125867f29d8", "value": "49152:iPZJbvlWBfHN3lbZIIJGVezx87mE6/P0+yVdqHSOwkpczcFuOxWv/JIqWvESvHjB:iPHG/N3rIIJGVD7mE6/P0+yVdqHSOwkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779122303, "uuid": "4e9b3e0e-f829-4d0a-853b-dcaef81b817f", "value": 2856104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779122303, "uuid": "52993aea-d967-465b-9a87-369a03bbb032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122303, "uuid": "8fb7926b-5cc1-4f14-a400-77dcefa1385b", "value": "WW26A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1bc90e-52b2-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1779106193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106193, "uuid": "a7793e24-255a-4d2e-9ae0-d80fcf432b14", "comment": "Malware payload (DarkTortilla)", "value": "ad9f81e2070086067bc1258628168564", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106193, "uuid": "5236ca09-9b0c-467d-8b94-e0242ff2b354", "comment": "Malware payload (DarkTortilla)", "value": "013d5174db983647a5e7af748aeec5dd60f01865e8e23ad3570339e01cf4be2e", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106193, "uuid": "3cc595ce-94b3-4714-b50e-36100bda3586", "comment": "Malware payload (DarkTortilla)", "value": "314276a16ad8e9c3f5f948f3756dde1975796319", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106193, "uuid": "29d5f758-9650-4c84-b3da-a967c82cb992", "comment": "Malware payload (DarkTortilla)", "value": "ae7922000496724105e9e4305dbcfd84c3b41cbdd17f74227f1c4c5d148782f0324a6c2da68ebac681e737562935ac1a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106193, "uuid": "98056975-b369-411d-8e42-1f49a7a3fec3", "value": "T13415333895F8624D1A0DF2EAB9D53A2AAED3106CB827E2370C2C314781DF5F459365DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106193, "uuid": "ac70cb6a-6b8c-4241-8ff1-2960c70f8daa", "value": "24576:80nXazc1t1c72RPrQRxoU9/j+8mHwPnCmCbAOE92p:80801o2RPU19/jXekwEAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779106193, "uuid": "4676e903-bfbc-4fbf-9b81-a7bddf5a50f6", "value": 942099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779106193, "uuid": "276cb5e4-341f-4ec4-a31e-b90a94d1d2b4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106193, "uuid": "e3e17541-e55a-48cc-a620-858aa23ad659", "value": "COTIZACION PARA Q3_ELECTROMECANICOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e386e62c-52ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779130421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130421, "uuid": "925924a4-78cc-4be1-9a99-cfb6e18be8bd", "comment": "Malware payload", "value": "0df4fe0f1e3e8b0941f0d1442f132700", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130421, "uuid": "2c771ede-da89-474d-a8bd-6f9435ba062a", "comment": "Malware payload", "value": "03145a920ea47b6fa8f4e56640baaaef3c0355f1fde7356edb5dde99a44d29bf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130421, "uuid": "b06c0e2d-730e-4772-b4f5-021a6eec548d", "comment": "Malware payload", "value": "3ee4dd936dcdc8a3c7566569a64ab854ecb39e6c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130421, "uuid": "0ffbceee-e0ed-47a8-aed6-ebd17e874c10", "comment": "Malware payload", "value": "37ecdd1193d0ea6867283c1384535ba7afda1a160fc097d4dfc4d91ee05fa8695edd5db8137cd8801e77723e2b386fe7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130421, "uuid": "463f770a-23de-42ed-8636-67f07ce3a5c6", "value": "T1D84124BAF4628E30336DC5BC7589254CA7579AAF49162E74F087B43C37BC3647074295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130421, "uuid": "c244c26c-3555-4b59-aeb7-d6784d048479", "value": "48:vkwvpihneZZn1oBydXhEtonmzEvJGU6ljiPq2MTCki:vkwYheZZK8a2mzIj6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779130421, "uuid": "ceb47fe0-f963-480b-be2d-b5615f7e81d3", "value": 2079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779130421, "uuid": "e3557afd-2854-4986-9712-dc665b4141df", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130421, "uuid": "380be944-d613-4f13-8ca6-2e48bc07377c", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d59b3fe-52b2-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1779106171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106171, "uuid": "38fe2cb6-c9b5-4b84-ab58-9a982f1fc6eb", "comment": "Malware payload (DarkTortilla)", "value": "b543c1b57fcb65562eaca589650415f5", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106171, "uuid": "455852e2-7341-4f67-a47a-9bfa22c76b26", "comment": "Malware payload (DarkTortilla)", "value": "034cf72ffacee3d03aacd2514b7f877186deb5a4333da129029f837b69e18638", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106171, "uuid": "f0f30d8a-9367-454f-ad87-88d2fa91d47e", "comment": "Malware payload (DarkTortilla)", "value": "abe4a2549069d298b9edbb5d78b44c2192dbfd8f", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106171, "uuid": "d44df216-9344-4543-a36f-42cc75cb1b4c", "comment": "Malware payload (DarkTortilla)", "value": "9ddff7d86f2d102143b37d9a40ee6956ad8a23029b031e53bb1773f68af10077bce909f8c89235bfa2cb4c7cacb6bad2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106171, "uuid": "c32d2506-61e2-4d9a-be2d-fc906138712c", "value": "T14135F1185A8A2F5AD92E0FBDC1220459B7F4C857938BE76B6FEC80F47973B84CD06512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106171, "uuid": "e2d95ac9-95ed-4180-bcdb-e68623cebbb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106171, "uuid": "588c1b0a-cdd7-47b8-8308-00ce6a8c8a56", "value": "24576:CK+BeGJcUoZNKedcYIesRiVZus+TCuX9S9FbCo60LP:Q4moCeQsQ9FV0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779106171, "uuid": "190b7376-a3b5-4295-92c9-f6f618da7e29", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779106171, "uuid": "d4c63e29-9edd-4390-80e7-1df368cb5eaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106171, "uuid": "ab59b814-de44-4e66-bdb4-846ab64467b4", "value": "AMESA_COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9c7a99-52e4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779127509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127509, "uuid": "53274ff9-f275-4a0e-8d86-ed04ce103f64", "comment": "Malware payload (RemusStealer)", "value": "a83629b9a8d201b33161d5ecf91c0450", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127509, "uuid": "06fb6364-1be0-46c6-8693-c8431583b45d", "comment": "Malware payload (RemusStealer)", "value": "046c1a3e24743695f98a8cadba113d5f282dd9819f46b81b7d2950ec5f67d09f", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127509, "uuid": "391c96ca-c589-400a-83d7-981cfdb08f20", "comment": "Malware payload (RemusStealer)", "value": "38d0d9cfa48d61b89edf555a224974d251d5052d", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127509, "uuid": "090b9902-3758-411f-811e-112ed6a796d2", "comment": "Malware payload (RemusStealer)", "value": "daafecb3559075aae336806557acec6bc89ffbe457e9db0091c20e33771f6d153b5e72faad91123c52cad1e13a497cfc", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127509, "uuid": "73fbc181-0ffc-4385-9ad5-9bbe82a7e40b", "value": "T13BE54C42B46418FCC0ADBA3558E67C41AF203404A73567A74BA32EA06F777D25DB2B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127509, "uuid": "a450a0ac-ccb1-4d32-b3dd-bfb4db2e4341", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127509, "uuid": "eb798658-3362-4f58-b82f-e6d0083c79da", "value": "24576:urNpCfOAhTyPFGPSTTcvP20LiOdtFhpL/FF6tR3U43Gp8YltPScYt+:urNQfOAhTyPFGMP0Nlhp5sk4Yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779127509, "uuid": "ea202f13-5f99-4d80-97f9-4d8ff50fdb5b", "value": 3151360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779127509, "uuid": "2178941f-71fb-4b1d-885b-fa509e14052b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127509, "uuid": "a81abd76-0b34-4da5-a84f-c252295ae5f8", "value": "Bootsexeeec64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bcfd0d-52b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779109271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109271, "uuid": "1911860b-3778-4ea5-a484-e79fe3bb1717", "comment": "Malware payload", "value": "0ec6a57893db3a9859bcd014f1d8528d", "object_relation": "md5", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109271, "uuid": "a23875cc-4407-416c-8aad-060e51e3e1cd", "comment": "Malware payload", "value": "071c4bfb9a8b19a12dfc6cb5f65a9484c04f49631cec275e43ecc48fd9d47577", "object_relation": "sha256", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109271, "uuid": "419d2935-892c-4e6b-b592-d25ba148dc27", "comment": "Malware payload", "value": "54ac306cef07cb857174dc97105389b6971f14ae", "object_relation": "sha1", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109271, "uuid": "d3459b40-dc86-44e7-9eee-ebeccae430ba", "comment": "Malware payload", "value": "c27f47634c1ceb9979bdad27daefac3f9b5ac1f817cb5274e405bdf7d771e020c7f0b0e83bfedecee1f429bd3924fe37", "object_relation": "sha3-384", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109271, "uuid": "5fbf3030-7452-49ea-a446-bb0223525e43", "value": "T13BA5AF57A2B400ADD163C2B8C9565607F772F40A13316ADF53D08AAA2F27AF517FB720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109271, "uuid": "78f48ddd-f1a5-47c9-a5bf-efc3b62dc44e", "value": "af1fd296178dbd76922e2f31fcde60cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109271, "uuid": "f270b676-738a-416c-b9ae-bbf516c38250", "value": "24576:IX2iYTGaOjjtTq8tQ6LXduVDTM1wzdN3A5P1w0+ldOb+o0TMYruqBX85n4xwUC:QJLXqMG/AXw0otv85nD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779109271, "uuid": "5cd3d309-947e-4c0b-89fe-1c3a10729049", "value": 2211840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779109271, "uuid": "f7d3605f-2731-44f3-ab45-3c1cb6ee0d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109271, "uuid": "5f0a3af7-f0ce-4c59-ba48-e9bd164b3b9f", "value": "071c4bfb9a8b19a12dfc6cb5f65a9484c04f49631cec275e43ecc48fd9d47577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4538e77-5251-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779064683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064683, "uuid": "9fc11f2f-0552-40ca-a8a3-d11fee8a4c4c", "comment": "Malware payload (Mirai)", "value": "4131df918a11071b7da09158e99397d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064683, "uuid": "e9a569cd-88cb-455f-b18c-cabb3e78d5c0", "comment": "Malware payload (Mirai)", "value": "088dbc1f1b28b46da55b70a8b03a64d752a934209efb7145b2cfbe9533a86016", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064683, "uuid": "35187307-3190-413f-af17-e19398e3e17a", "comment": "Malware payload (Mirai)", "value": "4e13b00f953a82599050da6a0eb7a2c5efe454a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064683, "uuid": "3584ce0a-f524-42e3-b765-065aa57a747d", "comment": "Malware payload (Mirai)", "value": "f410e7764036cf89b0fdef635cc46b41fa2202d4d2baa38ba929098c69c410b76879e712ff18cfec19f097743e5920a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064683, "uuid": "0f015b63-0d7c-4317-993a-1d8f9f5a282b", "value": "T1CFC38EC6725D7E9FE2833E3A850683066D2C5F54AC471502A0BDAD4B19FB6D26F238C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064683, "uuid": "766113b9-608e-4dce-99cc-6ba85cb3a383", "value": "3072:TpY3158cHds3rVKSlKXi6D4/Y9tveow5ogYp:lYu3o4sif/WveRONp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064683, "uuid": "51d9b866-8f05-46a9-be00-9f8429674e35", "value": 125708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064683, "uuid": "a14d37b5-46da-473d-aa46-a608fb39591c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064683, "uuid": "bdbc93ed-d167-456d-9aac-1d0f045ae75a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f3b8df-52aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779102699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102699, "uuid": "192e3938-5633-4f0a-ad5b-9f745cb01ec4", "comment": "Malware payload", "value": "1787448ac43b1f17404e7a1407ef8f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102699, "uuid": "651592da-2824-4c54-bdeb-ea4b65d82101", "comment": "Malware payload", "value": "08f563f3595f69870179d45cd38573312ce5911ce3c993a6567a9b001879bdda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102699, "uuid": "569d4df6-d254-4f1d-a09e-d464e2ec24c7", "comment": "Malware payload", "value": "4a32169e7f3a60b67e2ae86f74728542c0af08bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102699, "uuid": "8637ee2a-4c85-4284-be83-f309aed503c3", "comment": "Malware payload", "value": "949687de7c30cc016ae94043e688fc6a614c56242289262a171faf774e43caabdd20b2b76c131ce590823f22fb0376ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102699, "uuid": "a7ce3078-8256-4df0-b9d0-7fbe04d40dad", "value": "T129257C3E965801BCE1B3E2F4CE170942EA75744613306DFF07A459761F1AAFCAA3AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102699, "uuid": "9335ecf8-440c-4c0e-a4ef-3489c2cdc2d6", "value": "bb90e7a6055da282e8fcc428467622fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102699, "uuid": "d595faaf-4843-4190-b2ce-6e1bf73b843f", "value": "12288:zB5XJCZz/9JMWCZ1oIBatlQx/x+Gfo9AjgbV1/6hC00MOotDs:zB5e/3MDgIBateRx+PqgbV1/aEotD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779102699, "uuid": "83736834-df05-426b-a20d-6d0ad4ebf581", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779102699, "uuid": "72935186-242d-405a-bfe9-7a538d1cbfaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102699, "uuid": "6c456480-a005-49d6-a68d-2d7ea4537969", "value": "1787448ac43b1f17404e7a1407ef8f0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed20ede9-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144181, "uuid": "d8aefe9f-26be-4c87-ad46-c4d4dc809d7f", "comment": "Malware payload (Mirai)", "value": "2ba8bd70776416b90b9f71e2d0ca1a41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144181, "uuid": "3bb4cce5-aaa8-4acf-be6c-6850773ab685", "comment": "Malware payload (Mirai)", "value": "09b3d586ace1ebd3c17a6978e86fd3954942741e6539d5c48f26904856b089d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144181, "uuid": "1fd8f3ec-35a2-4d95-a732-3283d24e2aac", "comment": "Malware payload (Mirai)", "value": "f8a028fd60ea2f1c8780f66a4a7382233315bdc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144181, "uuid": "d9e9fab8-c2f7-4621-b7ca-74fd30e97deb", "comment": "Malware payload (Mirai)", "value": "f23341db440981177e55cb328a2bb4ddc4f1e9ead1ddf97a06905f58c5a3ec995b04df4503a04a5410da3d3743c95da9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144181, "uuid": "eeb62cce-ff1c-4fee-ace3-afc3d8097c5b", "value": "T190B32A86AC814A11C5D613BFF92E118D3313277CE3DE72129D205F2477CA96B0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144181, "uuid": "1f80efb4-3312-48c3-b035-4b1fa99f9526", "value": "3072:BfxGIfE1qVXbO4bnOfGZKKajrfiIbVva4qWXCfuaM1kfxGH:iIfvlDDOeZKKa/iIbtancCgk5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144181, "uuid": "055e74c0-2c88-4a16-aa64-c3f1862ee37e", "value": 116104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144181, "uuid": "d78be6c0-1345-412d-b8c2-5d25eb4b2877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144181, "uuid": "0fc9933f-8c75-4236-bb89-d8648bb89d65", "value": "heilong.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e201b522-52a5-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779100784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779100784, "uuid": "ebe04a19-9822-4fae-aaee-8732f6c4f6fe", "comment": "Malware payload (ValleyRAT)", "value": "a7f5813610510c8a4aeef8f4fb0d984e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779100784, "uuid": "9671632f-a0f9-442b-925e-d3383ed26102", "comment": "Malware payload (ValleyRAT)", "value": "0bc1875fd1b702e00722e2881a529ad770056b907a2fbcb1fecaf883ddd6d050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779100784, "uuid": "5217b65c-e2ff-4615-8334-7d7caa91210a", "comment": "Malware payload (ValleyRAT)", "value": "6a05f6f09171bd36870c8315e1efa256cbe548d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779100784, "uuid": "3c11901a-c9a9-46c5-9d0e-1f1929635d5c", "comment": "Malware payload (ValleyRAT)", "value": "4e3274850ecd61b51423d6f47b2aa976b630037b548c8ba41c1c96131e8f6a47715c7e33c349ffabd02472ea0cad9873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779100784, "uuid": "56645f02-cae8-43fe-982f-1f53b4fcce9c", "value": "T113068D83B2B55265E9B7C13486A7952BD6727C038F2499DF125CB3186EB36F01E3B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779100784, "uuid": "a2413f0d-faaf-463e-a3bf-551665657dfe", "value": "f4ebb49bc19acbf0441a4e7b4b3620fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779100784, "uuid": "97aa5aaa-b824-4bbf-b673-2548821af534", "value": "49152:rmkDXrtkeSKReJYXRAUY2mwhWXs/g2lciKGJsv6tWKFdu9CaPTvG7FDpHFhh6Dh1:6+h/k8IZJGJsv6tWKFdu9CaiDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779100784, "uuid": "ca6f2592-541b-409a-b5ab-4448283d4692", "value": 3726848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779100784, "uuid": "81157cce-e132-4dbd-8848-3ea6060db493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779100784, "uuid": "c4630d05-6034-47d3-b4a3-8416d52353f7", "value": "2026\u00b7\u7b2c\u4e8c\u6279\u5185\u90e8\u8c03\u67e5\u4eba\u5458\u7ed3\u679c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97f667e-52ea-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1779130378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130378, "uuid": "f787ec60-3d3d-49ad-aef7-1c485f6a9ba8", "comment": "Malware payload (RustyStealer)", "value": "4d079fbd86c242a260f22ca2f1483a49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130378, "uuid": "c9b3728f-d704-4382-8c8d-214200d871c2", "comment": "Malware payload (RustyStealer)", "value": "0c6a5c5275c51a4c9acea3e3381abd60e395deb402a7bb7a6583b8c2d39577f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130378, "uuid": "640652a7-a28c-4449-93ea-28d065496b13", "comment": "Malware payload (RustyStealer)", "value": "189d02d4752329a7131526120a81241e35a30a68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130378, "uuid": "428d9d86-b4f3-4d46-b1bb-2192c7623755", "comment": "Malware payload (RustyStealer)", "value": "9182eb77ae9eaf35b813e4427141932ebefbc40683e04c913ed28b7774c89fc991cb1f5615d4206776c317119bf82b57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130378, "uuid": "7e8e9f8e-b902-485a-a735-bfebcbb49b91", "value": "T1E5670164024CE388745F4635E3D0FC3FF2E8359A377AE9A96C3991DB64523C282B9587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130378, "uuid": "424ef380-31f3-4884-9e3b-7885fa0f6f23", "value": "0bc1b1e557f4a4387777840b7c7925ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130378, "uuid": "70385778-638f-4a56-a7d4-f603e2ed3e77", "value": "393216:ZGdSuDRiOHKdEvUT8G6Cs5iYCOLYgCig8sQeNut5AVnDii6Ss1DT9SfhVEBhz:ZGdS0RpNVJCahDLBtVbD1DT9SfhMhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779130378, "uuid": "efd8b96e-b159-4113-8070-4be9b2f8133d", "value": 32293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779130378, "uuid": "1b460948-f316-4a0a-8079-73c1deb554cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130378, "uuid": "2348ac83-fc5e-46a0-bed4-11b64982bac0", "value": "RobloxHub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06afb938-52ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779130910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130910, "uuid": "ac3b4254-e1d9-4e13-ba80-feceb18352d3", "comment": "Malware payload", "value": "39f4748a8f5137cbd34c97f1f5943a98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130910, "uuid": "551df5f7-38e7-4174-ac58-970d77838df9", "comment": "Malware payload", "value": "0c906c21f5045396fb7581f4e0d721c5c62db3792f5f04e28fe119523546aa31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130910, "uuid": "271df847-29ff-4cd9-be35-196b69d2de22", "comment": "Malware payload", "value": "d44beb53335fc5615d4273c4bc4fee6000801abb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130910, "uuid": "34b42a8e-aab6-458e-8975-a2310fd668f9", "comment": "Malware payload", "value": "cdc0c4326b754275a00a45c5edc8ac39552a5ed385544e5982da06cc6a0739c9b6ce60c908c34b57d9ab12caa2272ce7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130910, "uuid": "f658b1cb-b14f-4e3a-aef2-cd5c67af38b2", "value": "T1DF860905ACC53BE6C42C5E7444EACA6522B06D140AF2463A26A4FFE9BC772757F478CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130910, "uuid": "52d116fd-1566-40b4-8594-ab26ac7de747", "value": "49152:RX7W9BJ4KGlHi4Ocyc0CQ58WTBAaiCaIE17Il8ZkFc/5Eo:whuLQ5pgImDOFqEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779130910, "uuid": "69503864-ca1f-4741-b98d-667373068fb6", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779130910, "uuid": "222da72b-3ed7-4b69-8040-9fc578af3802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130910, "uuid": "789503e2-f08f-443a-b821-029ee35ca9e0", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7c7fa7-5260-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779071194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779071194, "uuid": "39196d24-d107-4bdf-b291-6c7426bc97a6", "comment": "Malware payload (Prometei)", "value": "ce179be3c723e09e7775f37a2f279c6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779071194, "uuid": "070efe7d-7bc2-4228-9941-72b3339c73b5", "comment": "Malware payload (Prometei)", "value": "0db2c6afeb0ba8623c21f6f53783b2592fb6d20105ec0bf9a6b7fd4e59ae3712", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779071194, "uuid": "fc4ece99-20c7-488f-8626-e603c16fe9bb", "comment": "Malware payload (Prometei)", "value": "6bf81b3a66e420c174cc84a0dc79bd300c1821f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779071194, "uuid": "73c2dd4e-3ce6-43e6-8061-00f18e55a921", "comment": "Malware payload (Prometei)", "value": "11a2b92f1d59a010914ac4e60e51b79977b042e8eb6c8ddfd9fb03cda77c9875a010b203e8432d8620d4f53832a2779d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779071194, "uuid": "e3366aa0-c865-4f85-bc95-7b77fe981c09", "value": "T19A37CE77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779071194, "uuid": "003f883d-b821-4e6d-8153-53c956d083e4", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ9:cqYUQuVDt0TZEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779071194, "uuid": "383a1726-1507-4de4-9cf1-e5e5b732a4b3", "value": 22413312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779071194, "uuid": "b34faf36-ec7d-4ec1-8528-4f05d78cdd63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779071194, "uuid": "244915d1-1bf2-42f1-924c-a6d328c4f648", "value": "0db2c6afeb0ba8623c21f6f53783b2592fb6d20105ec0bf9a6b7fd4e59ae3712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160a4bad-52c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779113756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113756, "uuid": "d17613b9-7db5-49a6-b855-3df452e9163a", "comment": "Malware payload (Formbook)", "value": "140e35e0a1e21756d408459d5024f983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113756, "uuid": "441a7710-8f73-467b-9714-9e40ccd0c687", "comment": "Malware payload (Formbook)", "value": "0e9815093b48958e642ad4bf4806a0fbb84cd1350e7d67d9c60aaa0c145e6302", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113756, "uuid": "27800a03-2b1a-4773-a887-c3f02509e189", "comment": "Malware payload (Formbook)", "value": "2a6e70ed2ceb885ebcbc14471a599450da89fc1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113756, "uuid": "3adecadb-ac82-4037-81a0-2da53f74c043", "comment": "Malware payload (Formbook)", "value": "981121264d0ab5e93fa11653a622072575f7b3aa133ba351a03e5602638539efded6d89eabed1c06a30f2fd68f14ea25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113756, "uuid": "71c5b131-db27-4148-b29e-7266281ded77", "value": "T1B72522685B66D807CAD4AB340E71F379122D1DDEE842C207AFE87DEFBD66D246D00192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113756, "uuid": "a0c5872c-d0c4-40e9-8760-c6a671af1d4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113756, "uuid": "821300d2-3947-40b3-a83e-7011948e0f1b", "value": "24576:yweB5LBrafKTwgoAnilN2F+zNg5xBNaDyUlPDKtrg:onk4oIilJyxBNuyttr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779113756, "uuid": "5e0f8edc-9a88-4b7d-ad16-b996c9b56217", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779113756, "uuid": "83e30bb5-1b43-4d2c-abc5-2d2c0300aec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113756, "uuid": "9d0d548b-4c91-42f7-b49c-a93628580b1e", "value": "Bank_Payment_Confirmation_Advice0023456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89623248-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120821, "uuid": "aacc10c9-6454-4cea-a99a-8f41add30e94", "comment": "Malware payload (Efimer)", "value": "2388a567dfabcac2361109dc3f1126f4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120821, "uuid": "0909fed0-7310-4973-86ab-435b5c602902", "comment": "Malware payload (Efimer)", "value": "0ede0addd8755f41164a6ca36c350440c567a51843d57443185c61120fdf14ad", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120821, "uuid": "c33251a7-4c07-4ef9-9b51-5ce49571ef63", "comment": "Malware payload (Efimer)", "value": "8e463abe03e1d965d34f6b04b7640b04fb2debef", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120821, "uuid": "a50dc7f2-13d1-4ebe-bd01-d08b094189e7", "comment": "Malware payload (Efimer)", "value": "e5d58c5066f499dafdc6ff16d35fd50fe6ab61ac322d4dd763bcbc174df9d4f7bf2d0c78c8b5338d2424a36ab493e147", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120821, "uuid": "6eab51fd-1ec8-4d6a-9022-cd2b91dcef07", "value": "T16DD63318A6E622EDD3B289747FF163F2F864B4681239CDB5B354A3B3DC26458652CC07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120821, "uuid": "7bf92621-73dd-4dc0-a462-32908f189627", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120821, "uuid": "297f900c-45f7-406e-a622-2d2f856e12f3", "value": "393216:Q3nK6DpPplIGZ0TlipqXMCHWUjX7cuI3/PGTAI:QXFNPB0TlipqXMb8X4H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120821, "uuid": "5f19e1f8-3dd5-4862-ba9b-7702042fde81", "value": 13866891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120821, "uuid": "1e53ffbd-dd0a-44ad-8a2f-91074120067b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120821, "uuid": "96d435b8-6a19-4848-aa75-f00dc74ccceb", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99aa210d-5301-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779140176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779140176, "uuid": "c1262bfd-a8cf-4520-95ff-d53bcc5c7c75", "comment": "Malware payload", "value": "9a51f5dbadbc98645d0aeb8219541b66", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779140176, "uuid": "6ce641ab-c987-418c-921b-8c497df819ec", "comment": "Malware payload", "value": "0f39f7ea677bc1c9c1d0ecb05da506e9e13c574c183d88f1084e41839bff8d12", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779140176, "uuid": "929f29c9-b33d-4dba-a5af-9c44dbe917c4", "comment": "Malware payload", "value": "f506bf7c80498e2c35c97d2eee1b21e037d7e236", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779140176, "uuid": "d19df9d1-9541-4060-a151-d20783c2f938", "comment": "Malware payload", "value": "bfd01db2c60b414b34fdf27729067c93eb066e404be272b5c46b1b2d72ef05be616f7e41578d5a292a6754eec3199e03", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779140176, "uuid": "d30dfbba-404b-4245-8f62-e896ccf75e09", "value": "T1FA137D6956857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779140176, "uuid": "db2a4c2a-ba00-4564-a1e5-63bec61cde5c", "value": "768:B+w9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:B+Nco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779140176, "uuid": "54afe84f-1a6e-4439-b6ac-b4edb3e11dbf", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779140176, "uuid": "e8c718e8-b3d9-4f5c-be32-1ea8dfea0f3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779140176, "uuid": "e09ef3d1-9264-4c2c-b60f-0b8a94b0b611", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59273d28-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089816, "uuid": "493d39c6-4f2c-4ba5-a177-83524da068b7", "comment": "Malware payload (Mirai)", "value": "e8a7e38033af5f80b439c7c2386b7303", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089816, "uuid": "70ccc0ca-cd63-4a57-9fdf-32ed09808d42", "comment": "Malware payload (Mirai)", "value": "0fc5e1f6d90a3d2bedb4d2b66f0b8b85078f6fac2c7ea9cecf324284b81ad761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089816, "uuid": "e70491ed-aa44-4eec-92c6-d00fc114c53b", "comment": "Malware payload (Mirai)", "value": "c12ec6daade21919e9071b9fa9069dd3c0dc9e51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089816, "uuid": "364a2c17-72f8-4d3f-99d0-a2feec0990ae", "comment": "Malware payload (Mirai)", "value": "749004a04df8e57a6eefe0141d5518f1398b13105b9561c7631cd9fe25a0b8f06560500b3f0bf9cddc77aafacddc67dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089816, "uuid": "ba6a322f-a3f9-4cc7-9e0e-a94ee3c5d165", "value": "T12063F11725A3FC70DBE11539F436A30EBB904ABC747EB49664A0A38D35C184BD769B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089816, "uuid": "dcdee64f-febd-4307-aeae-c429d497eeef", "value": "1536:QWIe2QfoLEoqEWB6hqPjyty3YnkIWLkG1Y9sg5zo1H:Qm8EUa6kbyty3YnULz1Y9sWox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089816, "uuid": "c31af21c-6477-455f-8042-9bcfe4c7b643", "value": 67436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089816, "uuid": "d04fbb59-0cfc-4a57-95f6-cf31ba765e8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089816, "uuid": "b109008a-2c07-41eb-b7c7-a697c4d15744", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1d52bb-52c8-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779115811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115811, "uuid": "b74c7ec9-cd06-4efc-aa23-3341ddcac6e6", "comment": "Malware payload (GuLoader)", "value": "99518337967103f8306237959886ab04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115811, "uuid": "f3951849-f170-4998-9c64-532f70ab0344", "comment": "Malware payload (GuLoader)", "value": "10b13048b3765fdacc9108982f2ccbc6a065e2c78efa8c0299179f7547c49f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115811, "uuid": "c548f73f-9bdc-4b9f-89da-51ae6649190c", "comment": "Malware payload (GuLoader)", "value": "56f7f01535978f684c6c368e0382f18f0b26b822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115811, "uuid": "abe92cc4-389d-4ffc-af67-b5552635b12e", "comment": "Malware payload (GuLoader)", "value": "330d98d005a94fd35f3a6d0fb2da3c9b664bdd0468cd81b9eb18e9de32e9429b3301b5ee58d9684df937df7792faf8b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115811, "uuid": "d45e6267-2d8e-41cd-ac4a-736dcd6480aa", "value": "T1480523143084D95BC13081B54E326EB6E2DBAE72562197170384BE3EBCF5DED532B2AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115811, "uuid": "24a682ff-cafc-41f9-990c-bb105d6c6c77", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115811, "uuid": "4916ca22-561a-4c8c-92f9-2cf6ea574f08", "value": "24576:j+I3ZuZ7A/ZGXKhqg3aHNHmAlljEAGuBCt5Ay8:q8gZ0/ZGXKhqgKH39JrBCt6y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779115811, "uuid": "4fc1efa1-e7c5-4b20-86a1-5c305739dfc5", "value": 815851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779115811, "uuid": "b4df7003-68a2-4019-ba13-db737d5c3576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115811, "uuid": "15eedc5b-99c9-4f2b-b5ed-fced0ba576a8", "value": "Payroll List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fb00de-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120728, "uuid": "0b01a583-a2af-4e12-bec2-f87add527806", "comment": "Malware payload (Efimer)", "value": "ff09e627105a6c72b6c4ead218b34f6a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120728, "uuid": "446816c5-f84a-4346-b168-889ae7765e92", "comment": "Malware payload (Efimer)", "value": "113b3a45cdbf001ff8b80cb77874a423b87b7601838e041cda2e6f2b7091a28b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120728, "uuid": "9cdc2193-c359-4705-81bf-50384b059285", "comment": "Malware payload (Efimer)", "value": "9685dcbf2dc1e470b9a1a38d120b82caff1fb367", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120728, "uuid": "1404a229-9122-40e7-a071-383f8dac753a", "comment": "Malware payload (Efimer)", "value": "cb3176d791055b314b9230a5d7f22d68cf8fcdba2283e6401b3bacb4e8f9f3d4b931dd8757202e26f5628776ac2641a6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120728, "uuid": "20b81599-675c-4029-8409-866ddc1906ca", "value": "T189D6334D99F762FCC6F398387AF13AB4E0A8783902729D592D24E7F1AC1B550CD26847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120728, "uuid": "159e297d-a62d-47b4-8d38-cda55bec02af", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120728, "uuid": "ff2b9f28-0b6c-4016-97b5-a92d3d065a89", "value": "393216:gmoysmjOwUv8SsHiu3iDXMCHWUjXzcuI3/PGTAI:9JvOwr/riDXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120728, "uuid": "dffbb1a8-2c43-4dd6-b617-1c633be16496", "value": 13851390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120728, "uuid": "e549f9f9-b463-4ea6-93f6-2e08324dbf56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120728, "uuid": "4f9b9289-a1c5-4a19-8594-39800561e053", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2643c52-52ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779103817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103817, "uuid": "9eb226c3-98a6-4f14-9148-98fc5a28861e", "comment": "Malware payload (Mirai)", "value": "585d40fbc5c3be8b868b7fa6f7a7bae2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103817, "uuid": "619998fc-206a-41fa-9c79-a0728638c23c", "comment": "Malware payload (Mirai)", "value": "120b3b7c013a5f859edbbd60957fa560eaab797a42884b20b2238c8a99458f01", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103817, "uuid": "fd029d4e-0511-4a6a-a963-8dd7fa848867", "comment": "Malware payload (Mirai)", "value": "5cdd03fd292297d76e2bda35fbb9f1d63f7fba59", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103817, "uuid": "2d43c3b8-96a8-4aa8-a9a4-99a3f40c6a56", "comment": "Malware payload (Mirai)", "value": "0ce567a7ccfe86a42ba2a56ecd7a19e314a42dddaec5d52797087acecacf8fe5bd48ee5005de4d655af06705163c73a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779103817, "uuid": "5eb5c9c2-8785-41da-a9cd-429d1aa2d03a", "value": "T1C8547C03B6814CFBC4D6C574478FE222AD33F4956222F72A7594AB243E3AB646F0D791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779103817, "uuid": "87038479-3f7d-4b7d-9908-75d8c3ff098c", "value": "6144:G9lvPBmVFYzkd92IQD1z1A/F5UlRm1dfXSKdUHdkVKx:G9lvPgVGkXvc8C+dfXlOHdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779103817, "uuid": "64efd5e9-9e59-4ea7-b8a5-13580c1e6979", "value": 292472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779103817, "uuid": "e42c488b-3706-499a-bd5e-6a0c625fc712", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779103817, "uuid": "f90e4ba2-1594-453e-9343-50fc3f462d10", "value": "su9wyp_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8c29bc-52d7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779122169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122169, "uuid": "fad328d2-444d-44a6-b7c3-59e583b0b874", "comment": "Malware payload (RemusStealer)", "value": "5868cacdca56a5c1371ae5af24a07727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122169, "uuid": "b45d3e6c-d9ea-4e10-8f83-1aaf2edc5191", "comment": "Malware payload (RemusStealer)", "value": "125bf0e6913ec5da6c7b8150aca8edb815bdda95af0018230bef53f0ff9fb0d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122169, "uuid": "19bc054d-3791-42f7-b4b0-494041c7efdd", "comment": "Malware payload (RemusStealer)", "value": "6c7941ef308b7f10a0f790bb22a18f8bd873e4d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122169, "uuid": "23f2b3ac-1729-43ff-9aeb-e6651a31d854", "comment": "Malware payload (RemusStealer)", "value": "037cb8d4430154492863088716a8620c9268dd22fa2582bc7d39711fc24b250e08fddc64e2815741a94874696515c984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122169, "uuid": "bf542c2e-92ff-411b-a197-e3a4d1248d29", "value": "T1A6E54946A86540FCC19CF13054F63D50EF2138486B3927D31AA27AA86F77BE11E7672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122169, "uuid": "6faf6b29-4f04-454f-afaa-13412412b5af", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122169, "uuid": "7316d5f3-9ae9-4522-84f3-9d452f132054", "value": "49152:JBG2yF2kX9uOfV68K0893Bm/RP1RFpi80GnoYt494YEvydE7F0imC6JifKpBK:JB/qftuGthfKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779122169, "uuid": "378cc43f-4f0b-45bf-9323-b3406f55b50f", "value": 3103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779122169, "uuid": "95622c49-6d3b-43fe-904d-ee3b34f86994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122169, "uuid": "47d14891-67df-420f-885f-201b16a16830", "value": "WW26A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bde704-52de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779125189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125189, "uuid": "6c0d2baf-becd-49dd-bfb6-3f0bd0ddff4c", "comment": "Malware payload", "value": "d328cc574c1f7d0bc5c3d35849e53f0f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125189, "uuid": "0f7f892e-622b-4920-8d00-76b719aed52b", "comment": "Malware payload", "value": "12e5473b97a8952cef9d662b9f423167704ffa5a931416c2ddcf394eaca0161e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125189, "uuid": "fb6cce41-8db1-4949-82b5-ad50105b3bce", "comment": "Malware payload", "value": "477af3416c9532560af1085a23a0c61ed81afd86", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125189, "uuid": "4ee1bda4-1dca-4dbf-a7af-004e82e50f86", "comment": "Malware payload", "value": "86d336f8190a7b8d9a635db9fbf1cdc672bba974c3903993edc3d121775530c36af2a10eb3459c8b75bf01c29812c51f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779125189, "uuid": "f5df29b3-67f1-4637-bff9-7ed459f7de46", "value": "T1184402616FB4C837E003E375D740E1235C3A9598D18AA59B34ED93E11D62EB73E09B8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779125189, "uuid": "20ee1fcb-0373-4a9a-9563-614c716e2b99", "value": "6144:4yUCfnZSOWkMGNxgzHlDDeQIdMExpsgFHB:h7fnZSOWU7yDKd7zs0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779125189, "uuid": "95ccf51d-fd11-4d08-86e0-1564ca574654", "value": 267152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779125189, "uuid": "b2af9a55-cd79-4a52-b960-ca7c8531859b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779125189, "uuid": "e90a30c7-31f6-4124-ad6e-56c03cce3c59", "value": "Argon_Client_1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658443c3-5259-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779067933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067933, "uuid": "015e7312-16a6-438d-be47-152c368666c3", "comment": "Malware payload (Mirai)", "value": "f6fad2d39d73cd979836ae5aed897346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067933, "uuid": "928a9eaa-138c-4f89-9abf-eb6f26cba3d9", "comment": "Malware payload (Mirai)", "value": "13bf410c074e93d0630ac25e6ee673f44af8413231515083632fa036458c1b48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067933, "uuid": "6ade111d-20be-4f2d-83e6-9f5d3beccbbd", "comment": "Malware payload (Mirai)", "value": "e634a3dc9eab6d0a737fbaa55b6405ec88755c39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067933, "uuid": "e4ffdef8-b5e4-4346-ac58-092a0807008c", "comment": "Malware payload (Mirai)", "value": "24a5f5961fee358c602e328cacdfabc28825aa0efc7dfabaa910fc6f6811995e1063558dc41b4a1fdcefafa90274e4bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067933, "uuid": "83d524ab-d2d8-46be-be2e-6fa147aad2b9", "value": "T1DA835C01B31C0A43D1776DF03B3F27D593AEA59121F4E685381EAB8A92B5D325682FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067933, "uuid": "6dd11f5d-2aba-4865-8625-dd01d1fff406", "value": "1536:ObT9Hr/cp20Gk96a2dksOFXAq7JLwGdg4gPrk7u4Pl/Q+Tea83kt:ObTB66a2dieOEvS7XPt9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779067933, "uuid": "3ddb1e60-fb7e-4629-9bd3-aaa8407f6fac", "value": 84196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779067933, "uuid": "8ab5e212-c6f3-4d5e-b504-f5795e23779d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067933, "uuid": "ce74afed-a4be-406a-9837-517fc69bf1c3", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869892b9-528c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779089893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089893, "uuid": "573355f4-5904-4226-8b93-646224c0a73f", "comment": "Malware payload", "value": "648df292398d373a64466a067f6a8c9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089893, "uuid": "fec0e405-a17e-4935-8f55-f1d4fe83ef09", "comment": "Malware payload", "value": "13fd09b19ecb9bb3b508527266df3e2266b174df4402c7bc991eb0ea67e01443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089893, "uuid": "b9b485c7-e24d-434c-b72a-bd54b99c8c91", "comment": "Malware payload", "value": "9c720fcc0754a4ac09cece00b369a5d4205f85e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089893, "uuid": "49261cbe-c179-4548-8b69-25a11222ee86", "comment": "Malware payload", "value": "220d0fce7476ae060e4db2d869c78ef0ce4b7a50c117a41a919edb26dd579aa007c3dfd3ce161f3db168df4be076a7e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089893, "uuid": "53ff4720-457b-4b99-9160-2fe497237751", "value": "T188C401833AA95750E63962B9C0E3A93412F7B8C77BB3C74D7E0943A56E413E49E857C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089893, "uuid": "4103a3c6-9240-4001-a255-cc52344a7838", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089893, "uuid": "2a468d33-6c60-495b-b8fc-cbe3cd7585da", "value": "12288:WSjfD9+AdoUJr/LieWPWJex22M7rL+hlvQKQHPlHn6c:WYtBRE2+b2PlH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089893, "uuid": "227c9fab-b3b1-4d21-8ec5-887fe9f441f2", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089893, "uuid": "f48718e1-19cd-408e-9f89-144243156659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089893, "uuid": "f2bc9e7e-ba48-482a-9e9b-bb366714ff12", "value": "648df292398d373a64466a067f6a8c9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7e6fcb-5284-11f1-a769-42010a9c0008", "comment": "Malware payload (Xtrat)", "timestamp": 1779086388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086388, "uuid": "707889bc-679a-4b89-a5f1-ad31fee62575", "comment": "Malware payload (Xtrat)", "value": "c2b08d5df4e386a0d5fa5c797306d347", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086388, "uuid": "69f0dcb1-9d7a-4e64-bca9-90fa7badc340", "comment": "Malware payload (Xtrat)", "value": "142a8fb85fb8aa7971dd6467f9a2eb454452ad526bafdfd6aadb8dd508624b4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086388, "uuid": "8d0fe1d8-85c3-4b3b-a3a3-a5e472532428", "comment": "Malware payload (Xtrat)", "value": "1125eb7602d85c0ce02e93086942fca7e4ca71e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086388, "uuid": "2613c78d-ad8d-45e8-ae29-5ff83e1706d3", "comment": "Malware payload (Xtrat)", "value": "6ebd4bfddb990d96d0c69979e4a86f5be7b24d0e4185c55ac1c5032294e49e524bd89ea1d06a3621c05e3279773155b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086388, "uuid": "4cf372a5-04e8-40fa-8b68-409db86a3bd5", "value": "T145434B0175F2AA31D2326B7C4F09576DA83F663026604C85B36E1F8C99B8793B70C76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086388, "uuid": "538e13c6-59d8-4a1d-80c1-f136ab92bc95", "value": "8a4665cb76c9faec77c9a109d7b4769e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086388, "uuid": "f583ef39-87b5-4f87-85c6-af242397ac5f", "value": "768:cuMAzLqSQ6kwATx94o0IWhWAKphMltZqgpKeC50Cwfx0vzo:rtLqSQ3w0+rIcKsw4K30KLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779086388, "uuid": "d6e1c492-10e7-4496-a474-1fc6024b4417", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779086388, "uuid": "ef2be8c0-1c5d-4a3a-9399-527e34888beb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086388, "uuid": "6d525784-3218-4acb-ab87-9408df846adc", "value": "Leons", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2118eef-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144190, "uuid": "211a7983-4cd0-4fd3-947c-9c8553fbf985", "comment": "Malware payload (Mirai)", "value": "88cf9a18a7164b0c3811f4e29244f5e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144190, "uuid": "ede9d0da-8716-40d1-9870-ef3bef699ea9", "comment": "Malware payload (Mirai)", "value": "14f811a6a055e44eb246cad86d36bcf793a77c463ef609146ab7aa7c80c87c81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144190, "uuid": "ef3c7398-f619-4132-beef-b15dee325945", "comment": "Malware payload (Mirai)", "value": "0e7a24aa437a455788f04dde9673cd7f68055057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144190, "uuid": "07d23d5c-02d6-4902-9a81-20e9bba676c0", "comment": "Malware payload (Mirai)", "value": "4e7520fd1aced420ffccd88a73f7966abf481aa24bfbefae5241442e21592229d3c593a22c010c56944facfbefa70b52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144190, "uuid": "f45bd03a-1594-4829-b9d6-e5802c2795c4", "value": "T14193AD33C92A6DD4D6519674E0F48AF81B63E50082671FBB19D8C5A95087EBCF20A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144190, "uuid": "4b099c22-9e26-4f97-9db9-13a6a1627eb4", "value": "1536:CGKS0rFc8wtAGzd8qjeCckbJcNcnwCQQjCTFilbQqK+UAA7ULEKwvCpuJUEFW8Iv:CG70rFc89GBxjeCcEeWnDWYQt+mmEKwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144190, "uuid": "755a519e-190d-4774-924e-356db9b8178c", "value": 95692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144190, "uuid": "5aafe294-87a0-4c33-b62b-f0f68856781d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144190, "uuid": "c72fe1aa-d6b3-434a-a837-716f80ddf9b3", "value": "heilong.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e93177-52af-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779105050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105050, "uuid": "5f4412ec-c39a-4bcf-a102-7df527662b72", "comment": "Malware payload (Prometei)", "value": "20613a8649792931af8f2733ddfec74e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105050, "uuid": "eacef02b-b056-444e-8d7c-7d5448d2f94c", "comment": "Malware payload (Prometei)", "value": "169e1952898276010f212f609c4956a4fd89daa35ce3fa45c31357b44149efaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105050, "uuid": "38dbf98c-77c3-4c12-a469-b8666885f58e", "comment": "Malware payload (Prometei)", "value": "699d14bcfa795368248a5091063b20f3cc4f1ff4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105050, "uuid": "e54caaed-77ae-4b26-82a0-b1f78077e28e", "comment": "Malware payload (Prometei)", "value": "1e834b81bde8f1fbb8acfb9487d2664a43d9cf8fc09790fe8496469e60ff951eaa8c4e5f5806a321be45864208641386", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105050, "uuid": "ca7265be-2ff0-443e-b8fd-ee93b74498c4", "value": "T1BD65F757E89590F4C0EFE174C726A213B9A13499473437E36FA18AF11B26FE866BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105050, "uuid": "a1af2ea8-2509-4370-b0dc-cefcef56bb39", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7FOQzjFyaWPli9+cleR8ddEz:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779105050, "uuid": "86592750-04eb-4417-8cd9-c30ca5a6b4de", "value": 1474560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779105050, "uuid": "f3d38b05-4555-436d-8b30-6fe747c881b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105050, "uuid": "9a90417f-f4f1-493c-b4d1-ad9ff00ee2e8", "value": "169e1952898276010f212f609c4956a4fd89daa35ce3fa45c31357b44149efaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdec704e-5256-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779066820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066820, "uuid": "bde276bd-edfc-4ea1-9209-a82791ae9656", "comment": "Malware payload (Mirai)", "value": "08411f5a061223c44d7c8f77920f5215", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066820, "uuid": "809bf9ef-d34e-4dde-a07e-9c545a929e16", "comment": "Malware payload (Mirai)", "value": "193a8e53a7f26e82d216a49dfda248fa7a17ebbadbf11cbd0231f21261847a41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066820, "uuid": "85dc6cef-1bf9-423f-a967-371a73ed1c4c", "comment": "Malware payload (Mirai)", "value": "bccc1daf8dacdaefe85716a3fcf7726c110977ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066820, "uuid": "42e274d5-277e-4d35-b235-7a03c506540a", "comment": "Malware payload (Mirai)", "value": "c3d202eeb3be04e8b7757a07615ce9b763f9a34cca217cf992637613f4eb9768277248eee338cfa0583d8c71a9ef4ec6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066820, "uuid": "562f54a2-fe2d-41f0-92cf-0d204985b914", "value": "T19D148E68FE8E78D2D2C7E37DAD4A0FA230277D749565C0B11A00A29FD5EAFD489D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066820, "uuid": "ee27add2-3151-4273-87d6-4b3fc6d79f90", "value": "1536:OYtdyYq3BANtiz4UoUWHyeCFbjKEdAStt8YTpQURvqL4dqiofCsHNNjzPx+P7dq8:/yt4wz4UJP8EdAxYC4qfiofCeNRzPxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779066820, "uuid": "36c643d7-10e7-476d-b185-deefa1b05629", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779066820, "uuid": "02971c01-097b-4e52-959a-cd85890010a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066820, "uuid": "8f29b310-93fb-442b-afdb-c41814669c75", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ceaef3-528b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779089618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089618, "uuid": "f537f674-6f28-4f1e-a1b7-5386925b036e", "comment": "Malware payload", "value": "d9d77bfdbb0bb6f3c51780574853df41", "object_relation": "md5", "Tag": [ { "name": "IRC-Bot", "colour": "#4313D2", "exportable": true, "hide_tag": false }, { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089618, "uuid": "c2c8a5b1-8952-4fa7-8faf-9cf50ddbb786", "comment": "Malware payload", "value": "19e74f7e2a31654ffb9a3e6fa7be3069d587b76d571960ca5b0fea0457fef619", "object_relation": "sha256", "Tag": [ { "name": "IRC-Bot", "colour": "#4313D2", "exportable": true, "hide_tag": false }, { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089618, "uuid": "7be20f24-173d-4dc1-be5e-601d912ded37", "comment": "Malware payload", "value": "c7356e63e389dc54831e8f9d7122deb21b308428", "object_relation": "sha1", "Tag": [ { "name": "IRC-Bot", "colour": "#4313D2", "exportable": true, "hide_tag": false }, { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089618, "uuid": "995a9b30-e6e7-4653-b2e3-6ff5a3d5c41f", "comment": "Malware payload", "value": "c901980b22b14b8bf98a688eaa48fc04d5e2adb22ffba0f36de86feea1f0a7ba9a60b742650ced8985d3174a9517c325", "object_relation": "sha3-384", "Tag": [ { "name": "IRC-Bot", "colour": "#4313D2", "exportable": true, "hide_tag": false }, { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089618, "uuid": "9ab0b859-8d62-4f76-9058-f6a4de3f06a4", "value": "T1E4E2DA85489349613377BC6256BAAC09BB9602C3DF8BAE187C4D92CA5FB5434DCF4CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089618, "uuid": "1ea348a0-277b-46a2-beb2-ba0f0757a06a", "value": "384:ITC2CeMAbzI/4scQTuSjgMm9lMH4XZCjs/q8Ro3kaT0f:p6zI/4scQTYMmkH4XZCjqq80W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089618, "uuid": "a9eb416a-74c7-4ada-bcf1-293cd1d8e5a4", "value": 33415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089618, "uuid": "ad788e93-ff4a-4f52-b5cd-f38d59f77ed5", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089618, "uuid": "757fa8ba-c054-4050-834d-f307afa72852", "value": "19e74f7e2a31654ffb9a3e6fa7be3069d587b76d571960ca5b0fea0457fef619_from_176.65.139.43.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfae3d4-52b1-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779105822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105822, "uuid": "d3694797-6404-4eb6-a458-1bb9670a9df1", "comment": "Malware payload (QuasarRAT)", "value": "97e1c117c7eb19baa4911efe5d50013a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105822, "uuid": "6a0f0143-0b33-4008-8853-b98baa9e041e", "comment": "Malware payload (QuasarRAT)", "value": "1bb68efd2981f77993456a9973d1e1a0db368bd26a9d9c2d00c0ab94f55bbc02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105822, "uuid": "e1ba0aa1-ee80-4d4e-aa1e-dd14b5a2c190", "comment": "Malware payload (QuasarRAT)", "value": "007a5cac510859f4417a09b8f89dc386ba0da904", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105822, "uuid": "c21d2494-e5b3-43f0-ae17-e19692ea29bd", "comment": "Malware payload (QuasarRAT)", "value": "f3bcebce95fcea992cffdbfc36bde6c3ad21cf9c50a8d28996ac1392730a8fe4ae5cd69f6f62ae98e54ccaef70208fb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105822, "uuid": "072fee50-4bd9-49d0-9432-359c1b718cfc", "value": "T16115F18DAAC18D20C9176D3485305D740377AF597E95F282ACA87CB737F37E928A4487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105822, "uuid": "b9ce6ab3-85d3-4e41-878e-ffce2972ddad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105822, "uuid": "bc25e83f-42d7-404f-bcbf-774392746d21", "value": "24576:yQPPLjwTutnnb1EJ6+bJhAHbDr5+9zAJU4g:y6jPno6u07Pte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779105822, "uuid": "d1cd6567-ad8b-4220-bf0d-1546c0a03806", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779105822, "uuid": "b5540728-c391-4f53-b322-42b6a6fe69bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105822, "uuid": "31709416-e1ed-4e4a-a91c-1e1f9ed18e7f", "value": "97e1c117c7eb19baa4911efe5d50013a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2919ff06-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091024, "uuid": "0ab145e6-e5a1-4b81-8269-d1500f50e1b1", "comment": "Malware payload (Gafgyt)", "value": "f8dec6d33068e5c156f5c3cf4385196b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091024, "uuid": "641770eb-ac83-4e9c-8fa4-f7da93566345", "comment": "Malware payload (Gafgyt)", "value": "1c04c19289765ac1ed3f231e18866fd3c8fd81b277c6840156af8a09ca82f06c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091024, "uuid": "a2e4e3d9-0833-41dc-8ca8-26ed83106061", "comment": "Malware payload (Gafgyt)", "value": "54e3a4292bf4bdd79009ac29c634632eb9d0a196", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091024, "uuid": "3f5d9d4c-760f-49bb-a971-1a6c8d3b7874", "comment": "Malware payload (Gafgyt)", "value": "9446cfbb8ead1ddbc91613b3c408dbe242ac963fef8e847d03c50369b4765a230bfc7a2da320459dc8eec7566d116cf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091024, "uuid": "ddc57219-56bc-4be6-bc2e-2519c914a76e", "value": "T19E041905DA405B37C1E22BBAF79B42CA33239F54A797330695287BF03BD27A94E36111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091024, "uuid": "34c7ec72-8c96-4ad3-a50b-86c03241500c", "value": "3072:0g4wgxqGp1wD97lXeO9l+JCXNfxOLm5hpu5geapsDaUW5N8FvR2QMs0cd1dhQZIr:I6XuDaUW5NMvR29cd1dyIvRzM/9ekmmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091024, "uuid": "0d45c4e7-c578-43d2-ad04-fae14822b8a3", "value": 184659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091024, "uuid": "46cb28f4-7ff3-4752-ae83-9988b0840f57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091024, "uuid": "90eaa7df-a000-4578-9850-8a0563ace630", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29a327e-52bd-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1779111092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111092, "uuid": "f2aec871-d46e-4f4f-a90d-d4ef473adc0d", "comment": "Malware payload (DDoSAgent)", "value": "26abfb4fdc5089ebf7dcadde352dd1ec", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111092, "uuid": "2624eeb6-3daa-4630-b467-f3e022c355f5", "comment": "Malware payload (DDoSAgent)", "value": "1c16a7c5cee404c37de39563e7dae215f0eba4a61d7beca2f100398f67cd0208", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111092, "uuid": "5d0078e6-eb5a-47c0-bd1a-f9cc447c8fb4", "comment": "Malware payload (DDoSAgent)", "value": "68591c8752b9a28182d020d683d46d33aa048c9a", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111092, "uuid": "21208364-5d76-4ae3-acb2-b67be2ad659f", "comment": "Malware payload (DDoSAgent)", "value": "a194f0807b045baae54a92b604a70aa0630a1e08daca1b31aa413eda28af22c7c435eeaaa1904ba88bc3b5605305e66f", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111092, "uuid": "53a4ca13-68a1-4943-b926-7fc2976b20b4", "value": "T1C0864B137A28E70FC62821300CB2CA94276A1C9682D7915BB745F309F9F61BD5DAECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111092, "uuid": "e9eaf57d-960e-4a36-b730-fd4a6acc1f2e", "value": "49152:BNu7vyafxvoTeM3bZN8lMCtlb5KoOVvtUzAbGHHR/9rgHo2+LEqlXzmraia5pp0w:otQ4zPiQ0TJVCB6nUjE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779111092, "uuid": "23a4a31f-81d7-4035-bc7e-6efa1aad62b6", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779111092, "uuid": "043c1ffa-eaab-4c8b-8d58-d6b673892026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111092, "uuid": "33e9fee7-a96e-4ca4-a01f-6619d79a3073", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5416b699-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089808, "uuid": "285d2035-eb3a-4fcf-a6d3-713bed48c48f", "comment": "Malware payload (Mirai)", "value": "b927c936859ee691577424e420ce14c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089808, "uuid": "87d491f2-82e1-4fea-a5aa-bc29cfb43c1b", "comment": "Malware payload (Mirai)", "value": "1cd4cc9db6c8b003cfeccc0d14bedc623b12ac728a5bddee2acb10f602d2a1a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089808, "uuid": "2cef9b8a-518f-4f74-8659-ea865ef7c82a", "comment": "Malware payload (Mirai)", "value": "0a53bfb754df07fb24f4d10c4bad401b362255f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089808, "uuid": "66e8d97b-a37e-4687-994d-77e6b96cc5f6", "comment": "Malware payload (Mirai)", "value": "d1b5de048e1ffd45aa2ff304d3ece0bd1410714314e2cc02d64eb71c40365d0062fd61de064ac8d8dd42c13b9fc39235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089808, "uuid": "afab9d9b-e410-4563-b194-a4e1e3f73019", "value": "T1B803F121E9F9D306E7A82033E4DD35574A60E62162DDC07ADAC0943E5C8BF66FF6D510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089808, "uuid": "0bd8eb16-8cc2-4f16-add7-3e0160cf60ca", "value": "768:g2HJeRRzOfGyM21RgGW1Gz0kclnnKwHgLf6QjX4ckLaWunbcuyD7UHQRjw:5CRzGGyDjbWP7nnKwAT6AockLjunouyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089808, "uuid": "60a3e725-0ad5-451c-ba77-6fc5f08f168e", "value": 41296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089808, "uuid": "5c906b03-6a70-452f-884b-0ccfac26352e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089808, "uuid": "9007e1fc-200e-4076-8723-47f22e0f5214", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9f50ee-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091035, "uuid": "16e1f0ff-9db3-480a-bced-0a44bf21357c", "comment": "Malware payload (Gafgyt)", "value": "076a26857a65cfa14436d14841f728c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091035, "uuid": "f4620093-0967-4ed5-9b0a-8ec3f2a56cfe", "comment": "Malware payload (Gafgyt)", "value": "1d435214fd76b8dbe26f1fc3159f69615b038c8a022733f4457f129e258e9db9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091035, "uuid": "78be72f2-e9c0-49ed-ae4a-a510706fee7d", "comment": "Malware payload (Gafgyt)", "value": "bd1eefe16eda59a64d475867585fe91839ff7cd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091035, "uuid": "88aab384-f88d-4da7-a0a6-5027c62358c1", "comment": "Malware payload (Gafgyt)", "value": "6c90adc1cf91ccddd56e138652681ea59958f942cf9a7f562352631aa5bc332b2274bdb28677b1d232434073482c69c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091035, "uuid": "3338a50f-1dbd-4c93-9487-2389947c5194", "value": "T1B1240901D5505B67C1D21BBAFB5A42CE37331F6497DB3302AA28BEB41F96BAD1E39011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091035, "uuid": "2974fc1e-1ac3-41fe-b144-34e065a1a20d", "value": "6144:U3WX0wVXajfs6pg0Hk1dfcGN0pmWZ8QAZ1ggStCWh:UGX04XajUL0wapmWZ8QA3ggStCWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091035, "uuid": "ce13a661-06f3-4459-9b75-3d7d73954c96", "value": 229271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091035, "uuid": "409622d2-fd68-4e03-89ad-f9085ec51cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091035, "uuid": "5afba7a2-af9c-4db4-9760-ba09973dea07", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f263aa88-52e3-11f1-a769-42010a9c0008", "comment": "Malware payload (GoStealer)", "timestamp": 1779127440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127440, "uuid": "606e9fc5-7c56-4443-acbd-bdd852dad1cd", "comment": "Malware payload (GoStealer)", "value": "e930bacfa6fba7e04167be3c4de450a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127440, "uuid": "3fbb6eb7-fec9-4b83-86f7-999fc1c00fb6", "comment": "Malware payload (GoStealer)", "value": "1e85e7d9ed8d9dd0a4ff72a71f211bced090919a87d5a1c8f935019226d18a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127440, "uuid": "72c8bb15-45b1-4cde-b995-86b177a7482e", "comment": "Malware payload (GoStealer)", "value": "6247b9e99e9489b5e41a6a8940692b6c78e3e313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127440, "uuid": "ede9aee3-9e6f-44dd-990f-1a7c0b7fabed", "comment": "Malware payload (GoStealer)", "value": "20ddc610f72bd5f800a48332efc45a00fd498ec5baee4e4c5cb996c2161dc55adabd09396cdfb416f80fbf5786d04a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127440, "uuid": "c52b9b0d-28b7-4247-9ed1-c924257c572d", "value": "T1A3572A03646140BCC0E6BA3564A57441FB2174486B3C37931AA26EB42E7FFC16EB7B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127440, "uuid": "cb8edb7c-10bc-41a6-a02c-dd731d60baed", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127440, "uuid": "5fd8034b-2e23-4877-a5de-0a2f33260f29", "value": "24576:2cqi6Haib+tg+xH3O5C+STx6pIjyDBoiGEwpoqRz5iYOm86u4yRKoP3grPelesXm:2zD6iig+xH+5zizeolKqjO36u/Rj3zMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779127440, "uuid": "6b9eef91-eb0b-4149-834a-5f84a0ca2087", "value": 28351656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779127440, "uuid": "42eb5d73-3f49-44db-9d97-0b8fd6273480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127440, "uuid": "93f494ff-775b-4c40-8eaa-a77df527d235", "value": "\u0412\u043e\u043estrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ab988b-52ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779103794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103794, "uuid": "ec00a891-9068-4ec2-bdf6-381f457dcffb", "comment": "Malware payload", "value": "5b4a8dc53ea553737a8b857d4fb5baba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103794, "uuid": "b06592ae-8c58-475f-893d-64fd241da5fa", "comment": "Malware payload", "value": "1fc3a5ec7a65a8478190bccb5914aa1d1c6d2fea1e907282d12d1b32984503bb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103794, "uuid": "ab5d24e2-b97a-4bee-92bc-3d4a243a1b4e", "comment": "Malware payload", "value": "e75d9c08d6aaa67b93d99f0af5f6ab8e23557d82", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103794, "uuid": "11362aaf-0e56-4719-b208-8877d2642737", "comment": "Malware payload", "value": "e84b651fa14539d82d6a05e06729dca5937984eeb52ce0f340f915d62a25fb1412cb52ac1624f6c67423035119c7cf0d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779103794, "uuid": "91cdcb22-013f-4965-ab3c-826a637e4154", "value": "T12D137C6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE318759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779103794, "uuid": "c2f55a47-5df0-4712-817c-67fc61bc45c8", "value": "768:er9NyXsZztC99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:oHusZvco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779103794, "uuid": "417f18f1-4e5b-4e4e-8783-10fdc97dedda", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779103794, "uuid": "57ad883f-3cb9-4894-b122-b20a8902c194", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779103794, "uuid": "d356219d-5a77-4b9e-ac03-c6af76fc71f8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc42358f-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120504, "uuid": "d90b460f-c473-4744-bc39-e9bce3b3b3e6", "comment": "Malware payload (Efimer)", "value": "f17f5aba6d21e909127d26985a0b7792", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120504, "uuid": "b33e87ae-6784-4752-bcc6-3673d3c994f4", "comment": "Malware payload (Efimer)", "value": "20ed4837f644aff19e2434f94613b43972180752aa50d0778c56066955e555d7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120504, "uuid": "552e481b-f40d-40ff-b0ff-22304edbe720", "comment": "Malware payload (Efimer)", "value": "9de06db9c20e453cfdbddf6def81bf71342ef60b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120504, "uuid": "e54ff117-33c8-44c4-9232-534dcda4578b", "comment": "Malware payload (Efimer)", "value": "5f84f7f789feb2750ad753ed195a3763af703afb26f37c11ecc5f7faefb6c129f8c74c08190b9f76b2c3d45decbddd8b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120504, "uuid": "4789c609-405d-486f-99d1-d2e977f1babe", "value": "T1ECD6330AA8F3A0EED637D470BEE5A2F9E865B47912758C3E9B54C7B07C471604B2C41B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120504, "uuid": "6cebb5c6-0381-43a0-9c2a-aed47737c87f", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120504, "uuid": "372362db-d33e-4592-bf88-32d86615010a", "value": "393216:PMks2a++V/UIM4AFsg3XMCHWUjXBcuI3/PGTAI:PMksW+VLMBFLXMb8XWH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120504, "uuid": "7e274974-9956-43bf-b4f9-83cf265d38c6", "value": 13837253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120504, "uuid": "ec0c5757-2685-4d5a-afec-38f8395c0b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120504, "uuid": "62a8410c-1e87-48a0-a625-20aafe88a2f0", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed35f6f9-5283-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779086199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086199, "uuid": "22cedd3a-bf51-4a56-850d-19a97405e8af", "comment": "Malware payload", "value": "d0556a7ce42af4798dd994f1a1543064", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086199, "uuid": "c144d757-df5c-4865-8588-7d932393f9b4", "comment": "Malware payload", "value": "213a1e3418e27862e88441bfb0b43b11bb960b3fe38225ef4c5a44ba31af1939", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086199, "uuid": "7f55c30b-e34c-4631-8eb8-0504cb2e9661", "comment": "Malware payload", "value": "9388513005ff3e8c698924a251e234c92b104feb", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086199, "uuid": "bf06aa68-6a53-447b-bb6e-87bb15f22236", "comment": "Malware payload", "value": "4a0c569b56faec5fb22cf6ba9693dbfd88abbf289a0ae2bb124cea67b5ebb276fa8cd278d591d1f86f75e5856d680a8e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086199, "uuid": "09d47950-04e7-430d-b53b-20d6418bfd92", "value": "T16582D72A37B404A641833AA8D5DED219EB18513B41192E5070ECC6C5FFB2A6FD7F87E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086199, "uuid": "ee7b35b5-8fef-458d-b524-6274489e6bd6", "value": "384:nbSBtPGbJIk53B4ln23OX3n3s3K33A3Y3hoLg9n5xfuOuTA:ZIk38lVoLg95xfuOuTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779086199, "uuid": "2cf76f54-b125-4d88-af4d-0fb2b2fdbc33", "value": 18173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779086199, "uuid": "540b14ab-e132-4400-a4a7-6cd0418a7ce4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086199, "uuid": "3d3434f7-9d5f-46d3-853d-256d347958ed", "value": "ps (5).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82b817f-5283-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779086191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086191, "uuid": "6425121c-e38c-487e-aed7-598cb4d410d3", "comment": "Malware payload", "value": "6c7816d095a015bfba7f77d2187577b7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086191, "uuid": "090f3770-0f54-475f-ba8f-9b71ebfdc56d", "comment": "Malware payload", "value": "215778e28c4c88b1042f098a251326d06fafb3d1b9553fa804a2b928a67d3bd3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086191, "uuid": "b0fe8538-9f89-4519-bfc0-59bb8321762c", "comment": "Malware payload", "value": "4b5a088fd2c389170bdd96fa005e65589a467141", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086191, "uuid": "3c88dd41-6511-44c1-8bbd-2607a1aab48d", "comment": "Malware payload", "value": "b91be6c9b2f02f3bea36c652ed27b3bb57c93ac76e16e8ebbec19a8ba5753c5959161c435392260f8eff5feb24b1c2b1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086191, "uuid": "06a377e9-1234-4e65-be91-dd51438e06d5", "value": "T14C82F925327954B602C763A8DACED308A62581BF921A5D1438EC87C1FF7282B57F87D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086191, "uuid": "ce3d70f6-29d5-4e59-9756-0726be882ff2", "value": "384:+LKWg0TCFv4nb7pfroLgcts3+3JeOfWPEDLy6:30qMbxoLgcoqJ9vR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779086191, "uuid": "989cb181-e824-47f0-8fac-fb8c2304bd8b", "value": 18543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779086191, "uuid": "75c61674-cbce-414f-a56d-3c8fe2fc392e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086191, "uuid": "e3335551-1126-4aa5-9ba4-88631738ba18", "value": "ps (4).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c855cd2-5259-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779067784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067784, "uuid": "a2d2a1f4-209b-47ae-b2f3-408ca8807d43", "comment": "Malware payload", "value": "befc0b483d634adcfbf7d0952bea9231", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067784, "uuid": "9ee577b7-663c-43b6-a034-9f4f858d223e", "comment": "Malware payload", "value": "2163a90e93578eb4081384af20cc3312d5b871893d74b9c94da1a02a0858a5be", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067784, "uuid": "0298a7ea-6752-4662-b055-597a8b054676", "comment": "Malware payload", "value": "7ac8567d23d956c9a57729d2fb2bbdc1b12e7277", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067784, "uuid": "ae01eca0-72d3-40e4-ac61-645c056f5a31", "comment": "Malware payload", "value": "be778ee0793d49366a9795d43db45d7a5adfbd83d81a004d87077649d98434e4e8a3649430b95590a75fa12f85825965", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067784, "uuid": "86e1c135-aff9-4f49-bfde-fd2ae4d55981", "value": "T17CF31223F04E64DBC93982B4C312BAEBD336762A0BB1D6DB57C181102EDA3BAFD14541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067784, "uuid": "4b0b5bcc-97a1-4f5f-baf5-229a3d1574d9", "value": "9af652503dfd57a3e159745faebb9f13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067784, "uuid": "0f8e11d6-7957-446c-8e6b-71f820b290e4", "value": "3072:jT9fjBslPv227EUPP/kI8UZ2V/O+Q0onFJpPdfMI/0w1lJRbI5CtS/:UPO27EW/x9gI+MvpPN/k5mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779067784, "uuid": "aaea30df-75b2-4239-9e3e-db3a192cdf82", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779067784, "uuid": "1cc5c665-7f6e-44ec-97d2-61fc324cc2af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067784, "uuid": "b48f1c94-9fe1-4e8e-b27c-cf037a89dcb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0556c28-5262-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779072004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779072004, "uuid": "c2ca4a89-5a76-455e-9a5d-ad2f1386b6f9", "comment": "Malware payload (NanoCore)", "value": "99839107fd8f68979ec3a52821d0c7c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779072004, "uuid": "cd369b27-391e-4f07-99d5-62d546713e2f", "comment": "Malware payload (NanoCore)", "value": "216691ada8d515a8e518cd070291e3ac61f80dcd81c50749b1f8395601d25999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779072004, "uuid": "abac88ca-9749-4e81-bc1a-9c3e012df2f7", "comment": "Malware payload (NanoCore)", "value": "7344398d05c7fd87831fb45a04e44ff9f7d2ea0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779072004, "uuid": "8c8efc52-8671-4e4f-830f-6c8bacbd5122", "comment": "Malware payload (NanoCore)", "value": "8c19892683457e6971293a4c7e5223775e7bd498367d65f23f872eb1815a734fde2f14b2334d45a21af95ba7c940eb39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779072004, "uuid": "15f9c09b-0de2-42e4-9209-0c6cb278571f", "value": "T19C14CF6677A8492FE2DE867D601212529379C2E39CC3F3EE68D854B38F527E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779072004, "uuid": "35669c31-de8a-47bf-9b90-94fb8cab0f5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779072004, "uuid": "a5c84be3-da26-4daa-bfbf-5c2bb4afe15c", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIrvwKNdlIhtRSE8KaDtyvLGVQx:MLV6Bta6dtJmakIM5GTw37ax4L2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779072004, "uuid": "ad340287-8510-4549-b801-142f5efc3e14", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779072004, "uuid": "0b8a2b50-096e-4acc-a974-e066af28be51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779072004, "uuid": "30a1dd21-39d6-4ea4-97a6-f30cb0fe738c", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7139df5d-5250-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779064087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064087, "uuid": "ca058998-5b29-4c54-9f76-e4d225b3429e", "comment": "Malware payload (Mirai)", "value": "9884aaef49ed875be101179150ca357b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064087, "uuid": "d77f0313-2e00-47fc-b8ce-48558ae60f8b", "comment": "Malware payload (Mirai)", "value": "224a5c22ef8ccddf925b16f1604a4db959173a0b7492cb7c0f34938b02a03c62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064087, "uuid": "10e40b98-8316-4e59-a2c4-57c6f4be1b8e", "comment": "Malware payload (Mirai)", "value": "bc67da1896715d69d0ef76c30680ce1131f57da1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064087, "uuid": "89d0f49c-8869-460d-9685-e41bc3827b2b", "comment": "Malware payload (Mirai)", "value": "e4c3b056a0ad4022d6c9172a741e575bb7f410f56fb6e00bcaa2ad8ceaacd446c3121990697d6c83d81a227c837dce87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064087, "uuid": "f9a6bce4-c469-4039-8fe0-fabad6b8a24e", "value": "T18D6301BC32EB8030E0DDA522664F22307371DB9AD43B53DE3E85B5D9F2565690913FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064087, "uuid": "22f56c77-df36-4513-af17-305e16341384", "value": "1536:hltrI7mDmde7Lletk8cghgLFPjihgulh6DoI153rPb:hl+YmdkLMk8c5PdulIf3rPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064087, "uuid": "3d8cd9f2-eb4b-43e7-8e0f-a1bcf8bbfd22", "value": 70848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064087, "uuid": "315c9928-6db9-4f07-8dbc-18cfcb76f453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064087, "uuid": "d8c152f6-c6d4-489b-9be7-5521ff79452c", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01ee573-5283-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779086177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086177, "uuid": "684d8262-e4d5-4ed1-bdc1-3ee7d2cf8447", "comment": "Malware payload", "value": "5270df82e5558a016692581bfa4de1c2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086177, "uuid": "0eb2ea4f-7911-4f12-891c-252cdd56ead4", "comment": "Malware payload", "value": "2548ae86214f67a74ec4f04694cc7aab81eb90ed4c90907f888d59e363ae0e08", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086177, "uuid": "37947954-f78c-49ac-bfc4-7db645a6b948", "comment": "Malware payload", "value": "79e545daf3325adca0c7276b4b5243d699cdfb98", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086177, "uuid": "9b873dc3-2c64-4074-b80d-60d09e522ee0", "comment": "Malware payload", "value": "0ee5fec583b83631c457489f17f5fe10db37185cad427df8bf91487578d5f9c1ec5dbf5ded755b94d1b6f400e9ce01a8", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086177, "uuid": "41ce7967-bf41-45e4-b48f-0ebcb8408c04", "value": "T1E0821A2977B450A7018726BAC4CEE119AA19811B516D2DA0BCCCC2C0FF7652EA7F47F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086177, "uuid": "ce572f84-c2fc-44d0-a736-26d3cfee7c2f", "value": "192:nuPRs1Tidas1hPBsUNRcqKAE66vbm+zbeTb9xGcbzxy/bkbnRuhIH8QvmAQ58UDY:uYmHXyGlUn7DvuoLg0C79JhgSrvRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779086177, "uuid": "71f7df61-4b7a-466a-bee6-6cb88069294d", "value": 18430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779086177, "uuid": "18806593-803e-4e48-ae9d-3d249fa0afef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086177, "uuid": "7cdb95be-7dac-48e4-b875-89bb077adb67", "value": "ps (3).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ec9407-52d6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779121782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121782, "uuid": "9e859ac8-70ee-47c5-9c73-1bd7e942d58e", "comment": "Malware payload (RemusStealer)", "value": "afc3835568ee1fc628f1765c56d5d835", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121782, "uuid": "45334776-f4c4-4266-a393-0ead68b68649", "comment": "Malware payload (RemusStealer)", "value": "295e4b156d04e55df217621ddfcd250578439e13ba22183fed78f505ffb6c44e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121782, "uuid": "80daf7f2-b21f-4054-82e5-0e18658c123a", "comment": "Malware payload (RemusStealer)", "value": "e5b7cd0deaff38ce081ece6976afd0e28f8fc42b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121782, "uuid": "2cf1767f-b574-4413-9ea6-13ec0ab1c072", "comment": "Malware payload (RemusStealer)", "value": "02c452916231df15a564a4fb10273b5e87f4f65c2915700c3be67ce81a9e6af1ffa6970e61cfa6d415a4cef355ea4582", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121782, "uuid": "af60b0c1-77f0-4115-9518-5100cabebafe", "value": "T13D163B03642510BCC1E9B13461F97D50EF2130487B2C2B974A93ABA46F3BBD25D767AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121782, "uuid": "2a361dd7-f65b-48ca-89db-9edbde8d183c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121782, "uuid": "00b173c5-49f3-4ecf-b653-4ffd4303e468", "value": "49152:AaMepGpeKnH9KDg7NVJOFBVP6R0T+qHxtvQyTYgE5AI3Bj:AaFwHYaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779121782, "uuid": "fe4026d9-d985-422f-aa67-fab7ad7e7d23", "value": 4202688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779121782, "uuid": "5d947885-8087-4c6d-9ad1-f12dc2d3c142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121782, "uuid": "c817ccb4-f679-409d-8ecb-29729a0ae016", "value": "WW24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2add63ad-52f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779133547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779133547, "uuid": "775242b9-a209-4067-892c-d7ed18c8f55b", "comment": "Malware payload", "value": "bf61d88f9de87ad2e773d0ed8fca26f8", "object_relation": "md5", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779133547, "uuid": "07dffc5a-33eb-4c0f-a1db-1db88988402d", "comment": "Malware payload", "value": "29d4a55234815d466892052847d58e9d7eb9edc6bfc5c197bd978da2c1605be9", "object_relation": "sha256", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779133547, "uuid": "1bdff38e-6633-40c1-b877-b664b41c5575", "comment": "Malware payload", "value": "2f1627d2b82ad178e375a2a18789004dc7217bc7", "object_relation": "sha1", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779133547, "uuid": "8b042710-c2ff-4750-900b-f5445ddcc8c0", "comment": "Malware payload", "value": "2b220fbd8c5faa0609f63eb126bc4d7aa8ed6a6ad22648939688a8c41058574ec5de1dcdb52a0191107bb9071164380f", "object_relation": "sha3-384", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779133547, "uuid": "26e9d6e2-6513-44d3-97d9-fb1d241c245d", "value": "T10E51E1678F2543BC53CAC2D29960B227C6F8D383AC2470BCB764C0DBA91D1D1866D763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779133547, "uuid": "571a8b62-f7ba-4b0c-824e-277adebdf26a", "value": "48:2xiDO2PlnIKTBt5l0j+hrijCvqqDCVx37MLo7AcRlC8C+clnhODsL0lhre:2xiDO29nIKTU+9k6qqDoMaA2g8C+clht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779133547, "uuid": "85960635-20d8-4c65-afe8-12bb487b0239", "value": 2638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779133547, "uuid": "57ed2866-828f-4047-bf95-acbc22306131", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779133547, "uuid": "9aba7f7e-bb78-4a07-aabd-1c87213dc1e6", "value": "TEAMS_AGENT_SETUP_V10_14_4_RW.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1635827-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144188, "uuid": "23f663d9-0038-4ce8-9396-65d757cbdc44", "comment": "Malware payload (Mirai)", "value": "25003df8d7fdb48ea77ae49c17eec01a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144188, "uuid": "fa8a604f-0718-4d30-95e9-8bd8f933eb97", "comment": "Malware payload (Mirai)", "value": "2a61ed18c31ee7545ec8491a03227b7ad81ac1590d082e60e1027795d416bab0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144188, "uuid": "2151caf2-04cd-45a4-ad6d-f861a5a00b65", "comment": "Malware payload (Mirai)", "value": "acc418a7cbec76e3ea461cff6bddb1f9669c3289", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144188, "uuid": "38343134-74c1-4947-bd19-ee182ad09768", "comment": "Malware payload (Mirai)", "value": "e2f44b826337dcd708289a636957eb1bca5c62a28070291db873ea22f975e16b1d29252422115065dcabe6c0b1038ca9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144188, "uuid": "5dde264a-d785-4c0e-988c-86aa48641f43", "value": "T18AB31851BC825612C6D612BBFA6E418E375623A8D3EF3213CD255F203BC7A1B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144188, "uuid": "c7d59646-aa25-4fa9-b55d-9f7c71b7e5c3", "value": "1536:7jcuL8lzTm/NWSGmQAf3ilNUsdnS3qF4h7Fo1YWOavLKX4zZ5thK1rKcLl6DUta2:7jcKamISANUsdnS3qWJnWFLw4zZlfjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144188, "uuid": "cf6fe03a-974e-44d0-9c52-072fcbb1af29", "value": 112020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144188, "uuid": "4b2bd1d2-ad6d-4237-b756-c46498702864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144188, "uuid": "4b6f1b62-6752-45c3-b046-69f0a091ffdd", "value": "heilong.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263e0402-5258-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779067397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067397, "uuid": "20f41633-7c1b-4b68-9cb1-02f516b6d48b", "comment": "Malware payload (Mirai)", "value": "fe3d74c916e4c86340f20f9b7f6f69b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067397, "uuid": "0eafa07b-26cf-48e3-853b-8a5477dc78cf", "comment": "Malware payload (Mirai)", "value": "2a698655efb8fbb804897433a17805772f0d66f8c9807ba6bc29dbd078f43e22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067397, "uuid": "c3fc68dc-6927-439e-8a8f-69e047219b9a", "comment": "Malware payload (Mirai)", "value": "1fe6025b840731bfdb1343fb120c42c1abdcd619", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067397, "uuid": "3080b4b1-9a23-427f-87f4-72bc29e484cd", "comment": "Malware payload (Mirai)", "value": "8eb66a3491d6460c2e0083323af18b3b61fe6370c1e106bc9c91efbaf4e995a7ca91b54254018c2550ba2b915af47dbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067397, "uuid": "942a5c42-0e3f-4b6b-bc7d-21dd8cfeac10", "value": "T187631A869962DFB7C105F0B069F95E790B5AB8565A2F09E86439D6E0034F4CBF00F7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067397, "uuid": "0bfc9b96-1336-4cfa-90c5-363b2b937446", "value": "1536:zZv5bOaauxE2ZRg3Y0XQlbiKVNk1C5zA3CSVrD0wh:zZv5q1XuVjzA3v0wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779067397, "uuid": "a0bacad3-0b38-4856-9c37-1979f615b11f", "value": 69980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779067397, "uuid": "977d9a79-4588-47de-8452-80cdf9bf2045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067397, "uuid": "b845a212-0072-4451-9754-a76dc95ca940", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78722b65-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089869, "uuid": "7ba7d8af-efb7-4f9a-88d3-a7b9d21ddf09", "comment": "Malware payload (Mirai)", "value": "83fd531c097ed59ddd22b00dd433c43b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089869, "uuid": "b6cfe1d2-e979-46f3-9668-22c50833c2d0", "comment": "Malware payload (Mirai)", "value": "2a7d54ba6881ca897caf76b028e5d7dbfd4720d8f440fbd91528c54a4e31a032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089869, "uuid": "b08a8bfd-dca3-4f0d-96c2-d7c14186fd9b", "comment": "Malware payload (Mirai)", "value": "95b1c48010cae89ef3642094885b21f43ff96eb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089869, "uuid": "b939b857-d085-4571-974b-65b5cc76b222", "comment": "Malware payload (Mirai)", "value": "3f0880d46fd3dce7821f0a76c7fb15ae1a2dc2523a09dbf89547f5d0d179059515683ba123f295d608badb9b9556d2e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089869, "uuid": "064b0f82-df27-449a-aa35-f0f55adda3a1", "value": "T14A044C46EB814A13C4D62779B69F524633239B64D3EB33069918BFB43F827DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089869, "uuid": "ec00b2cf-070b-4c8f-923d-db2e78003056", "value": "3072:lBPR0atTo8saehF/h9XRpgBcAwjCK9RUdqPyoWAM/9ukDm1M:lBGCPsaehF/h9hpwp6CcR0qPyodM/9uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089869, "uuid": "d321700c-12b6-4714-87ad-67c5b4c3a7b1", "value": 176523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089869, "uuid": "d44b51a8-852e-4545-b849-c6b22e6de66d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089869, "uuid": "004a6843-3de6-4daf-b896-6034f1ba2db6", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256f07d3-5277-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779080710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080710, "uuid": "e258e35e-e335-41c9-9973-3b26f8404bb7", "comment": "Malware payload (AgentTesla)", "value": "3e97daa3cdae270ffd6bbeba2f145ba1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080710, "uuid": "cf17f113-a258-4cab-b6f9-dbf4a22cd53b", "comment": "Malware payload (AgentTesla)", "value": "2b8819209c0a0fb3e00adb132a31d72604c63b1b6e8a380c9c08048868be7c03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080710, "uuid": "6b493de8-b842-4643-99fe-a2ba2ff124e6", "comment": "Malware payload (AgentTesla)", "value": "7f77096789db0c00e93c95b64774b5efc2af2711", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080710, "uuid": "41a89c91-c96d-497b-a3e0-ed4f4f2aacf8", "comment": "Malware payload (AgentTesla)", "value": "13ef29192c2abcb310714c3aa6456d895605530a1ddd299711caa91c1bdbac67dcca5a3f8692e7859741fc60c49ca3fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080710, "uuid": "db8b8c96-3ddc-413e-8865-2f46e5863dfc", "value": "T1E735533ACBE90115F1B79B14FDB41416E83E7F662A2DC9DC1181028F477290DA9ADB2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080710, "uuid": "13551873-c8d4-4c1b-ba44-f1ab1e8da4cb", "value": "6144:yVqz443fJJfSzLKEkBU36c0khhxu2UFfAgu2d+neb/3HRWnoTPxNS2fp0rV9DwMJ:pzFqePe2kneDR12Lp9Dww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779080710, "uuid": "12fac960-cbee-4ba0-bea3-14ceaa3d80f9", "value": 1068244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779080710, "uuid": "be3ab59a-28f1-4762-b8a4-447cc9928328", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080710, "uuid": "48617e41-ca22-47c1-8339-8284578747b1", "value": "PO2144R SITCVN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbd3a8f-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091030, "uuid": "0e397b65-6a43-47c6-9dd4-3ba40e444bb7", "comment": "Malware payload (Gafgyt)", "value": "12b87fa262ce7c4b6aa366fc54d167ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091030, "uuid": "f9f916c4-95f0-43a4-b653-b12d6eda969b", "comment": "Malware payload (Gafgyt)", "value": "2ba0efc355a22ed586133e4eadf6f2736f3df6bf38798ebca47f75bdbba067ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091030, "uuid": "4917ddb6-ac53-4478-b19e-dcbeb0f794af", "comment": "Malware payload (Gafgyt)", "value": "6a9b52abfabd1a74c898febcce09bd248fddadb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091030, "uuid": "df9f63ef-eca2-47ba-aa5c-f5752fa3a3bf", "comment": "Malware payload (Gafgyt)", "value": "3817fd5893e9d3411684c9ed024bb1b9da505169cfbcbd9ed13635d29541f84ba5bb1c0454922b393a1be2e66c5a098c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091030, "uuid": "24399af9-2569-41d0-8607-f3cac16b534f", "value": "T162242A93FD05DEE7F40AAA3605D30B207231BF660A532932B2577966DA3A3C4742BF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091030, "uuid": "eba8337b-cb63-4514-bed4-d9b0f0a2d399", "value": "6144:xlbgP6bQJeWPPquqLnHyhAWpmxQLdD/rHk/yPFt7CW:xlgPt66mxQLdD/rHk/yPFt7CW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091030, "uuid": "039f8662-6532-47c1-9b3a-08fa57f8fc74", "value": 213227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091030, "uuid": "5e37676e-d7c1-4459-aff5-7cc930579b8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091030, "uuid": "5416e876-2126-4321-8404-df44aed74e02", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdd7400-5250-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779064321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064321, "uuid": "4ff4dbb5-9a78-42b7-94bb-3ebb252b3b64", "comment": "Malware payload", "value": "d12ba930315cef53664e9939084cd454", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064321, "uuid": "8afef667-9b69-421d-8810-bd6b5985cdf8", "comment": "Malware payload", "value": "2c3f814e49ed009187a76d448c92bd1b730817297949906a2fed73d0e2276644", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064321, "uuid": "aed1f37e-229c-4424-bb52-8b751179b9fe", "comment": "Malware payload", "value": "d024d45c963b3904d9f99b565b77686c9eaadb13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064321, "uuid": "f5f2c54e-5dee-4ba3-962e-64ddf9944748", "comment": "Malware payload", "value": "d192dbbe7a403c167efb62325d99c696b7f1c057cc17c3c0baf987e6939b9509b5b7d68c7d945072c965b3eb7a0a5837", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064321, "uuid": "dc06579d-bde9-479a-9659-c7427ad8fa88", "value": "T129A3F949E9116B19C6E232FFFB8E428E33135FA8F3EA3025CD305B6133C5A965A75521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064321, "uuid": "74165d28-0431-4d43-8f6d-6183ee1e59e7", "value": "1536:B3FnXdoS75GC1foyt20ya1qjglomVWlzyDRiu3s6n3pn4mMcNCY7r28gK/:BhdoOvN540ya1qjglddn3pn4TkCU2+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064321, "uuid": "cc90f98f-8844-4adc-a090-f930b939eb66", "value": 102976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064321, "uuid": "4d55c146-ef77-48fc-8d84-5e985ac5f82e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064321, "uuid": "9d80960d-aba4-4539-854f-a769fab331f4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f2f203-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089818, "uuid": "a53c36c1-8ed2-401b-b462-59023dfde1d3", "comment": "Malware payload (Mirai)", "value": "89165531afbefb74831686dcbb560399", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089818, "uuid": "3d4bf85d-db7e-4e26-8f34-29c35fbfe7cb", "comment": "Malware payload (Mirai)", "value": "2dab510bbd20ee2d5ff06d05d07988b8c2e62bcca86140427faa1d5b49d9f609", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089818, "uuid": "a65aac66-da2b-4808-8667-2d4754d4f01b", "comment": "Malware payload (Mirai)", "value": "5f3642eedc57ac3478d6694ed9e95badd5fc838f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089818, "uuid": "47d525d1-1d06-42a2-a62f-913a2761539f", "comment": "Malware payload (Mirai)", "value": "e0b19ab9a0c8343c06bda95750aacd8a5459841616bbd6065936e840300aa8941c416dfa1037e46f3f5ed539ca94df1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089818, "uuid": "22db8900-e47c-41c7-9453-5643a63fc2ea", "value": "T1C013F130395FAE70EC74DA70F77581A1168312F1D2FB68333205A854519A9176BFEA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089818, "uuid": "8ee4c024-b316-42f6-97f5-1d99acf50a6d", "value": "768:Rt7bV6m0zw86qK9JGRgbUzrskZYIHZke+CkFWjq9yLE/9S2m2JNG3Heda6Bcs3Ub:RT30N6/JGNz38P/WqYElSING3Hedayzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089818, "uuid": "20708144-7478-4159-b8f8-00efc189e3a1", "value": 41628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089818, "uuid": "22fc8731-f621-4bf0-8a94-7d458c8559cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089818, "uuid": "1edcb681-1aa9-4442-bbf9-9f25867a3b92", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd50061d-5283-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779086173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086173, "uuid": "52e1c9e3-fb51-4332-aa09-441bf887d1bc", "comment": "Malware payload", "value": "13995b9b3babb4cfba28061c08335d31", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086173, "uuid": "c1818fff-7cee-4f42-87ab-2dd6842fd4df", "comment": "Malware payload", "value": "2dae8b4f07cbd251b0b007efbedde149dcb1eb8b85935fd33d69e96f2fab8ff2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086173, "uuid": "fffc7ba6-5fdd-4d41-a2d6-7b844af45010", "comment": "Malware payload", "value": "8c9d16d6e87fa943d00afcc5b760d7c9cd0a23ca", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086173, "uuid": "ebd46b36-7eb0-4d25-92da-db0af71f2f48", "comment": "Malware payload", "value": "22fbed8e45297b2100fde1659efca51b02d74166b33e8654e11db60a33e86e43f8b881f7b4f21a8657cfc314c1cdce5d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086173, "uuid": "3306539a-411d-4187-9e7a-b2439d5d0fbc", "value": "T133822A1A737B04F9444227E9D6DDD2089728522B911A5E9078CCC6C8FF6193EA3F57F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086173, "uuid": "4b71141d-3f27-41b9-a137-7b1258a6f1d3", "value": "384:+vB/3TGs6A9f5r0Gy6naFNPePPoLgkjkZSU6tN+BFSDyAIJ:+J/T96ATr0GxaFBeXoLgkUON+BFSDyAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779086173, "uuid": "44c67390-60cf-4130-9195-85951b396321", "value": 18107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779086173, "uuid": "ed5eb316-1615-4f45-a1fa-5bd7d8f1b578", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086173, "uuid": "97ee72cf-4918-49f3-9f28-4fc0773c19fc", "value": "ps (2).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e97d921-525a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779068431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068431, "uuid": "54c9b08d-46f8-4cb7-b27c-72ab3e64035b", "comment": "Malware payload (Mirai)", "value": "58d3a17b705e09d053450c0b5b9fe62e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068431, "uuid": "41da27d3-6ed9-48d1-aaee-cf7f87fa12bb", "comment": "Malware payload (Mirai)", "value": "2eb175d394a3f094f974ce6740f9446bd4e6e0d36aaf4ebe31d39cbb39c52a7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068431, "uuid": "3849dc86-ef01-4219-80bd-abdb5bced329", "comment": "Malware payload (Mirai)", "value": "46d3129f0a8f3df4036a5b9419f1b98553814a25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068431, "uuid": "e61a0ed8-b0cd-4f7e-8dc9-bc0640b8d73c", "comment": "Malware payload (Mirai)", "value": "2cd25aa72001e5cf6a3c15d5a0dafb61dab181bf051d331c54d4a13eb69c270b81b469276234335a82ace38ff5466047", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068431, "uuid": "f2242073-f623-433c-ae2a-36b0fba7970b", "value": "T17EC36C06A591A0FDC086C67447AFD133FA76FC8A12357A5F27D1AE312E6AF113309792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068431, "uuid": "413b1ca3-38ad-4925-b6b2-2e9421f4c67e", "value": "1536:WgsKQzObGbU6B6G/F8vzlsXn1vVXwC4Vr8pbIS/Xd2mbJtnbCf/hiSYorUw:R3szWv5eVeVribddJFb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779068431, "uuid": "a859eb1f-2490-4ff2-9caa-7897f4f1f868", "value": 121240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779068431, "uuid": "6834cc7b-a89b-48ed-876c-b0358216a9fe", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068431, "uuid": "d58f3e42-7839-433c-ab35-a1cb88460555", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e58e8d5-525b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779068834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068834, "uuid": "f8a666f1-3e4b-423b-bf26-0fe55adad705", "comment": "Malware payload (Mirai)", "value": "03f64d7f0be2fd588f002e626ceaa917", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068834, "uuid": "eff5fc8a-53e6-4aac-a23b-5f72f7750a30", "comment": "Malware payload (Mirai)", "value": "2fc78af612168b531234325f9519427df1a905cd847b1ae29daacf9e57b52ba4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068834, "uuid": "d9aa2b40-e5e4-4a21-817b-899cf5389225", "comment": "Malware payload (Mirai)", "value": "055569ef2279a1aaed93f48e67076bddf8ac38b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068834, "uuid": "810e61fe-a76c-4ddb-842c-1e6805677717", "comment": "Malware payload (Mirai)", "value": "2277de30314362daa36a8c127b6025b85727ab578083b5c06458312be0adbb941283ea196459f9d73e7ff62b3f5b893b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068834, "uuid": "41784091-873e-4b5c-af51-eb7c4ff67926", "value": "T19AD319A6F880CE62C6C12BBAFA1D428C73530B78D3DE72019D159F3466EF9560F3A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068834, "uuid": "7d0b8a1c-a647-4483-ae8d-2a928e599fe4", "value": "3072:upC/MsgPV87nGoh9QYzoliD6VSW6U2EUbhdXKbu:umnnh9QYzo4D6gW6Gbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779068834, "uuid": "8f0f9469-98ce-4a3a-9327-c3ea6ac34d09", "value": 133100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779068834, "uuid": "a04358a3-f6da-45a3-be96-ee826b0d0c66", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068834, "uuid": "96a53fdc-f454-42ba-be1e-4aa7566efeb1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b621d4b-52aa-11f1-a769-42010a9c0008", "comment": "Malware payload (ResolverRAT)", "timestamp": 1779102678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102678, "uuid": "dc690cc0-a860-4fe7-9ff4-7eebb3c672c7", "comment": "Malware payload (ResolverRAT)", "value": "504369337d62d78887c7ca59e96b865c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102678, "uuid": "4d4a8a27-8144-416e-9c02-b54e62fb69d7", "comment": "Malware payload (ResolverRAT)", "value": "2ff33cbb55dab6dff97488724a35f8c791635293ef5689ade472894ec1ac9632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102678, "uuid": "1ff56202-6167-463f-b4c1-504d5d6bb858", "comment": "Malware payload (ResolverRAT)", "value": "f431fcfa23f1d35a038afc577d043226b6039ef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102678, "uuid": "8d3e596f-7624-4d5b-85b2-dbdce71b6e9e", "comment": "Malware payload (ResolverRAT)", "value": "38245a439e708cdbc6715851123faba4f938dbb5958ed5b39d6254c9992f16628881283e619371263e6b1bafaff72760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102678, "uuid": "527f5adf-c5df-4ade-b508-0ca9ab922a27", "value": "T1D9C57C10FE9754F2E806153189A762AF23358D491F32CBD7EA487A7DF9B7AE10836305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102678, "uuid": "82711344-e16f-42c0-9730-57ff1ba3982b", "value": "c6fb30ad4dce883317a7260ffcbc1a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102678, "uuid": "e9460783-09c7-4c14-b20b-ea723d3ca0f5", "value": "49152:O10qUjV1rWlhVbTbROsfTPQ6bkCcvgxHImfVS:O10RV5gRHfk6gCFomfVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779102678, "uuid": "ff4d5aef-859b-4172-9e7b-782a88dd8cbe", "value": 2678272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779102678, "uuid": "f70a0ef5-3d17-477d-8ec8-e191f0db0492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102678, "uuid": "219f9409-2222-44c6-a3cb-6981e19d3190", "value": "504369337d62d78887c7ca59e96b865c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7f42aa-5283-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779086168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086168, "uuid": "e25d2720-d1d9-4bba-8052-4af45e3a752b", "comment": "Malware payload", "value": "f75e5a86029b62e44be2bc94b1c5ae23", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086168, "uuid": "9f228b4d-6ce0-43f3-8696-48be10b89ed0", "comment": "Malware payload", "value": "3359f1aef5c796d1998f3c74dfe4a6bf464f1839fc5d3bcd7b32ddb0956a5f9e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086168, "uuid": "1e3a1db0-fb50-4706-8ead-8e450ea8e2ba", "comment": "Malware payload", "value": "5986026f3a72181eb8605d91c833ce785b770403", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086168, "uuid": "c015d5cc-2e79-4a44-b602-878ad584f03d", "comment": "Malware payload", "value": "5ee95483e2649a5a8360cfd2c371c6d52352fbc24da24178da45086180efc3845be182eee529e0171a861c3cdd9a9c8f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086168, "uuid": "97d8016f-806a-4de0-b9fc-ab32669ed124", "value": "T1D482B826776515A2414327B9D2CDC20D9B29859B215A6D90B8ECC380FF6273EE3F93E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086168, "uuid": "17aa60a1-ce5a-4898-97a4-0705109fed03", "value": "384:8pc+8OhjiZSXyJnH7EboLgr+XUkK0jjdUj:H+rjiCYbkoLgrIw0lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779086168, "uuid": "bce12a04-79d9-4e35-b982-cf13c61ac602", "value": 18490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779086168, "uuid": "7be4d236-7cf2-443e-a85d-992d6af1d398", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086168, "uuid": "9419b5d5-2fb8-495a-bbf6-bda88c79ccf6", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2faee4a9-52bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779110792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779110792, "uuid": "a9759484-97ce-442c-aa7f-ed30e59d9637", "comment": "Malware payload (Mirai)", "value": "ce7bd51f75fa116be67854000116b3e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779110792, "uuid": "cc207fad-1ed5-4134-a1e4-80c3774d163f", "comment": "Malware payload (Mirai)", "value": "3466f7c680b7b945b11bd5f0702108321257cd6b04910f66e16657244bd41a73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779110792, "uuid": "bcc2b614-0622-4774-9f88-32c19956677c", "comment": "Malware payload (Mirai)", "value": "f9588076cb7e4bf86932947aa7bbaf55feb2b241", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779110792, "uuid": "bc833e60-b022-4388-a5a8-d0a82b59c8d5", "comment": "Malware payload (Mirai)", "value": "4f5d4965a8f4e1f61c092789c8a4ac145cae863ef82303049059d4aa619218b28972262d7cc00e3dfc4f205c9e482f90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779110792, "uuid": "6413ffe8-5933-4e78-b80d-26bf671e0ab6", "value": "T10EE30846F8819F16D5D112BAFE1E024E37231B7CE2DE72129D246B347B8A87B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779110792, "uuid": "cb82e6ec-dab5-4935-8b26-ae8f2fa6bcf6", "value": "3072:BV4SFFTq10WzQXEOfaPvxDqng3QCS1adh:vPFq10bXHfaPJDqv1adh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779110792, "uuid": "f9d7db35-c290-46f9-912d-116c16c28293", "value": 145872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779110792, "uuid": "c200d9a1-aae0-465d-a113-bf205d74bf92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779110792, "uuid": "fdbcca67-1287-4ee1-95e0-6ff2a635b29a", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f878806-5258-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779067520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067520, "uuid": "d9d055a2-0260-4e55-855e-01e4ba1a7467", "comment": "Malware payload", "value": "3473044d0376320122482639517cfbcc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067520, "uuid": "73d9e85a-b026-4e0b-8ebc-702293144c2f", "comment": "Malware payload", "value": "347e9d05feb7736b15a1890c59e006b58f91a1545110398d80ef036fdb9cf4f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067520, "uuid": "4337634d-dd8b-496e-8b70-39a53df57cd7", "comment": "Malware payload", "value": "ec4decf6a6afdb17d989c99f4a3e141e36e2dc2b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067520, "uuid": "eab2f26e-bb1a-48fd-9a80-71355b7af631", "comment": "Malware payload", "value": "c9bbdc7e7f831de130c268af85fbd3fbd4e2390e0022930ef7febb0c54ec884f933a80f323e8419ddd5531902b28abf4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067520, "uuid": "46aee145-95da-4764-b863-c6c05ad939da", "value": "T1B1136D6516953C25AE99883B5D7F2F0CBDA983E2304491DDBF8A3CF18C15A9CE318B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067520, "uuid": "ff61edda-0d38-4b76-aab1-7b54a5346843", "value": "768:rr9NyXsZztCt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:/HusZ3co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779067520, "uuid": "5425e0fd-c29e-49c6-8c0e-7eb6d2b26beb", "value": 45533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779067520, "uuid": "e693dc8c-6df0-4feb-97e6-e2bad285957f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067520, "uuid": "a269d945-8cac-4b98-b34a-cf6afcb22e61", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8def3ad2-52b1-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1779105796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105796, "uuid": "781490d6-2315-492d-8081-2fc368a19574", "comment": "Malware payload (PhantomStealer)", "value": "4f2b02e2b100afd5690a2687be3d3c38", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105796, "uuid": "bd3816c8-66ec-4d58-9b26-30aaa5f50fad", "comment": "Malware payload (PhantomStealer)", "value": "349f1bc3352ba3e444d627ee88cafd869cc0da219c28c3e59803853cd43fcfbc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105796, "uuid": "e2617272-74a4-409e-a407-007e01871362", "comment": "Malware payload (PhantomStealer)", "value": "6cd61127bb76fcbefd15faeb87f6d5a89918e12e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105796, "uuid": "844fb2d2-16ef-412f-b38e-a7845c8d6b8c", "comment": "Malware payload (PhantomStealer)", "value": "715cd47767cfda3b80c814fe27aecd4e41e50ed88a2c932d4f27f1a9e1f5877c951df7b46f6e131a0486497dd033bad0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105796, "uuid": "2ec4f679-5ac0-4753-b63f-5beec3de646b", "value": "T18FD39344B2D1BCC813C32BA7361BB1EDE86E089E3D445BDBE64CF8A47674616E5E8530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105796, "uuid": "40e6b34e-ed7f-4085-9f3b-f44e5e038a4b", "value": "1536:clhuPkqNRR5ilbyjgokgUV/qsbLEoJF9rHgA/C8PR9AblTqRtd64qCOAqQ4XqR1b:6Y5NE9rZ6oL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779105796, "uuid": "e7f330e2-22bc-4180-8464-b9cb7c372483", "value": 142241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779105796, "uuid": "e9e216d0-4468-4ee1-8757-d7f2e162aa4a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105796, "uuid": "2a69405f-028f-40ab-82e2-9c7d901be9f4", "value": "DraftBL-PL-CI_ref2605185674.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1e04f1-52d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779121655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121655, "uuid": "b9e37f5f-e77d-4e13-a9b3-6b9b05d0ca01", "comment": "Malware payload", "value": "fda0bcfc3a729d0e552891e4f29d2d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121655, "uuid": "f8febfa5-6d65-4651-b590-0506e1360321", "comment": "Malware payload", "value": "3502b5014d2c88fa28b20f6779bf97f24370f6f53d719b66cf8da41b1331fab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121655, "uuid": "4561a414-6c99-4cc4-8d46-3c373b06849c", "comment": "Malware payload", "value": "be4413e302da96adbc940547bdfd25712f9ccc32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121655, "uuid": "caff0505-c270-410d-9f8b-3c235147e698", "comment": "Malware payload", "value": "cc318d58a67a9ee656486c33b18914b3647655225d11bdfbb96932a9ceaaea7e98c0bcee33016cb4085a86de8d191d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121655, "uuid": "feec8a71-b99f-43e5-aad3-74763440f512", "value": "T103E623E995D522F4C5D30A80724E53CE71D0716E46F9AC2836DB2C026F72DAF164AEB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121655, "uuid": "dda889d2-a36d-4ef9-813f-ad58f37df5ab", "value": "25c3e38b17b1d56755dab8d40f96b957", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121655, "uuid": "811d27a5-ea83-4f94-868c-bed5ca70ccce", "value": "196608:mQ7UZSnNkf+jKcdNwlK0Okxi41DTu3yb5yh7fkNoPmUMyoXUfWY0Y7GHvCXGtB4u:mQIqkf+jKqNwLOoi41DTV1ivjWB6XGMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779121655, "uuid": "74fc4f18-1e2a-4fc4-8c3f-864c7ed6bec8", "value": 14028064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779121655, "uuid": "158e5a5c-483f-403f-84bc-458aff70424c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121655, "uuid": "feb5fc61-85d6-4420-8b80-d89a37a6b54a", "value": "lunyrax-inj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423fc23f-5251-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779064438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064438, "uuid": "b357f68c-daae-4f9f-bd16-589ace8ce670", "comment": "Malware payload (Mirai)", "value": "7a995d6b1edeea5e2a5f1e1e3b8e8131", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064438, "uuid": "33decb7a-43ac-45bb-b1a3-0305b0b35777", "comment": "Malware payload (Mirai)", "value": "369ea644e59db3ef1068d7615223835628388b2e3ac5c6aadc83b871c061611d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064438, "uuid": "3c3ce8c8-fb4b-4ed5-b36d-36ae8787dc45", "comment": "Malware payload (Mirai)", "value": "1029c3f45c7e874da3d2da4be0d5c789b48311c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064438, "uuid": "b428baaa-6a95-4893-8a0f-bbf9df14736e", "comment": "Malware payload (Mirai)", "value": "94bc25b7724b55865a220f6669a1d39c2ae2c10140afa80c2844ad8d00c838d5b6eeecaa4b5b7bf803dd9839147d239b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064438, "uuid": "bfffe37f-c1b9-47ff-a059-5c4be9bd88d7", "value": "T1B9737CC5EA83D6F0E85205B4A077EB379B36E5350029DE03E7A9EA77EC17900956B34C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064438, "uuid": "d17312a2-138b-40d0-a19e-40eb0c492417", "value": "1536:oUUqHgOz7z88oFZCkLK4IZDEPaESzFVM2S1T:oU9J7Qt8YbIFECfzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064438, "uuid": "cfce0e53-97cb-4d85-b941-1ac39ce530b6", "value": 75316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064438, "uuid": "fac07b42-7577-4df6-9474-24a4d9adf09a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064438, "uuid": "95df53fb-bfae-4137-bd9a-3ae3698fd172", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a6a987-5311-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779147018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147018, "uuid": "d8805990-4527-4144-8934-d1fe561f5d23", "comment": "Malware payload", "value": "67b8476de0e972dde9968860a14d8574", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147018, "uuid": "9af27e3b-010e-4135-937f-d3b3a0c710fa", "comment": "Malware payload", "value": "36fc695bef786060cfcba7380d3c0714167074012e87c82443be104a1489edd5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147018, "uuid": "c541f8d4-50ba-49d6-be10-19e8211a1bd2", "comment": "Malware payload", "value": "1296edb72ac0c68630e80422027e01e4f0c65911", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147018, "uuid": "30dede16-bd23-499a-b23f-544ff5b35ddb", "comment": "Malware payload", "value": "38e578ab7244780e1c966cfdc37fbf09696c9faf46e38d6053fbaa7fc005de9adc0453416b7b7b05f0c9f3370c5166a3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779147018, "uuid": "d21e2989-d012-4f99-9237-da3e3b0872b6", "value": "T1F545F42E730F3476A4C808791A1760DE2E148EC1632EBAAE7B194AD36F5DCC61723D57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779147018, "uuid": "d44943a9-741d-46e8-8006-8cee5de7fc10", "value": "192:GTSWFWJ4sK1Fpacjsv2rYYD9BBTFks6KmaRMHNHi6sdb/1i3/yssDQLBK8056p7L:5p77J2ZTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779147018, "uuid": "df112d3a-84d3-4b9e-b332-39cce3ca848f", "value": 1247694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779147018, "uuid": "dad6e0f5-2cbe-4132-b0c2-e64f265960ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779147018, "uuid": "ef68d8db-3196-4f14-87f1-bc04183c0f16", "value": "dikomn.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fada38-52f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779134479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134479, "uuid": "c3d0d034-ff2f-445c-b84b-2d70378ab2b0", "comment": "Malware payload", "value": "06b472438562eca18247040a10bc8021", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134479, "uuid": "dc302592-a5f7-4ec7-9ba2-2d51f0e106ee", "comment": "Malware payload", "value": "38c9b467d642a05fa1a5fa68eb106d4345cee56aa73f51fd7085fed4d5170214", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134479, "uuid": "02ba2d6a-64ab-44e8-86af-7dcd758c13b2", "comment": "Malware payload", "value": "c98333202f65c6f129adf2447203b33fd1764dae", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134479, "uuid": "04151ca9-93c9-4679-b4a5-6ff539ae3e20", "comment": "Malware payload", "value": "3cc861ef55e1e404757a10cc1bc408a792ffd378e601111937d44fbfb2248083ec89aeec6c4c7444d201162011d48898", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134479, "uuid": "e0a00735-e41d-4979-b877-afec844f4269", "value": "T193F5333F5AF40D899A2BE9FF5D77E96E5272090BCA44B3F45B818122BCA27F0544235C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134479, "uuid": "faf23376-16a9-463f-965e-76119f848251", "value": "98304:mPl96FqqAzq0YBQO8S0xZQ3K3xyYxBNmOnF1B/G8:k6F1AG0gX0vQ3KByeHmEF1B/G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779134479, "uuid": "a9186117-b49d-4b6d-9f24-674d2764567c", "value": 3442011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779134479, "uuid": "7124b065-594d-444a-a55d-5b1ceb3966f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134479, "uuid": "db9a3194-02d7-4fbb-8667-42a0b46f5ee9", "value": "wowjing.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fe9185-5251-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779064681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064681, "uuid": "026767cc-539a-48af-a1e4-6bb2e0fdaffb", "comment": "Malware payload", "value": "f8aecd70bae9ef14db031e11f980e544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064681, "uuid": "36e9a541-69c0-473a-be8c-6a8d02d9a03a", "comment": "Malware payload", "value": "3a37b281c6a2551aafd168f74c4434b38b3c188375b9dcd55c804d8f647a256e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064681, "uuid": "7d9506a2-4536-4191-adcb-f3f0740927d4", "comment": "Malware payload", "value": "bcec83f63177f11cfb934fd35f7bc8e30a8f6e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064681, "uuid": "0fb4e2eb-d2fa-4511-9d08-9625603939e0", "comment": "Malware payload", "value": "14517e44dee97d8b157a922354907310d9780328ff8260b6b30024cbdf0e8790400c9aef4f1eca6d3079d6633cbf856b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064681, "uuid": "8ab0f171-199e-436f-9d5f-22a620c8bfa5", "value": "T1E05318376591DABEC09B91F06BEBD922FC31BC3A0732304563E4BE636E598D02D9D251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064681, "uuid": "c719151d-bbb3-4b1d-81ae-0255e9978f0e", "value": "1536:Bt9XMRD3bhks4RMJQVM2TQcwDJq4ZWvD3xa:BrcVtkseVM2JwDJqoWv7xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064681, "uuid": "a464d0f7-81eb-449b-b9a8-15146965bc12", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064681, "uuid": "fef2003c-4339-4934-8211-b9e009f3f056", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064681, "uuid": "3067324c-e076-476d-9eea-be74547ab978", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308397f5-52b0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779105210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105210, "uuid": "c4481daf-af3b-4164-8c7f-d88f4b1b1442", "comment": "Malware payload (AgentTesla)", "value": "945e70b158e360a52441f46c2d11a205", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105210, "uuid": "af956ae0-4ad5-4a78-94b4-7832f38f2fe8", "comment": "Malware payload (AgentTesla)", "value": "3a4aa0b1c817a4f88f88354a2bb9a73192088af0d5189fe1fc80536b9a4212be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105210, "uuid": "01f583eb-b718-471e-9b63-d0268ccc079b", "comment": "Malware payload (AgentTesla)", "value": "80332b3282ec92bdb09a681310cc7951a4b2783c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105210, "uuid": "d80f71f9-f56e-4472-ac0b-f5897e0e9cb0", "comment": "Malware payload (AgentTesla)", "value": "61356bd55b9f1972f291ecdac335b00c9d356a288efb6f3513f4477fff73d19ab4424a0e30ee18ab3a26bc59d9d09624", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105210, "uuid": "43114361-a926-4a0a-b903-bf30987a2451", "value": "T18D1523629A6ECF56E98F1F12813FCD3285A8DC64C8786D5370CF67D08AA0985B583FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105210, "uuid": "febb96cb-6939-4888-99f9-3e9efe1dd789", "value": "24576:WTgEGHX3sXnoSI/wOh2mCRjm2TUIlYGdEXAdH5KlFrlp:WOHnK4nh2mwq2TFTdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779105210, "uuid": "95d07fd7-985f-4dcd-8951-14ae3aa26448", "value": 923236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779105210, "uuid": "beb06c37-441c-46b2-8463-abb172c16f4c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105210, "uuid": "e9227a77-d4c8-4a67-98a3-66711a2bfa76", "value": "13052026_1722_13052026_RFQ_NEW_ORDER_093847738.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414db6e1-52c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779112540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779112540, "uuid": "a8219aa5-eafe-4231-8454-307471b5eede", "comment": "Malware payload", "value": "2b832d894428b66f2bf82013e19d7bf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779112540, "uuid": "c3be69cf-013e-4772-a46a-f9be62561747", "comment": "Malware payload", "value": "3b691213632b7457032085ac6805800461361cca1cc73d75e74783f890a92121", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779112540, "uuid": "99a2abc7-6ac9-4e24-8c53-5730f05073d1", "comment": "Malware payload", "value": "2d31240589fe042fceb78385d82e06cff86338e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779112540, "uuid": "e3327719-da6a-4633-8bd6-3a35a624beb9", "comment": "Malware payload", "value": "8281cf2f581280b56f6b297c880cd5118b37c6d0bf23dac1be51fe1c809cd22c191bd4e5b61fe581597e7e577907c1c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779112540, "uuid": "4816b946-7a81-4bca-b296-f109f888a0b5", "value": "T111762A97B8924952C4E43637BCBE81C432630EBA9BC7165B6D05EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779112540, "uuid": "69f07a43-680b-4863-b8ea-f72bdb550942", "value": "49152:dvQ3F8K4V6I9k6QE3Qd9hjxw513d0+q04BD3SUP4GFsbmyWkdun5Ev+:Zb6I9klEgd9hjxw51e4GFsKV5E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779112540, "uuid": "788644d7-70bb-4fdf-a42f-201f98dc99e0", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779112540, "uuid": "24c88541-7854-4afe-a843-6fbaf594cb8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779112540, "uuid": "0f9a0f77-ceb8-4b06-85ef-bf96cafdfd21", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ead0c0-5309-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779143585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143585, "uuid": "d039ac62-6355-4dd7-b85e-2900eb04a4f6", "comment": "Malware payload", "value": "5e95caa4bc09c63600e7ad3ef9dfca00", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "hs-imitationfinancialfootwork-icu", "colour": "#1ADBF4", "exportable": true, "hide_tag": false }, { "name": "pw-5251", "colour": "#1E1376", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143585, "uuid": "cdbaa0bc-e73f-4df1-9ac8-e92510f47d12", "comment": "Malware payload", "value": "3c406954e5476a23c8abab5b6ad31c1410a4a06c6bf11e898627391dd3fbda87", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "hs-imitationfinancialfootwork-icu", "colour": "#1ADBF4", "exportable": true, "hide_tag": false }, { "name": "pw-5251", "colour": "#1E1376", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143585, "uuid": "d4816540-ccd8-4a71-b7e6-4106d3638543", "comment": "Malware payload", "value": "ee25019b0eb6bef8323d27b0523146dd5ba2067a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "hs-imitationfinancialfootwork-icu", "colour": "#1ADBF4", "exportable": true, "hide_tag": false }, { "name": "pw-5251", "colour": "#1E1376", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143585, "uuid": "c9791074-6a8a-45ed-9234-b0aa5e61bef1", "comment": "Malware payload", "value": "a7927f608eb4013ee9a2d09599e90f40731bcd79fe04b8ae68829aac55adf4955de9803de736492982b49a13895f3095", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "hs-imitationfinancialfootwork-icu", "colour": "#1ADBF4", "exportable": true, "hide_tag": false }, { "name": "pw-5251", "colour": "#1E1376", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143585, "uuid": "6d58ecb7-188d-4f52-a704-df553539d2c7", "value": "T14C07337E21B5A0B84065C651E33B670AE8DB90DA379CC2E7854F247F0F513BA19E18E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143585, "uuid": "0f8d10f5-bb93-4e66-ac41-0fcf082f6999", "value": "393216:rE+/X9qgmIXz+injYY+ndjjg64JZWsWGZybftycG:T/X9WCKimdgw4ZyTtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779143585, "uuid": "60ca6f03-50f2-4cb2-a9d6-0d8dd70e6374", "value": 18383491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779143585, "uuid": "08fcdc78-5d42-4f9d-a0c0-9832197ba655", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143585, "uuid": "73474361-dcad-4dc0-916a-d35383da6328", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02502fb1-52cd-11f1-a769-42010a9c0008", "comment": "Malware payload (CyberGate)", "timestamp": 1779117588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779117588, "uuid": "b8477b92-fac6-42d2-a485-28bc80aba79b", "comment": "Malware payload (CyberGate)", "value": "48f6ccf3aa2728c5f0701e1b94d55b1e", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779117588, "uuid": "32ec6206-8968-4d52-ad93-aebaf96375d9", "comment": "Malware payload (CyberGate)", "value": "3c41678d0524994308815afb2fa7f98bba1903ba0311128db486f7e67d967b6e", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779117588, "uuid": "9117b515-93f3-49bd-ab5c-12d2fb66b29c", "comment": "Malware payload (CyberGate)", "value": "1dbd4205e8a15d5970bebffd3822b8c981556dd1", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779117588, "uuid": "b8507c75-2f7f-4933-9eca-bfe94739cf35", "comment": "Malware payload (CyberGate)", "value": "fa45f9b27a9e5454099923ee86dc95c0f466feeefe9de43647964e890420f3d4fab0e4f890a50b47752fe08555f1944f", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779117588, "uuid": "a1b8cdf2-158b-40fe-89d3-051f399bae5f", "value": "T173541215A556D8B6C3B84EFC6D28F6DEF30A36259D2F60E386FC0ECC8518287161C267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779117588, "uuid": "17551054-500d-431b-b7bd-6ceced8949b5", "value": "7570f969f5fbf39893024b667c3a0ef5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779117588, "uuid": "81929900-bfc6-49ac-be1c-a7c6d7bcdfef", "value": "6144:uy+phWTwlTLfkixFUQKf3D7TnBAZ5qhbx+:r+pM0lYixsfvDBAzK9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779117588, "uuid": "6fef521c-50b7-4c90-b9d9-6b83acf39c2f", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779117588, "uuid": "596c950c-8e48-4e7c-8dcd-36749ebdc6a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779117588, "uuid": "7105d3aa-f8e1-443c-83f7-ca68ac107e05", "value": "LeonBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5688f796-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089812, "uuid": "7ac0f5e4-9b6c-474b-82ee-8f9964217621", "comment": "Malware payload (Mirai)", "value": "2b2b02cb82b8fe37ba5492fa0a92966e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089812, "uuid": "4783d7dc-6bd2-41bc-aa10-8068dfea813b", "comment": "Malware payload (Mirai)", "value": "3ca8161fe8410dc39bc45d684cd4be8516e687454e3b6fc353f07978c3ef5a24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089812, "uuid": "5c08867d-5a97-4411-a9d8-e0debbfe4d6c", "comment": "Malware payload (Mirai)", "value": "59b382d9131dcf5f073a0fd34d369fcf0948eb4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089812, "uuid": "d504aff8-c2c0-4c5c-993a-5402bc77d6c3", "comment": "Malware payload (Mirai)", "value": "80ce89324de61940dc04bbd0696891b505936c82a269b6bf4be1ed700bd8e7f445a1ebb6afa282ffaacdb265762b72d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089812, "uuid": "35556eca-90cb-4a6c-8006-b7b43d2ff7e3", "value": "T1BA13F2DE60CC666BC7BD9C3D6808531ACDA2B5F1016FA64A5F01064C9BB07C7BD5C1E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089812, "uuid": "fe79a26f-eb73-4145-898b-fd06d1a471fb", "value": "768:NInJXx/OohmsD7bh/xerAfORlUR+aZs3fA+nEWd3j53qUJyWEcn7mo6oHSWt:NIjOqvbhgAGERxZAfvEWdTwUJyWEcmon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089812, "uuid": "86e10cb4-7961-4750-8a85-f6aabc0f50f1", "value": 44592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089812, "uuid": "00161c44-24c5-456b-ad01-f916214f073a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089812, "uuid": "6157d656-e085-4fef-af4e-f5c50eea3ef2", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc8c537-52b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779107786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107786, "uuid": "dd276ae0-f322-4a8a-becc-9649fb5e3c9d", "comment": "Malware payload", "value": "1be523a0d3ec41af57dd2ba6181012fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107786, "uuid": "791f0702-0cf9-42d5-9eff-2805fb4be953", "comment": "Malware payload", "value": "3d81e153b781f05f4c095f2dbe6751a5db8cd71a9aa634fcf0586440f3535dcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107786, "uuid": "508b31a6-cfe0-4fbd-a1a5-9a7f9001b32a", "comment": "Malware payload", "value": "deaad3cdaca0d92854b625a9072168601ab34774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107786, "uuid": "afc2ccfa-a52c-4fac-bc32-908f010cebd7", "comment": "Malware payload", "value": "9028099aa2742d2fb07f4ebf035771f2621fbfbc73e487b878493c1b775e7b15e150681562de4f08f5874a0cd079c690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107786, "uuid": "0c3137fd-3b7c-488d-9b02-81044cb966d1", "value": "T1A7351F2AC7E9010DF5F39B50ADB4041FA836BF16292DD95F1190068F4E7294CAB6A73F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107786, "uuid": "96883e1a-d302-430a-bee9-7c8be2ded556", "value": "12288:yda1qPG+p4VURejZiHR1bItRtMJz7sj+RF:y44PJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779107786, "uuid": "10044d32-c784-4a76-ad27-d3de38c2e346", "value": 1114220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779107786, "uuid": "ac64615c-ae9c-4e13-b733-430721eab04e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107786, "uuid": "7bbcf25c-99d6-44e6-97b5-7d092690a724", "value": "NEW QUOTE 10453180.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb0a77d-5315-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779148694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148694, "uuid": "fc28507e-a1f6-4648-be9b-f310a7373164", "comment": "Malware payload", "value": "38e98162f454c8ee71487de8754a682e", "object_relation": "md5", "Tag": [ { "name": "novocoleta-online", "colour": "#F2F857", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148694, "uuid": "4c63fbe3-d3c4-4bfd-92d5-daf27b3c268d", "comment": "Malware payload", "value": "3db188298fa9bc6f307bde24e58d2f8a5acbcc2732c1f2015a0d6b5fb2f9510f", "object_relation": "sha256", "Tag": [ { "name": "novocoleta-online", "colour": "#F2F857", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148694, "uuid": "c4b3b4ec-80a1-4040-83a3-d49f5fa57f9a", "comment": "Malware payload", "value": "be851222e59d4b366b62758d2f3c2e26c47e3cef", "object_relation": "sha1", "Tag": [ { "name": "novocoleta-online", "colour": "#F2F857", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148694, "uuid": "ec0e13e3-7c29-4b7c-b7d5-e9097d921af7", "comment": "Malware payload", "value": "a1d717e06c1500b15f54e54ac4e92d553d542c6a7c877c518428a301c2cbb86a06a6e62a5491577fd9ed3aa616b75d24", "object_relation": "sha3-384", "Tag": [ { "name": "novocoleta-online", "colour": "#F2F857", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779148694, "uuid": "23a60c7f-907a-4719-8913-043b40b42618", "value": "T10512C044690A7447D29C3BFB0099916DF7025D7DA76B840EE6FBDB478DC5051DB8700E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779148694, "uuid": "3a7776ed-d892-4dec-bf03-ad928e26fabe", "value": "192:bUOrjdaPKlOU19OCMMrRqZzRRzShStLhc7LrM17sNnhzX:bU4rfHOCM4UzvCStaMJOn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779148694, "uuid": "c76196e4-37d9-4966-ae94-46d3065e9133", "value": 9443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779148694, "uuid": "af2f5965-49f9-4a1b-ae6c-4379e874f05e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779148694, "uuid": "29db2f33-438b-4d70-8304-d32a291b97e3", "value": "Coleta2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54ae513-5309-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779143631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143631, "uuid": "d80e073d-3eb0-4f6a-8839-42304e932520", "comment": "Malware payload (LummaStealer)", "value": "35fddf03fd232f779087a3ef99b4e0d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143631, "uuid": "884c14fa-8b0d-4bbc-be6b-10c286216c1b", "comment": "Malware payload (LummaStealer)", "value": "3db1d7b1a464bd1b2cc71211f35ff9ad4222ecb5809ac86d5b5d0eba9e83e7ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143631, "uuid": "d77af14f-f0c8-470f-ae1f-afb4e80a692f", "comment": "Malware payload (LummaStealer)", "value": "06f7fb1f9b1682745f03c1759cfdf4e2f0e56bd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143631, "uuid": "9da169c9-6c92-4237-a60a-7187d2d97256", "comment": "Malware payload (LummaStealer)", "value": "b3a098b3f470993a55a63369a4151595402688d3e0a0998124d1c77648c0adfd135819b38ea1aa6ecc37e0b7c1fef8a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143631, "uuid": "d79e5a75-4aaf-495f-ba78-037c21e9984e", "value": "T151D54A84ABC2F871D7C2B0307076F17A93118801DB7CEA67DEF16E98B97E3922853556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143631, "uuid": "e6551516-84b4-4e11-8d4c-fc8e462decf9", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143631, "uuid": "e53fc3f8-0d03-4537-b6f9-ee3d69ae3e73", "value": "49152:ujhtWaeuXYrdACAIRQU319FYgrk/tar4mMRFtklt8x2t/FaujU62w:uFtDem/iQAkMrNMRF8fU62w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779143631, "uuid": "aa4365c6-85ae-4a6c-8888-8da1a7ceadf6", "value": 2962624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779143631, "uuid": "d0adab79-b21b-458e-a8bd-49158390f371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143631, "uuid": "772bfea9-c7b9-428c-a0f4-ea7fbb874696", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f5de03-5276-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779080622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080622, "uuid": "4f2f579e-af7f-43e5-bc55-661e1ccfd0f1", "comment": "Malware payload", "value": "6ddf21b46c8a0f302cf3cb721f240f9d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080622, "uuid": "0f87448b-b940-4718-8dee-d5a4ea868c63", "comment": "Malware payload", "value": "3defedb00eacf41a0ada69c1382f13a694c762281c62dcd6eb7a149f311723cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080622, "uuid": "77df703d-d080-4083-9b0b-7c1296e04dc9", "comment": "Malware payload", "value": "723ac1021cab1edce553db11c6a9a4ab3dbdda5a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080622, "uuid": "44d255b8-c9bd-4e16-a680-0471724e97df", "comment": "Malware payload", "value": "0129e0702e7de6e6d558fc8ab7e02962084575e9718f501d3dff2027f9c6a7e129c7d739004c29309585a559908f1ea3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080622, "uuid": "65bd21a4-980e-411f-8465-6b675a694739", "value": "T17E25303ADBD8001EF4B39A10FDB4045FA4667B562A1DC88F21D1054F4E7290DBBAE76E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080622, "uuid": "57d36807-f91c-42a3-9d9a-bdc279b0d92f", "value": "6144:MNOUsiSqEuQWv2FQUkcGOwrkheIjjbwbjhjwwvsM2xx5yb77wGoasa6bYJJ5EU3m:SmuPGufGhVcbpEMNwGt/HZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779080622, "uuid": "a6caadb6-e6a4-4f80-a377-136148c07324", "value": 1001520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779080622, "uuid": "e624a710-7065-4bcc-afaa-7d856696f9da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080622, "uuid": "ec60ed98-e622-4173-a69a-353d4ef27351", "value": "PO_474_625_alask137_1779008180674_73N3100292835.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dde2f5f-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089851, "uuid": "40b100f1-50b0-4615-b091-ad2c9ea3c1ff", "comment": "Malware payload (Mirai)", "value": "84d250531392627c2a519bdb169e19c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089851, "uuid": "dc625642-2879-4a7a-b9a3-a30ab6efe3dc", "comment": "Malware payload (Mirai)", "value": "3e58ffaf0643015325e4e4d79e8b46f275441ac25205b05e3f3eea2287ba6913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089851, "uuid": "c5e95818-fbd0-4f18-8d00-94da9567c386", "comment": "Malware payload (Mirai)", "value": "f323381a5e628d47bb3256d754b430294585dfc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089851, "uuid": "00d880d8-2700-466b-baad-de693094a715", "comment": "Malware payload (Mirai)", "value": "0fc8e3fad115c98a4ac5b6dfaff426ccf9aceb2924008650768ef093c9db32c2a00279ad22dcf58bce9df0a2fde0ab1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089851, "uuid": "2e7deb5f-99e0-4e57-96fb-6aa848a85378", "value": "T1028328C1FA8BC0F1D91B89304067F63FCB31E9695061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089851, "uuid": "5e2a305a-456b-400a-9fdc-b9ad6a1b845c", "value": "1536:iXDwDhVtcU4xiUWaqH3Fgl3IeEMWximKjfTsv4gz9F7vu:kDWKzQLH3FljwmKjfTc4gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089851, "uuid": "1934aac5-343b-4afd-910b-3f87c585aa0a", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089851, "uuid": "6f0e2c03-40a2-46cd-b21f-c3f752920b21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089851, "uuid": "59c39a44-5310-4377-be65-8caf626be52a", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18869d9-528c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779090072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090072, "uuid": "b600ffa2-a78e-40f8-8e3e-435b64ae2ed0", "comment": "Malware payload", "value": "0671c80f6aada4a5979c7f612dd73c82", "object_relation": "md5", "Tag": [ { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090072, "uuid": "b274bffa-d2ef-4764-b932-215755455cc6", "comment": "Malware payload", "value": "3feb1ad66eaf92d9bdc91578b02d7692ff961d59170316084da90559a495af6e", "object_relation": "sha256", "Tag": [ { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090072, "uuid": "73523334-d33b-4cac-8c8a-4d6abdfd46b1", "comment": "Malware payload", "value": "a89c8f2b4e80a9b6b142cad23cbcfb1ef8b71673", "object_relation": "sha1", "Tag": [ { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090072, "uuid": "eb9b2f12-e81d-48d1-ba0e-015fa636951f", "comment": "Malware payload", "value": "fc05a0c971cc9b2a1fd043939f3c6f6964da4b3a4d1acf53c751c14c710a718fda1388bd31d1d183a858cef84b8c3d05", "object_relation": "sha3-384", "Tag": [ { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090072, "uuid": "dbb76378-7a9a-4cb8-836f-f9d4548dd4cd", "value": "T19102CF93DF42CD118A276FA84CC5BBCDC379B3A521A133A42E50C725BA7EE3CA645064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090072, "uuid": "801ce188-38e7-4071-951a-ad76e21a617f", "value": "192:AweK/RmkrS+X4vEMa8vn3OD3CnyHW20bb6:nfRZrS4kEMa8/OD3YyHW2cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779090072, "uuid": "3320910d-f45f-42b1-9c5e-9aeb372d53f5", "value": 8247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779090072, "uuid": "4d5a21c5-a27a-46dd-804c-961d330540cd", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090072, "uuid": "6f64c059-1380-448a-bd19-0ff6731c5914", "value": "perlbot_sample.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4534b987-52e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779127579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127579, "uuid": "4eb133bd-881d-4a7b-b88d-e0b8b15ca9f6", "comment": "Malware payload", "value": "30d99388ea146f9720774b77539ddb3c", "object_relation": "md5", "Tag": [ { "name": "pw-divinex", "colour": "#59AF1C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127579, "uuid": "6e700097-0cfd-4298-8b8f-cf49632030a9", "comment": "Malware payload", "value": "4091ab1a283ecbcc60cac4c328969141bb52134d34890c424bd1466c5f6ee649", "object_relation": "sha256", "Tag": [ { "name": "pw-divinex", "colour": "#59AF1C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127579, "uuid": "2247ae0d-38fe-4676-9620-faccc84a73ae", "comment": "Malware payload", "value": "4b91c470dcef3e52465b6192f174be76444a8ba9", "object_relation": "sha1", "Tag": [ { "name": "pw-divinex", "colour": "#59AF1C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127579, "uuid": "90d16a8b-140a-4ffd-9df9-9f8e747fe065", "comment": "Malware payload", "value": "7820202c0aeb15e48460721d12832612330ec1303d8ac448677bb7c78140de4edca4781b4adb08a75b959d8053b4221b", "object_relation": "sha3-384", "Tag": [ { "name": "pw-divinex", "colour": "#59AF1C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127579, "uuid": "9ff6e21b-f7fd-48d4-a342-a520150b0ca2", "value": "T1ADF733FD55495E35CE3134788BCCD6E593FE22AC06B60F610DC2ED6266E02B9B263D21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127579, "uuid": "ce77e505-585a-4f5c-8859-c8b85c43d49a", "value": "1572864:5L26VJHGELtCqbdd+phSi0zctqptx2mx9dcyc+jVQ7xhIc:zVJHpEqbWscEx/ndbOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779127579, "uuid": "f3767f89-7c87-410d-ad6c-69a3fafa6382", "value": 73901152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779127579, "uuid": "7dd2e8ba-b701-4971-ba2e-aa6d3262132e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127579, "uuid": "64dc59b5-76b5-4b07-8dbb-06e0ba4a57dc", "value": "DivineX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d06db4-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089865, "uuid": "d843b304-53a0-4ca3-974e-040d7c5f8388", "comment": "Malware payload (Mirai)", "value": "8c72a5551a6b88acdefcd961fbad2d7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089865, "uuid": "92f882b7-1130-491e-ad85-7f4e316d1d21", "comment": "Malware payload (Mirai)", "value": "40feaa57df11f6b0cbebfdce14123fdffe0ca1943a7acd56589d6665d20e8d53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089865, "uuid": "98179068-4ed2-4427-8b8c-48e22e92ce9a", "comment": "Malware payload (Mirai)", "value": "4986799fd0330ae1ee4fef16722967913079630e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089865, "uuid": "6b76bb47-d127-4ef2-80ad-a0d923679d5e", "comment": "Malware payload (Mirai)", "value": "ecd7b707305e253923924d21bd1274ae3a57fe3785553f94b7ca59f695ccc13f94a2113cc3d35c4557fa5e3911463ff8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089865, "uuid": "e752d04d-4787-4d25-aa4d-dfa73be303de", "value": "T152B3E84E6F318F7DFBA8C23447B39A21975923D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089865, "uuid": "c5ca866c-1016-4d8a-8f2c-b60cf50c13f4", "value": "1536:SEkWiTLiZECcpHOWWJDmmn5Pd1Oe4datc9BWZ6nak7+TeVedVPneQBZN01C6L:gni50poFEa69BWO7+Te0dVPZ01C6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089865, "uuid": "7d2ed13d-3ee3-4b0f-95b2-4cfec0f4210f", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089865, "uuid": "be88988a-19f2-4f1b-a2b7-98f45a12aad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089865, "uuid": "c0f8f468-b9a4-4d4e-9e7e-0c2f60df4282", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc49326-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089989, "uuid": "8ea54965-972d-467b-8357-00474bad6ed7", "comment": "Malware payload (Mirai)", "value": "31cedb152f03051b8c178dcc3c26d4cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089989, "uuid": "39e1aa2d-2ffb-4965-a9a9-76d1aba1ff7b", "comment": "Malware payload (Mirai)", "value": "423f633422af94d3e3af035f285210c8f9c2cdd117dd80822178acc1643a77bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089989, "uuid": "751c6133-65f7-41c6-ae59-a9fd2a67e242", "comment": "Malware payload (Mirai)", "value": "7c49ba5532cf3bbceb19ab7c34e154b31a74e812", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089989, "uuid": "221852d1-4a15-4f1d-96a7-b46b50eb8238", "comment": "Malware payload (Mirai)", "value": "b6b16ee5e51bd554dc6b73902f327e960715e9554fcc2607882b94e77d4120aea6230443de8540a08f26f86f75ad2c05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089989, "uuid": "b896eacc-06f5-4119-a4d9-8cd80ff7a58a", "value": "T1AB736CC9E983C4F6EC120A350136BB379AB3E53E2169DB83C3A9A525DC125C2DA1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089989, "uuid": "161bf98d-447d-4c2b-89df-2c59dffba2a0", "value": "1536:Dbsv6XewvySsos1LNxVZW9Z3J8h3qaccSXR:DbsiJzsokLNx+9zs3mR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089989, "uuid": "832afd64-b0ad-4897-bf0c-f7c09d1c5da4", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089989, "uuid": "53d14160-534c-4b30-9397-a58742db8bfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089989, "uuid": "7f939454-3547-483e-8773-28231e0a6933", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2cd30e-52f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779133979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779133979, "uuid": "7a05750f-cf62-4d5a-87a2-99cb410b353d", "comment": "Malware payload (Prometei)", "value": "9a0da991de5c15f03f5d177f8331c68c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779133979, "uuid": "3ee6824b-cfec-482d-8c7c-140c2f32dc0c", "comment": "Malware payload (Prometei)", "value": "4377d992ac25dce14d53d13d7db002284251eaea4622af5e2296b74daf76fc36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779133979, "uuid": "12b3d3de-6766-4bca-998a-e3ad2c50c540", "comment": "Malware payload (Prometei)", "value": "85bd458817e2513cdc8a1eb26fd2c70b1038e44c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779133979, "uuid": "99c1adc0-ddef-4f0d-820a-4d768edbc07d", "comment": "Malware payload (Prometei)", "value": "8f8c95f767ae67fac354bdc48bd1c0a36954f306734e1e23a52ad2a8b496c0e57885256fdae7a6d5e41184ce33973785", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779133979, "uuid": "5f39c692-fef4-48cd-8240-513a43bde215", "value": "T152A423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94E34F3D732AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779133979, "uuid": "97041818-a4d4-46b6-97d7-d0bf1c34e6bb", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdZ:Fs6pyCC/Ya2hpi6T6N4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779133979, "uuid": "6dcdfe31-b860-4b5f-adae-9e4441a5a3f5", "value": 449077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779133979, "uuid": "70480cd5-1c68-4c48-9c78-ee31b581868f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779133979, "uuid": "10d6d6c5-4d93-4a5d-bb10-6d23db8bd388", "value": "4377d992ac25dce14d53d13d7db002284251eaea4622af5e2296b74daf76fc36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a76ab8-525e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779069977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069977, "uuid": "66fa15c5-7a80-438a-9271-e4c9fc564bf8", "comment": "Malware payload (Mirai)", "value": "28ef178fdd21df4ca8404d7a2696eacc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069977, "uuid": "7fde5ad7-2d3c-4490-af5d-ea7c9ca30b8e", "comment": "Malware payload (Mirai)", "value": "438fa978de169d318889b1229639ce4c2195f54e2d9d8ab3c574df2efc9ec5bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069977, "uuid": "f00fe64c-5adb-4348-a341-5916561f2f21", "comment": "Malware payload (Mirai)", "value": "269f1faa4a033dc7ef4c585bc0b408f0644946c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069977, "uuid": "2063c77c-5f18-4abf-9a92-d68f59afb886", "comment": "Malware payload (Mirai)", "value": "b96ed1567dbbbfa32c03a6ccc8d1796b9390c6cbdbacf150f3838e56413b71ce21ef9eeb98d240f2131bcdf6b970c3ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069977, "uuid": "ba9c9d21-297b-4ea2-b064-f5edde6d9223", "value": "T1F9043A4B7711CF91D369CA3009F74797ABA6169217E29885E32DCD103E6439CB82FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069977, "uuid": "ece967e2-8fd2-4714-b821-1ec8a6e47810", "value": "3072:d4Gq82hZNgizV333sqrCN70sG3UhW5d2ymhCggtYvbNXX0HSE5DjJSj7RQ:DTeZNgiztPsGksYdgUhqx5PitQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779069977, "uuid": "03f062c0-22ab-4b87-94b4-86e81be1df4f", "value": 183496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779069977, "uuid": "a3ddbd0c-b9b7-4c7a-99f7-3006d45cf952", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069977, "uuid": "aaf48c39-f07e-4348-9d31-4164eef697f2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7187cb85-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089857, "uuid": "48beed45-cc8e-436e-bf66-a4ca2ce23316", "comment": "Malware payload (Mirai)", "value": "f42817f62b6c4d18ce851f95b91f1a7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089857, "uuid": "9b799a27-c719-4b8a-b340-cd25bf55cdeb", "comment": "Malware payload (Mirai)", "value": "441da71b1d04228b12f05417d3ccf87734bae3be2fd87240d81067259eedb678", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089857, "uuid": "77a8464d-8f74-4b57-b05f-7752efcca023", "comment": "Malware payload (Mirai)", "value": "32400369d807a110d3e58045cad80dda297e9fe7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089857, "uuid": "88ecbae7-42be-4c77-8301-024bc1fcf569", "comment": "Malware payload (Mirai)", "value": "6a8ad7e0aa140abd60ba89502c94092add75f613d395f5c30d76e8b0d05fad55eb085b991d7d6b02e70c505412259825", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089857, "uuid": "e9809cae-9495-4c5c-bd01-27fea75eeec0", "value": "T10E834B0273580D43D1A71EF02A3F37E593EFD59121F4BA89660E9B4A81B5EF2154AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089857, "uuid": "625d41b5-9dd8-405b-b053-56d570f7a1c5", "value": "1536:r9UIXOVeWbi7JNdtp4OlEFL+wmCWoyntMT+5:r9UlViJpdEF3mvk+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089857, "uuid": "999a43a7-d44c-4301-bb0d-63017234ba28", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089857, "uuid": "92e41b9e-a6a5-49fe-92e0-22c2774254c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089857, "uuid": "883b89ad-a954-453e-a4a8-e481ca5bfacc", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a987313b-5252-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779065041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065041, "uuid": "5616c7cb-f99d-49f4-b44e-2daef9567b01", "comment": "Malware payload (Mirai)", "value": "60401f9781dec2e67527540a5aa7a3b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065041, "uuid": "d773f433-f0b5-4413-bdb8-fa6ce86d3db7", "comment": "Malware payload (Mirai)", "value": "444dded915bc90218c3920b71f289b23aaf6e26c078dd44ab09561d707ac6161", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065041, "uuid": "9721b169-5704-4eed-b825-68cf51ec1bdd", "comment": "Malware payload (Mirai)", "value": "e82bb3729d84e1fde2a279a3c2c6c35b3f29ba25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065041, "uuid": "31b19bdd-30d4-4665-8f6e-672f9821b2f1", "comment": "Malware payload (Mirai)", "value": "2d99a90be3218a52f9b862d0e1c3679ab33a56cdfc5f15b88f3c7a96526cefddac5800e2ae0d65f4599c44bfceba0061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065041, "uuid": "776f0472-2bca-45e5-ae95-d32e084f1f0b", "value": "T1C783E949E9256B1AC3E232FFFB8D528E73131FA8B3EA31258D309F6033C1A955539525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065041, "uuid": "8a37b93b-5636-44c4-a858-450c2427cbc1", "value": "1536:cknUaVqUyT2lrSfoJ/1ea4sOLSITifC5Ebbgio55N63Io3Yhm7:waVTrWakazC5Ebbgic3mOm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779065041, "uuid": "9b7f935e-ce65-4492-b715-0815c0ddeb3e", "value": 87700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779065041, "uuid": "f202f5eb-205d-4183-8c99-3c69584e74fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065041, "uuid": "0c616c56-63eb-4053-a903-feace74d7f20", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51024e0-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120519, "uuid": "dfb90f0d-3d11-4cec-9680-d42647ff8649", "comment": "Malware payload (Efimer)", "value": "f2d308ed168bd26414d011e16c46acd4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120519, "uuid": "040a090e-e071-4d3c-86d0-5354c2133a91", "comment": "Malware payload (Efimer)", "value": "4508b4661457e48be5542c2fb894203020e680fe008719fddb96cee96f2ce886", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120519, "uuid": "b76385f9-5917-48b8-8766-d4da9c5ff1a5", "comment": "Malware payload (Efimer)", "value": "67e2134eac9b36de0300301c726525d17742511a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120519, "uuid": "eabc0068-751d-4cfa-9a65-ec93e32f0159", "comment": "Malware payload (Efimer)", "value": "dba09879e585baf2b89543cf83f62f626d61ca540564363fcdb7138f2e0905efe8092e9e3da7e207498c6b8f4556683e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120519, "uuid": "4db249ab-b66b-4549-b8aa-364d6864d16a", "value": "T191D6330C6891E2EDE5E2C07479F21770E4AC74A28A74D97E97ACC371ECDA0A0E64D45F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120519, "uuid": "92261ce9-cc9e-4ecc-9686-cc1a88443ea0", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120519, "uuid": "da011c99-3602-4216-ac8e-1782130c733f", "value": "393216:yDat+K+O853NMycujojrEqYLXMCHWUjXjcuI3/PGTAI:yDaUvJ3joHETXMb8XAH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120519, "uuid": "ee155a8c-3abd-4d3a-b016-d80915cedd20", "value": 13849949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120519, "uuid": "de7c70a6-c6e2-498c-8540-4acb492947f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120519, "uuid": "d8aaad9a-9cec-4677-80ea-3c634d2c1fe4", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e09c22-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089861, "uuid": "3ffa046a-86a9-49e6-81a8-458d30dee237", "comment": "Malware payload (Mirai)", "value": "0f8ef58735ff7ed882c626793df38b42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089861, "uuid": "71b6a28a-82d6-497f-80ce-43dc051e43f4", "comment": "Malware payload (Mirai)", "value": "4619414cbf5414d014fa52c665708e4d567eaad2da38ded8671893351dfb74fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089861, "uuid": "13fb75f9-3c92-40aa-a5ba-6c3ac4db69d8", "comment": "Malware payload (Mirai)", "value": "844d8f6b69c38596d96decad1f68ef55cf87454a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089861, "uuid": "7c4e6559-2f61-4eaa-a6a9-bd8255e31450", "comment": "Malware payload (Mirai)", "value": "4e41809ccf914920e9a21b1065ce098247146228a1c3922dde5ebb8f4535b3333b3dda6850c6e358af70787a5b22fb34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089861, "uuid": "ebc1f157-1314-4bc5-9038-7dbdc51c680a", "value": "T193B3E709EF611EF7E8AFCC370AF9270124CD596A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089861, "uuid": "ecfd944b-0257-4fd9-aade-017db8430eec", "value": "3072:w9urbdDS5HE6o/JO7B3OFp0FsC01h0q69:w94bdDS5E6t7S0FsJ1W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089861, "uuid": "b854fd92-0300-4103-a566-35c934826942", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089861, "uuid": "0f0ef719-54fd-48e2-9a9d-5317bbae1df5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089861, "uuid": "1ea3e457-976a-4136-97ac-6182003382b9", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc756d1b-5258-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779067649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067649, "uuid": "c0a117e1-7ede-47ee-a510-c807684c0cc4", "comment": "Malware payload (Mirai)", "value": "7048a8a6437b25bc953b6e18fcc6e21f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067649, "uuid": "61b85cd8-4150-4f33-9f3e-0b87aa1c3b26", "comment": "Malware payload (Mirai)", "value": "46744f9bd253813f795c7ee141b39ee1748789dd79d29fcbb9e7aeb0dd0e7868", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067649, "uuid": "3377ca3a-d11d-4f8e-935d-7a9dc0bbc6ce", "comment": "Malware payload (Mirai)", "value": "206bfc3e6f3a2d8adcac7306e748a70b1493bad5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067649, "uuid": "6701e25d-2ef9-4001-8286-7840c9aa110b", "comment": "Malware payload (Mirai)", "value": "6cd3d132a74bb22d3f9fa9f9177098906e2139485d159fece614b731096f129e74c004e127b7c9568f9d3c5e56d546b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067649, "uuid": "a64836f2-a7af-40f8-878e-89c9f60930f1", "value": "T152044B46FB408B17C4C61779FA9F42453323DBA893EB73069928ABB43F8379D4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067649, "uuid": "ee69c95b-f31c-40dc-a917-1bb67b796bdc", "value": "3072:7S6MUw2i/j1tzRah1cfEEKK9h9F/pAdFwaiP3g9L/KXl26ZX:FMUwL/jLRajcfEEKKX9rAfwaiPQ9L/KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779067649, "uuid": "6c0199d9-18dc-450d-9495-44448a2e67d0", "value": 177812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779067649, "uuid": "bd2c6652-76ab-4c06-ae35-bf66d0e5122c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067649, "uuid": "124b8ea2-cfe5-4d31-89bf-993bfe118a52", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ff041a-52bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779111929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111929, "uuid": "3273ef72-cbdd-4f9e-a5d0-a20c2e3f7746", "comment": "Malware payload (Mirai)", "value": "c386f40750edf28ad284e15b73cb40b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111929, "uuid": "e80673a3-09a6-46c3-a202-4765bda4308c", "comment": "Malware payload (Mirai)", "value": "474a57742b5dfc1b3ecb2da2e9bc573c950c906a81848a5a9b1d7fe34a277aea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111929, "uuid": "64f87ae4-c075-4fa1-91ec-6d2c2f87e862", "comment": "Malware payload (Mirai)", "value": "b699b80555de378025b846fd25a0df80f62a189d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111929, "uuid": "3d96ff41-34cf-476f-80d0-8888837c6de6", "comment": "Malware payload (Mirai)", "value": "962ad1cbfdcf5a289adc8bc310d037106fee5c99ffa5bade45d46a9285e4e25b605d4f8593e2bfb2914e48ccf5f8ba3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111929, "uuid": "fcff4180-d8f1-4735-afee-b424ef454f09", "value": "T1FB33F1F46F5389E7ED21F2B84BC403402EA14BB6B6138947E968C7175D82D9D7D06AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111929, "uuid": "3fb39b8c-37c4-4f1d-84f1-f9fe467bb0b0", "value": "1536:NqklXOuwI2MeQhlPC87CIRtRuikdNV2aiRaqNlTuMVJuDt:7vP2MeQjPC87CIRaiQV2/RzNtuMVQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779111929, "uuid": "85ca4270-2ac8-478b-9500-29b7c8f04041", "value": 53848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779111929, "uuid": "361d452f-b98a-4af9-a661-90e3ec597d8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111929, "uuid": "908250ca-a2bc-4c8c-8979-577c28a54898", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1859cc-5291-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779092157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779092157, "uuid": "5cff3de5-3dae-47da-b588-3298f92eab34", "comment": "Malware payload", "value": "50973720ff5168ef53773d9efa4a817b", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779092157, "uuid": "e6f49ad9-562a-49f1-a195-861ec6a9934c", "comment": "Malware payload", "value": "48b95f811b27d9ae2bc84705709c9bfadee56710d01e94a91197ebd62bef23c1", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779092157, "uuid": "68e7e02b-5d17-4783-b1e4-06731bca5b3f", "comment": "Malware payload", "value": "c4b3301990bb08f6191543df5e5d66425b9f1055", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779092157, "uuid": "78ee403c-9dad-4042-85bd-f42e3d108c38", "comment": "Malware payload", "value": "0c787ee1a9f5681ba130a6a5af1282a704fbab3ce1b595448c4afe4ed9742d2e7a77be3a8a38748cefb9be7d4d3ebc85", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779092157, "uuid": "65dc94e6-b51e-423f-b4fe-8add968d8352", "value": "T1F1648D5823ED8A26E6FE62B4E43D440D47FAB51A612EFB4F19A010FD5C53F8489017B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779092157, "uuid": "5568cae9-0194-489d-8473-2917858b627b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779092157, "uuid": "caf2b1c6-2268-4c5d-9dc3-b55af44d3b57", "value": "6144:wRh4ExBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:yhSu3TCIyESY+z8WHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779092157, "uuid": "d6ab8919-d4a7-4908-a2f4-1c43678ac251", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779092157, "uuid": "d480e485-7ea0-4dc6-b0eb-e610a74677b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779092157, "uuid": "a4b0f645-ba6f-4f6c-a169-c69c307b07a4", "value": "Klvcewxb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cddff9c-52b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779107405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107405, "uuid": "1b331ee9-42e3-4a41-8770-a269f0b1915f", "comment": "Malware payload", "value": "6f0b07c9dae5f996fffe79a85d6819ab", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107405, "uuid": "cbf4e9c5-6ce8-4d14-bc63-2348ad2f5f97", "comment": "Malware payload", "value": "48c0a84684ee4c2e2aa5ef0570d3dd18bc78ac3fc538f3aa34fffb603c69eed5", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107405, "uuid": "603c8105-d835-4c90-8779-954ba87a0b12", "comment": "Malware payload", "value": "1b0d33554c839138bd76ef1a266af50e66b30df9", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107405, "uuid": "4df0de5f-ef5a-4484-90dc-c7a818ff719c", "comment": "Malware payload", "value": "ed66cbcedea1c866760f1c8aee9e4d00eedf69dcf1654ea437fd52e65fd56496cf7708966ed1e5a2020c28407f85fb9b", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107405, "uuid": "639f09b1-1028-4ae8-a211-feffdfc523a6", "value": "T1C694DA202BFE5019F1B3AF55AEF874968A2FFE633A26945D1050034E4B73E41DDA173A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107405, "uuid": "d5e2aade-d8be-45d3-8a38-675325a54c09", "value": "12288:shNAgeGo+I6mJwFazocFjicYt631coaU22Q:CQ+ojvoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779107405, "uuid": "e7027a5a-7ba9-4a0b-ba0c-62a4900d9e8e", "value": 421942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779107405, "uuid": "3a380e56-858e-4fb6-8ece-ab40f6cfc72b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107405, "uuid": "878cd70c-9306-4121-869b-87297c0c1061", "value": "rICICIBankAdviceReceipt.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81706d79-5280-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779084730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779084730, "uuid": "440af15d-e70a-4f65-93d6-ba62a2401edd", "comment": "Malware payload (Formbook)", "value": "a4e7d627b45cafc5b9616a68c6bbcf08", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779084730, "uuid": "eecf7507-5107-4bc2-8809-ee7a1cff2ac2", "comment": "Malware payload (Formbook)", "value": "48f6f6fe8f0ec9f25c165e3feba1e5dc790da124db592edef97a0ac173324340", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779084730, "uuid": "282268d4-8d8d-4cb6-9da7-1c61e4026ac4", "comment": "Malware payload (Formbook)", "value": "4f6bd1013cefc6c6b1b93e40c66d72512a791e2f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779084730, "uuid": "28380299-fffc-42a1-b72c-7d89ee9ec692", "comment": "Malware payload (Formbook)", "value": "afafe72ee9f851aa43b667e9f0cbcf72878cb659dd3f77e39f7e2b511030befbdee78ca704115c94d405aa546280a20a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779084730, "uuid": "3d71e0a2-e726-498a-874f-8cb6723152e9", "value": "T19E9423220EC189493DF1811FDB19BA4FF38AC9E957ECF19632BD20C65134877968778A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779084730, "uuid": "21d96cb1-0025-4ae9-9405-16608c18c9a9", "value": "12288:9u20RcUmliBg77j7W6tmMUmWoNRB+lSX8rLj5M8oTfPXoEfv1W:9uxmr7VYmC1rv5Mx9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779084730, "uuid": "1dc23897-4dd8-4703-90db-4e0242b5283d", "value": 445088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779084730, "uuid": "030cc6ea-b311-4df7-8d4a-937b06f8016f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779084730, "uuid": "023e2762-774a-48bb-b3fd-9f9315078faf", "value": "Inquiry NO. 2021-7566.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9278f96e-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120836, "uuid": "ae2b445c-bff1-4e6d-9cb0-2cf701c453ee", "comment": "Malware payload (Efimer)", "value": "1cec805a5369ac68c97fc43f8a3c56d4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120836, "uuid": "18744b55-ed87-4eb9-adce-f490fb4ad149", "comment": "Malware payload (Efimer)", "value": "4b17e8b67643142a1131f51583e2c017c6385e144c044c70bb39d68f685a02de", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120836, "uuid": "9b2a7d44-0027-40e2-9a9a-81612044c683", "comment": "Malware payload (Efimer)", "value": "6d188e0abb206eda55429c4a567eccca676e08c4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120836, "uuid": "42510360-5b96-46b8-8437-4eac3adfb2ac", "comment": "Malware payload (Efimer)", "value": "3661d629b9e8770bf19b41f31e3ba3c16ac22f6acf97bb60daf376f6b8f91b12cfb8986d3e952fddf6cf693d31dc0505", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120836, "uuid": "239e4e91-aaec-4c5a-a72e-45f311ac2df7", "value": "T1AAD6330DA9E3B1EED573A1B47FE120F2B4B1343556F68D7BA714CB31AC1B850482A85B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120836, "uuid": "0112c05c-22bc-4b1d-bbe3-f5f6930dc049", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120836, "uuid": "da7f4c9d-ef4c-4304-8cce-0baeaddf6648", "value": "393216:zpHSzupdX//Qr5GK3N3npCZ9XMCHWUjXEcuI3/PGTAI:zNSz6dX//QFGus9XMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120836, "uuid": "2f4a37d5-e3f1-4ee8-b218-784cb1302eed", "value": 13848639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120836, "uuid": "8bad2da5-d1cc-42ac-9c1b-de3852ca3d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120836, "uuid": "e8e90c1d-bc79-4fc7-8823-3f907a12f07c", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eee39e4-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091034, "uuid": "ec22c43b-4cfc-4fa8-af47-2301084438ef", "comment": "Malware payload (Gafgyt)", "value": "ed2deb795e7f9d05c07db33f01c34764", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091034, "uuid": "3b9f74a6-6bea-4011-9627-7f39e3aa5374", "comment": "Malware payload (Gafgyt)", "value": "4ba6cd287d3c2ffb440f6aaef946a35bb1686a54644d7714c9f0990cca9794c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091034, "uuid": "ef1ef878-2025-4109-9d24-db911f0ca9f9", "comment": "Malware payload (Gafgyt)", "value": "0a4db8396650a7ba3ebef8f7581b1e258935a720", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091034, "uuid": "6f01ceaa-29fa-4397-985e-6ca8e9a6d369", "comment": "Malware payload (Gafgyt)", "value": "613615d463d919c8e5da140119f7545b93bb7651919d29471ce1b319bd803a83069960ddf0844d240f5a59cd8ee0050b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091034, "uuid": "e991166c-d221-453f-b6f9-cda42050c8eb", "value": "T16AF339416A45C5F3D4830FB112A79B610733FC3A2A6FEA45F32DBCB44E75198B12A768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091034, "uuid": "d808a990-c8d7-40fb-9830-357802a6b974", "value": "3072:kpfPulQxU9n3jVs7HNsgvJlxlzbjPQiydhQA7CDehm4uZmRuLTY/75hytPGttCE:c2mK9n3jVsDTXYiydaD2amRuLTY/75hL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091034, "uuid": "ccef0c5d-c443-4a8b-a623-ec92dd047792", "value": 170357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091034, "uuid": "61ccd5f3-4b45-45f4-a15a-382a09dfcdd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091034, "uuid": "c6c1d9ec-169c-4e84-add5-f75ffde2c083", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e54123-52be-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1779111277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111277, "uuid": "58ee3bef-8978-45ce-b25e-c701f2f473aa", "comment": "Malware payload (DDoSAgent)", "value": "bc811d11d9fa037ed1f05ba3b62f7e48", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111277, "uuid": "b587b7bf-7473-4088-8322-0938d1938d8a", "comment": "Malware payload (DDoSAgent)", "value": "4bb2133f6943ade2dec29e265691e97a7742838331279da387c57727ee1045ad", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111277, "uuid": "3148b9a4-3fa0-499f-94df-1a57171048ba", "comment": "Malware payload (DDoSAgent)", "value": "e9770a98a2aa4d1956b949c0f7d4f5762d080f73", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111277, "uuid": "d4c4bb00-26eb-49f5-9bf5-53bf670656e8", "comment": "Malware payload (DDoSAgent)", "value": "7a0ff81649a8a12d9b15e8d032151492c22d4242220c25bd5f66b0235dc152c2f056c90cfad18652276aa0ee833b1c7e", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111277, "uuid": "073bfa8b-908c-4caa-b9f1-0793db80d42a", "value": "T160767C91FB48A136DA460A3248670B30B3A15D82C1F4C96F970AF72F59B26F7594FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111277, "uuid": "b168592c-8396-48f7-862e-06098285da00", "value": "49152:/CKwGYUgc+7O1NbVL3dyhGi/p8VWzxqRT1riXK8Pwy9/MtJGfPHHUt5Ee:QUtJNbVEhGZoChgK8Pl/GJGfPnUjEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779111277, "uuid": "5b36a847-caca-40e8-b347-815209d8b121", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779111277, "uuid": "17ff7508-1839-4f23-80e6-728fb14c4bbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111277, "uuid": "c5a23797-9b5c-43c1-9c46-d3bb60e70f56", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e661e6f-5266-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779073504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779073504, "uuid": "658b535e-b832-4d55-a6b0-0486d14761bd", "comment": "Malware payload (NanoCore)", "value": "7702254ef19aa1006e2d714bf4baf584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779073504, "uuid": "3dbe5961-eefd-4699-9779-9a362cba9caa", "comment": "Malware payload (NanoCore)", "value": "4c423bbaba6531166cfc680d1554bdd235455ed33282633e033388fb85779f62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779073504, "uuid": "24b2123c-78ab-47f5-9dc3-bb5a27fce836", "comment": "Malware payload (NanoCore)", "value": "19f08cdc52b6c67dd51dcbbe0e190f74835f815f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779073504, "uuid": "6b9b3eb5-2372-47e9-9670-faec25dc54f6", "comment": "Malware payload (NanoCore)", "value": "d0a0a821cbb4efb9a5014c3522bbf2cd892a86a261b29350d21d4498ddb1b5b9b0789a901c19c1473290e1685e4a6fb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779073504, "uuid": "f9258f80-fb5a-4dfb-94cc-fc731ccf032b", "value": "T1EA14CF2627B84A3FE2DE85B9612251539379C2E398C3F3DE28D454B78F267E10A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779073504, "uuid": "d8a2eb4b-86ab-40d9-9bc8-5c1d8bb15feb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779073504, "uuid": "9f827328-5931-49e8-88f1-8bad33419b07", "value": "6144:MLV6Bta6dtJmakIM5Ld4SJm9dsJz1ORHFv:MLV6BtpmkydvzORHFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779073504, "uuid": "ce1b2e0a-281b-4dc1-9659-bba4ab77b7a3", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779073504, "uuid": "f4d12d4e-1e6b-4a85-9cba-2ecf6dc43052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779073504, "uuid": "56ce4c5f-222b-4210-aaed-f70bb467a6b8", "value": "dolantogel.nl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8246d2-5308-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779143291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143291, "uuid": "0b933a3f-8331-4ec6-8b65-adca898c9d9d", "comment": "Malware payload", "value": "ce6c19ad04d9f1d7499db84c3a5b9879", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143291, "uuid": "f77c93e5-c2c1-4469-87ac-f32d6a2358cb", "comment": "Malware payload", "value": "4c9d2d4f2c9a9d7609ddd8de9377b2d5f809e8a09e0237a3032f7c6030de15d5", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143291, "uuid": "eace33ba-195d-41e6-922c-c2d93e7c9293", "comment": "Malware payload", "value": "265b161facde0f7f06a544f94cef85b248cabdcd", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143291, "uuid": "f51128d6-499d-46cb-9dc6-e5ccf2e72404", "comment": "Malware payload", "value": "77110595532afde543ca528aac42c8ec430711f583fd26099ea53acde80f65c7cd5e0604281ee57e1dbfdd47807565fd", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143291, "uuid": "e5ac128a-5c28-4b08-8e88-3bb6432409ad", "value": "T1A8373398E2B3BEA454C3EF74A9C5F5D36498AC44994943DEBF290212B6C408F49727F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143291, "uuid": "d3c44953-14ed-4bf9-b0f4-3c40e46acab6", "value": "393216:xfzNmfmJS+RB0fC+LxR8Cgf9HW4oq5cBtTKlICkY1NI9NkqQHVjh99tKwlhRbjOD:FpSmbRB06G8CgfdoqcrYN1jL/KwlhBqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779143291, "uuid": "5f14fab5-9401-442f-b973-c39ed20e3766", "value": 24080993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779143291, "uuid": "3e3e2039-ce9b-43e5-8662-a8d8212373b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143291, "uuid": "1c77c266-2294-4ed6-aa0b-eab4959199b9", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62038506-52f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779134929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134929, "uuid": "e224b867-84d9-40f1-988f-7a083fe99c14", "comment": "Malware payload", "value": "a3844c516ccf9bc3723f43fd992aa3de", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134929, "uuid": "579513ce-7227-4bb9-b65a-a0c45c2d9ece", "comment": "Malware payload", "value": "4ce59c09ab83c0749e14581b0ee359456d149c882093457764d368401cebbbb3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134929, "uuid": "a2350f51-41d5-4ede-98ea-bce5152140d8", "comment": "Malware payload", "value": "22b5ec82846e70a96bf69bfae5a0f1f7417b0233", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134929, "uuid": "2a0771d4-e1e1-449b-ae78-25bec846d9d0", "comment": "Malware payload", "value": "3e23b7abed635b7cc96095ae96f2dfabe4c63e0e7c8bef7efc1296fae54f050f21fa466d0b947db9ba755f24cd8bad13", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134929, "uuid": "8d85fd10-92b3-4c23-8bdd-695e09bd0910", "value": "T140136C6526953C25AE99883B5D7E2F0CBDA983E2304491DDBF8B3CF18C15A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134929, "uuid": "361675a5-4081-4cb4-bb56-c62cd8a3c0c7", "value": "768:ir9NyXsZztC39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:sHusZVco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779134929, "uuid": "5228a4aa-af37-4d0d-a5dc-9396d025bf7b", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779134929, "uuid": "c4967119-9f99-49d4-9171-617709ff8349", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134929, "uuid": "9ecbab01-81d5-49df-8ee1-92b31d1dadd9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55acb7cd-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089811, "uuid": "e31e99ec-dd7f-4be4-89d8-713bc31754a0", "comment": "Malware payload (Mirai)", "value": "a2adcc0c250fe37e04f39b38fbd49653", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089811, "uuid": "c42a7126-0a72-4284-8abe-3f5f617432ea", "comment": "Malware payload (Mirai)", "value": "4efa973d0124f943cc585ec00db2678bccfa463feb353452f85035295bce813d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089811, "uuid": "3b928486-f7e2-4c5e-ad5d-8b8e5949a37a", "comment": "Malware payload (Mirai)", "value": "fb27467feb25b3bcebcfe5f1eb55afc733c85916", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089811, "uuid": "adbe84b6-f1d8-4225-86a2-86f82b36ac1b", "comment": "Malware payload (Mirai)", "value": "fa7b85d2fc025cc8ee1e5fbe603e21ec03eea5d0da50e86ed3f26dab72d64d27d540d34e112aba392130e064b1aa3012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089811, "uuid": "bb95a1b1-1de8-4268-8f05-08737876e917", "value": "T13F030258E3502C35F6E37F71A2B99EC8B7E4C7A6B335AFC0A616C7413522814C126EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089811, "uuid": "8cc42481-c21a-4177-96bd-4e3a2b831294", "value": "768:Lj7Jzmzi7ygo5RGtRTd2ZrvAU0lgySOTPDRm2fvpq7N4uVcqgw09t:Um7y9rGT8T0hSaPDbq7N4u+qgw09t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089811, "uuid": "7a755a47-73b9-45ff-b520-ca4632685e94", "value": 40132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089811, "uuid": "6112729b-381a-471d-82f5-684dcadaaa92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089811, "uuid": "8f92c96d-16f0-4152-89cf-647c130b6de0", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9884a4-5276-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779080479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080479, "uuid": "6a88f28d-319c-410d-9c72-b057b5561417", "comment": "Malware payload (RemcosRAT)", "value": "b1975d368e66ca8944da721f1e85517b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080479, "uuid": "436614ad-076e-4c33-864e-a512992329c8", "comment": "Malware payload (RemcosRAT)", "value": "4f88aaf55493cd03a2d5c90dab6dc57dc0f9201daedeaaac72f6f8a040aba72f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080479, "uuid": "9ec746d0-322d-4ba5-8eb7-f3dd0d92c0ff", "comment": "Malware payload (RemcosRAT)", "value": "aee65b939a71bad0d6c79af98c48d7ffd9546813", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080479, "uuid": "77d5af61-0c58-4375-8bb8-2b7b78957d54", "comment": "Malware payload (RemcosRAT)", "value": "253026c628ce62d7d48b55a0a36a192328e55e63211c46d96aebddf570638b9129810d1e0e13040a8f5d0641f6633698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080479, "uuid": "430dc51e-a2a7-4721-8f48-12f6b846b195", "value": "T1D925222DB12072B5E42DC6B34A28DEDD3B610D2163F178BFA646373586B0220D6B5B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080479, "uuid": "4fa58f91-bbe9-46e1-8c22-f9ea6fecf51f", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080479, "uuid": "f59e391d-b6bb-42a8-90e1-a7450964618e", "value": "24576:HfLE6f5nXjXzlVCavFcCB7W3hH6KY+eAZkJGrI7+nbBOh5:/dfZXDzp9cU7whH6KB1aJGndO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779080479, "uuid": "2787445d-221b-44f7-a838-4fdf4661941b", "value": 1057296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779080479, "uuid": "81fb644b-0a75-4b76-9832-bd5171536223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080479, "uuid": "cd39f7fe-c66b-4faf-ac65-3974b0c268e7", "value": "CO-PYT-0002891.2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7dc373-5277-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779080829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080829, "uuid": "1d79e7d7-0610-46fe-9a41-a00abdd2293c", "comment": "Malware payload (AgentTesla)", "value": "b881069da4c4526a6e5002d580619845", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080829, "uuid": "e39734be-01fd-499c-b600-eec43f07a919", "comment": "Malware payload (AgentTesla)", "value": "500cd979076c01f3873bd08de8f09163f74eb25a462ea66037b92a0665524012", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080829, "uuid": "10f19cbe-e889-48e8-a694-e3673027dd31", "comment": "Malware payload (AgentTesla)", "value": "c5591c5cc73d4beac2508ced5b9d89dd499982f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080829, "uuid": "2017bd4c-2f13-401c-b402-fadccba91bb2", "comment": "Malware payload (AgentTesla)", "value": "ef1bac76a4e06ac0a0084ea03f87a045da4ae25fbc2be4b4dbf6af1c5074f3b8de8560a54803dcd3034120f847893695", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080829, "uuid": "9bb19a2b-f2d0-4cfd-802c-670dfb7f291e", "value": "T161B50A01066D5668B088578C7CCB3F5A26E766BE04CD1F98B67A7F333815072FCAA4B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080829, "uuid": "6dff5285-ee35-4b29-af4d-c560416eebb5", "value": "96:qJXHaAQpVjz9UOSe01Uf6sxrGzTz3wnlrl2DiOxfXEUV9umgY+8iP0jOg0BNhpVB:qJXHor6loQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779080829, "uuid": "9a8146c6-d2ad-443a-8598-30c5d2b5c5c8", "value": 2402451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779080829, "uuid": "02865b4c-6d80-476e-9847-6df602efbc8f", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080829, "uuid": "493eb532-46a2-4ee2-9e96-34ae9beab98a", "value": "confirmaci\ufffdn de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b27a7d-5283-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779085841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779085841, "uuid": "4abf42f5-cd92-4599-a97c-ae906790b2f6", "comment": "Malware payload", "value": "1edb9f1c9a9fa3d8e9f1baf47a95eb32", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779085841, "uuid": "c554ddc3-f9d7-4cb2-aa93-2dbc24d6567d", "comment": "Malware payload", "value": "524982cd44d3874ecbaced4d493dcd287e481761f5d9cc18ce53572a122def84", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779085841, "uuid": "5c1d6c24-34d0-41e0-8f69-3e650c2a6e4f", "comment": "Malware payload", "value": "ee4a19bb057e9869915d0b28615862ee858493eb", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779085841, "uuid": "bb8d90da-34ab-40cc-833d-cb36fd1213e3", "comment": "Malware payload", "value": "b9a93a4e149361d8e9411a60bcbb43de6116cc99e47a0123fba1f4b6e0cf30f76e7536055fef08ca109f25dcee0bfa29", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779085841, "uuid": "e967b8db-d8f3-4e0c-927d-7533b44888c3", "value": "T1413633905829F998F0ED86101B2DC694F5C0DA3AF87A4BA3D79A4D77C4E17E35FE8420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779085841, "uuid": "3c0403de-c5b9-4b50-a689-04dbf3bf3bd6", "value": "98304:GIabJr9SPRgHSurPtVXYwpvJ+wOT4RcaDWrMk5zJ24NLnXskOIvp+eOA:SlAeHBLgRTl3zlX/6eOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779085841, "uuid": "9e7abf9a-57e6-4bdf-92ae-26f062d06fcd", "value": 4911591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779085841, "uuid": "e84ee20c-3d47-417e-b138-a23975ccbc50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779085841, "uuid": "812b699c-a778-457d-9451-ba115b7c2b61", "value": "P1-2605-0744.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0b38f8-52c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779113336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113336, "uuid": "dd218a70-49b4-43f5-adda-fc3744449bc7", "comment": "Malware payload (Mirai)", "value": "06abdafecd27e71021f292d2799c161d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113336, "uuid": "e5731857-fe2b-4e68-bf90-efdefc15a563", "comment": "Malware payload (Mirai)", "value": "5419b518820634df532723e2a9a2e68e2eaf4bf233f232c95a9cb9ecd291f045", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113336, "uuid": "dd1b3097-a2c9-4b9b-85b8-8b760a43e25f", "comment": "Malware payload (Mirai)", "value": "5ebe80d8fec08feccb830c6941ed2d441129d7cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113336, "uuid": "66f43fc4-0a17-47f6-bd31-637a7eab7fae", "comment": "Malware payload (Mirai)", "value": "4c7e01368ae53884299f62d78aaea2d72476fa41f474b49d92767b268c7e7c71e04f428a999e76348ed51273905363ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113336, "uuid": "a2fef354-4f51-4836-b0a4-8af971759f27", "value": "T1AA762711FE8B50F2E9031D3105ABB26F63325D054F29EBE3EA407F29F97B691193A149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113336, "uuid": "f5c37d2b-ab8a-4fb1-bc61-543e9c33e5fd", "value": "49152:aDcg444mBP+v3bUbRSkJiZu50cwOXT2VDDD4EvEuN2SD8LJrWUjFEcmCLpH5ELf:++4vq3QbRSP9ODiDoEv3mZCaELf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779113336, "uuid": "0aa20999-56fd-49ed-80e7-f863807bd487", "value": 7270584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779113336, "uuid": "46ce7991-7ef5-4ca5-a380-92f2eefbef10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113336, "uuid": "06fed1f3-d26c-4aff-9574-c7d85e87cebf", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b6da92-52c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779113639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113639, "uuid": "bb5a02bc-ee96-47e4-a484-e239d5e9fc6b", "comment": "Malware payload", "value": "f803dd8276af39934904969c57366a93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113639, "uuid": "e8f87f1c-6f9e-4234-8e71-6af8360ab271", "comment": "Malware payload", "value": "5507d121624b4408bcddb0c2a3c323af7e8c28f26ebad5bc791ac65711fd1eeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113639, "uuid": "02a4e63d-1da4-4cfb-97e8-f9b8acb50de0", "comment": "Malware payload", "value": "a7db7fdf28677cb9f2b0ed05b73685da38ce19b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113639, "uuid": "d4112875-11eb-4e8e-9843-50515afc3803", "comment": "Malware payload", "value": "bd6afd20bf93a2511c534c11047b766d95e49475a4cbf3cb2549d519b80ad90e467a8475ccb16e0ef1491c909224e094", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113639, "uuid": "0f68e296-43cb-46e4-a6f5-d16f5b6a2f97", "value": "T157761957B8924942C4E43A37B8BE81C432630EBA8BC7165B6D15FE383EBE5D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113639, "uuid": "c04a40ac-bd28-4758-b140-9390ac13000f", "value": "49152:2agRD+x5fl0OVbZyGENsVhsPWMcaq7WNBJtTpiB+Mus5EB:2/Dol0OVbZyGENsRYHJtdiB+YEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779113639, "uuid": "a25751df-8ffe-4cff-8957-5d174ea37795", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779113639, "uuid": "927282b5-f8f5-4bcf-aba0-5361a2121ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113639, "uuid": "58abfc09-fa0a-475c-8af9-5a80c6dd5b2a", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439d0667-52f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779134448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134448, "uuid": "193f8a7c-d7d0-41aa-82fc-b01e08ce2c1d", "comment": "Malware payload", "value": "9cd6caf48c24de5c38c479bfeecfe001", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134448, "uuid": "7c4fe8a1-37b3-40e2-9d61-b95684a8355a", "comment": "Malware payload", "value": "5543441f927d841be45bfdf1d987f1b225bf38264ad6937faa5a45359d4feeca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134448, "uuid": "4293f251-2ffd-4bba-920e-20f2315b79e0", "comment": "Malware payload", "value": "f016db9ef7dace3cf18e2ed3e45b9dfad83d6e7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134448, "uuid": "d2a69da0-1714-4e8a-8b97-5e679df6ef4c", "comment": "Malware payload", "value": "a1e8cf9902336805485afb9af519d3e2d17b1ed2b6f08ae6f042dd14aa3690e33ede07dd909c1cbd95931d8614da94b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134448, "uuid": "9cf0b1ce-b339-4c91-8b2e-85322783ba3b", "value": "T1B973420AAF601EF7F82FCD3B46E81B49308D641A21A97F757974D818FA4A20B45E3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134448, "uuid": "b2620730-6fd8-4284-801e-771da77618b0", "value": "1536:MP2ZtJNq2vKNZCgiUu2iZdCjwgS5uW0ViXG/B0M+wbZnq:MOTzqdNZCgiH2iZdC0u/VcG/8wbZnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779134448, "uuid": "fe7f3c1a-a192-44e3-9178-f6f84b1822e2", "value": 79684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779134448, "uuid": "35623bb4-ceb8-4774-b580-c0f573af897f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134448, "uuid": "557ba48f-212b-4475-901e-f3c6b32f3cc2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8ac735-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089820, "uuid": "dd52fa5b-168c-4470-883a-f8b048dbeba2", "comment": "Malware payload (Mirai)", "value": "5f0b6f78ccf6de362a4f87dbe70254dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089820, "uuid": "5538476a-90fb-4152-bf1e-5c5512a04e38", "comment": "Malware payload (Mirai)", "value": "55a984a448f5dcad1094d4fa356b72cc67010e02282edfefde5e6097f00dbfd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089820, "uuid": "159a7aea-a9c3-453d-abb8-2f7cd7835deb", "comment": "Malware payload (Mirai)", "value": "668e0976eb2a34c5b8538ba152f73c8aa165f781", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089820, "uuid": "bc6399b5-c910-4482-87e3-81d21370f1cd", "comment": "Malware payload (Mirai)", "value": "069efca71c3dc02f62b01eac1c87f61299ce095259b1d3e3189b0a7e6478f29641c38b713619d246fa1fb47aa559b5cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089820, "uuid": "e060478b-ae18-476a-b264-2a62ecea0e05", "value": "T10713F2FB66BFEAF4CD3A7979190C518CECB05B1FF881BB6B80A0E46A5D168131427D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089820, "uuid": "29e832e3-f2d2-4341-85cd-d1ead26197d5", "value": "768:xhIfHyA8J99JgD00/1kx+T+xveN293zzCdOGPmZQAUxbPC0WZqaBx05V:xhIvyJ7gq+TKv+2lzzuOXQlxbPCJkeAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089820, "uuid": "1710f353-f976-491a-a016-f126e4bad075", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089820, "uuid": "0cd10c80-d54e-44c3-b9ac-40030d05ca45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089820, "uuid": "ad5a80ff-b0e2-49cb-8009-6d9279691be8", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a7779a-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120489, "uuid": "05835aa0-186f-4548-814b-8afd11c1df2b", "comment": "Malware payload (Efimer)", "value": "cf78f2c1189ca9dbd0e7b8e33d9c0bc9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120489, "uuid": "be551101-5510-4d3e-95c2-0bd05cdfa252", "comment": "Malware payload (Efimer)", "value": "5692bbfdcb590925e4c2986ad097bf75b1e3c84a16d9c62abdf95a268a90bdd6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120489, "uuid": "dae7131f-5694-49c0-9aee-d602b3a5dbcb", "comment": "Malware payload (Efimer)", "value": "b2c7b6b63738212a3ad9ce65419ed623f8fd0b97", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120489, "uuid": "baa18a3d-835b-473d-b623-4bc158dcb267", "comment": "Malware payload (Efimer)", "value": "f1c9d2ea83269f6cba6b2b11af3e35afad5d495744d03a06b709bf8eef4a458f0332f11701533d72f737658435dff1b8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120489, "uuid": "f54e983f-beb3-4b55-bcff-15e059995e18", "value": "T1B0D63319A9E260EDC7E3C275BBE206F4946D30752376CC7B4B85D7712CA70E2869C48B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120489, "uuid": "0a002fbd-dcf9-4ce9-8a01-09898c5f9ea1", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120489, "uuid": "ad1aaaf3-2ceb-4883-ba1e-c48b6322a3a4", "value": "393216:8gsnKs2hJjVexNPjmIH2erJPhYUG6tXMCHWUjXCcuI3/PGTAI:8gsnZ23VejPSIWerJPh+6tXMb8X/H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120489, "uuid": "040b0db5-1294-4fdf-b406-95c57a0bdd21", "value": 13859256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120489, "uuid": "33710d52-cb10-4b56-82d0-d984d1390a52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120489, "uuid": "ec7e46d5-3550-43be-81aa-a5e2ff7848df", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5bfc1b-52d7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779121897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121897, "uuid": "5c5a9b41-6152-41a1-a3b2-15d30afaf0dc", "comment": "Malware payload (RemusStealer)", "value": "519ed50c8f91d0e7a641f818d4438a7f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121897, "uuid": "2a1c1b7a-9b9b-461a-913d-a828fdec8bb2", "comment": "Malware payload (RemusStealer)", "value": "57644a4dd7777c6fc8814c8df8d961ed492e4d201d07d71d20c77464a3e43726", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121897, "uuid": "bacbd7d7-86c2-4378-a9e8-2486be7100c1", "comment": "Malware payload (RemusStealer)", "value": "d3f63099082324d42b652646811b688f74e4acf2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121897, "uuid": "2bbd9a24-1c81-496f-9035-27c28e55fed7", "comment": "Malware payload (RemusStealer)", "value": "82edeacc78d36a25eba575b0809764fb63e9deece2295369dcb77c52ae8526d965d60f90288c1cf3d108dc22ce3dcd38", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121897, "uuid": "81d78526-2894-4c60-b41f-47ecca272c3d", "value": "T16ED55A03A82588BDD1D9F13564F57540BE21B4056B2833D31EA3ABA42F3BBC14E7676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121897, "uuid": "a48a8f61-316f-4d62-8d2e-29d942070d5b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121897, "uuid": "7b52cf2f-19d4-40a2-9977-2f2acbedd5c9", "value": "49152:F/XrLUBVy69+kdKOMZXWeEVc+U+fY2akdPMUELeOk3tP3Dz5:FvNS+ZfZXWeEVc+pfY2aSPMeOk3tPTz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779121897, "uuid": "cfa040f7-3bbe-43ce-8433-a6d25d6708f1", "value": 2917032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779121897, "uuid": "855f6996-c7f0-4f07-9805-dd2c7d84c322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121897, "uuid": "4ebe1c9a-0133-4248-a424-ce2a6f20f59a", "value": "WW24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e72c8b-52f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779134501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134501, "uuid": "e93dcbcb-3262-4dd6-b2bb-c97ce04fdc5f", "comment": "Malware payload (Mirai)", "value": "2a94161b60c27dc94e03a4a71832485f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134501, "uuid": "a747abd8-0c70-493a-ae89-0e2351f0f158", "comment": "Malware payload (Mirai)", "value": "59101c3e0cdf4e2a14b4dd574b9bf1f3864df6dd5984e9f14d3071c286400657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134501, "uuid": "24b27153-7f3e-4b0f-b3bf-37fb94673270", "comment": "Malware payload (Mirai)", "value": "7cfa9b959775fe0d755dda08f0d1a34d619ea894", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134501, "uuid": "527ed02f-d1ba-4ba7-bd93-234bd9dc6dae", "comment": "Malware payload (Mirai)", "value": "9a2cf3eba5f171bdf876f05642ea25851f11f68c289be8b93bc186712a15a14b6a1d1cf853ac4b6e64d3226c4d4f6e54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134501, "uuid": "e742ad4c-22aa-41d3-948f-8850f0717862", "value": "T16804D80ABB610FBBDCAFDD3706A90B0139CC545722A53B3A7274D528F54B60B5AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134501, "uuid": "e94f2786-3bc8-46fb-a83f-655d38011cc0", "value": "3072:lbLpzw7MYWEq4b4djDbIUh7pjMTQ1YxJ1:lbL9w7MYWEUdcUhpN1Y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779134501, "uuid": "51ea66f0-75aa-460b-bec5-8f516f9abe8e", "value": 177736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779134501, "uuid": "234e93d5-1c3c-4483-96bd-39220fd40505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134501, "uuid": "198d3a7b-d762-4769-88de-48190b2ac993", "value": "micro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b3bbeb-5286-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779087133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087133, "uuid": "a6713286-c85d-4f4b-94d3-005387c6f369", "comment": "Malware payload", "value": "cc042e32be5000618789f11fd8358c17", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087133, "uuid": "d5335756-c3a4-490a-9995-9fc28f48bfee", "comment": "Malware payload", "value": "59386bf1258fff2b4ebccdca764aa9c10d50d7df75ecfb5308e4474008bd17d2", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087133, "uuid": "a657aed3-843d-42c7-bde4-c0e3650b4948", "comment": "Malware payload", "value": "aeb441bc79e723c0aeb4a8101c2e66f564e6a41c", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087133, "uuid": "6546a3d6-ab95-4bec-85df-9796b021fac4", "comment": "Malware payload", "value": "2f12343d55624b31b29fec8e5b2d8d86d13b93f90db6c47ce2db32fedc62efdb90b13d952109262875ccd51b04bc4639", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087133, "uuid": "7e214081-b011-4de6-9ed3-5ddd5c5a050f", "value": "T1392633102778A327DADD87F8EAF67C1542F793D42587CC9AAFDF44A942EB1814706382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087133, "uuid": "1fec96b6-7fc6-41c2-82ec-a99e6d057193", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087133, "uuid": "4034816d-43c0-47cb-ac08-3259b38b8a6b", "value": "98304:AY4AnFvdvqKca9It/gDLriPVFT93SOXdh4eTsIAaPrXPCU:2KtlXoVFT93LIeTsraPrXPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779087133, "uuid": "f451346f-a5df-464d-bb7e-6e5985014b03", "value": 4434728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779087133, "uuid": "5cb6190d-d365-4bf9-b960-eba67675485b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087133, "uuid": "da67acf9-35d9-41be-870f-17e88dabc92a", "value": "_prn_.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a569237-52b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779105280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105280, "uuid": "b879f78f-2a3d-4af7-8349-df5c77f709d9", "comment": "Malware payload", "value": "bd35ffb0f85d0b7258e3fd7ebb88f1a0", "object_relation": "md5", "Tag": [ { "name": "184-95-51-188", "colour": "#63CD6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "motriztrading-com-br", "colour": "#4A831E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105280, "uuid": "354663d2-fdaf-4838-a419-c0966bb01e2d", "comment": "Malware payload", "value": "5965184f740778239fb9d3af509e81bbbf82e338cddfa8d35352ae6507bd19ea", "object_relation": "sha256", "Tag": [ { "name": "184-95-51-188", "colour": "#63CD6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "motriztrading-com-br", "colour": "#4A831E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105280, "uuid": "3cb189d2-3008-4f5a-ab8a-aad4c659212a", "comment": "Malware payload", "value": "c8e6d940bb78c2de4d0fdc970a368f7e77cb159f", "object_relation": "sha1", "Tag": [ { "name": "184-95-51-188", "colour": "#63CD6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "motriztrading-com-br", "colour": "#4A831E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105280, "uuid": "c4d372b7-2a83-449d-a9f9-259ebfc3fc01", "comment": "Malware payload", "value": "d64a70684dca1ed04a936cffe58bbf1863d3db726c156d009e18244d8edd66a430d1227eec16e8de6e03598c3564faf0", "object_relation": "sha3-384", "Tag": [ { "name": "184-95-51-188", "colour": "#63CD6C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "motriztrading-com-br", "colour": "#4A831E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105280, "uuid": "338a8167-f7c9-420c-94bd-8555554015bc", "value": "T1EB636C49BBC4A331D2AF8B39A87246064631F557AE13D78E5CD9106E0F727C48B19BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105280, "uuid": "24b04bc8-da92-4429-82ac-b24c080e1d87", "value": "1536:GN+VoBOq2ZaNo9Rn5AwUmArrw9dfVnpaVf9gy62Yw:GNaoBOjZawtha89dzaZ62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779105280, "uuid": "b69541a9-5404-40b3-acdd-7d51cf51cdd1", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779105280, "uuid": "3817c655-dc2f-48be-9ab9-0ce3750a4c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105280, "uuid": "fd46636e-77cd-443a-8b17-cdc73596ac65", "value": "5965184f740778239fb9d3af509e81bbbf82e338cddfa8d35352ae6507bd19ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d26b60-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779120228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120228, "uuid": "f4fa0931-b0d5-4c9c-aed0-f111a1e9aa03", "comment": "Malware payload", "value": "8680fc435f215144d0e30b42d636eb6e", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120228, "uuid": "fad2f4ca-aacb-4e14-bdf4-f211733b7910", "comment": "Malware payload", "value": "5a685951bc0e4b84e915ea44bfa46f893a62abe3cb8260f13124a2d53e2108da", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120228, "uuid": "f29f11e5-2408-404d-9a25-28137020ffa5", "comment": "Malware payload", "value": "7878f19305a0089e3953aad6609b079c7a5a903e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120228, "uuid": "5322fecd-b470-44e5-9966-e77b8ed36a3b", "comment": "Malware payload", "value": "06efbf7c169c1c8793b16b1ba4df5a4a6828d6b5347876538b8a67604384bc505dc78c908016765248db721fd269b842", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120228, "uuid": "978b3dda-c335-481d-a227-c2348de63446", "value": "T1B09733D2C5A36681DDBFC139CA39F62EE0A56072FB5B40215D70B32F22EB7E1596C409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120228, "uuid": "4e2cf1b6-a4e3-439e-907b-708fa0597fdd", "value": "786432:EbhFmA7Y7ZzqAEZIkpZzkfzlbvy31FkpUzUBg+gWjoOkoAvPGwicl47JMJE0yc9k:EbesY7ZnEZXefhbK31F/zSgWjYMsJdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120228, "uuid": "244792d4-bf2f-47c2-869a-50da9fa7fd1e", "value": 41757677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120228, "uuid": "7a272a99-dc46-4e3d-a266-97d54ed155fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120228, "uuid": "379206f1-956b-454c-8d5c-6d2ee1d93ac1", "value": "Loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b415fa-5277-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779080932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080932, "uuid": "9185ef03-4921-46c9-a111-eecab35456ba", "comment": "Malware payload", "value": "0f039fcd578e142522cc29cd28f746ef", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080932, "uuid": "dfca3662-e4db-4f3c-9eb4-f25d03fef882", "comment": "Malware payload", "value": "5be4ecdd80fe44b3680ad4d2d4cdeefa1a96168b217d21f9b1396c5c340e6042", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080932, "uuid": "3b785f04-1ea3-496a-9883-9dc32a8f3491", "comment": "Malware payload", "value": "0d395e1133ee87137d87ef0217cfae96b06e57ba", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080932, "uuid": "c93ef6c2-0790-4e2a-abf0-32bb9248fe2e", "comment": "Malware payload", "value": "2b0db3f85702e350ac4e950d5c9dbb31fa8a987a9300da739ffe0219c16eea29fba4c413e74faf0fb8a720c9d1e7c8d7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080932, "uuid": "243233d1-afd8-467b-a0c9-a93ab515c997", "value": "T15AC57A4F12A64C13A85DBC24776B381C50F67D9F5C324BA633BAFA2B045EC06B97845B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080932, "uuid": "c6ec1208-9dd1-4863-b485-dce0632c44ba", "value": "384:xOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOo2:mJnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779080932, "uuid": "b48da0cb-001d-487e-91bf-4c055df52343", "value": 2635321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779080932, "uuid": "1075a49d-6fd9-4cc3-b834-575ffb9f17ad", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080932, "uuid": "e154215b-9174-46f9-8939-c6b0f9399a73", "value": "purchase order AD31250192.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1e2f74-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089872, "uuid": "281035ca-7654-4796-a810-5c05a59ccd08", "comment": "Malware payload (Mirai)", "value": "b4e514730e6c1f88855f3c5cb8207414", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089872, "uuid": "9b555883-bf60-4035-b12b-74f3ef073a93", "comment": "Malware payload (Mirai)", "value": "5c2702e66bfe12420a305c20578ad005b21337ef0a6011fb85b2b0d0d3adecef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089872, "uuid": "2a459085-1641-4799-87be-eb4dadb7ecd3", "comment": "Malware payload (Mirai)", "value": "d5b60c654c0ddefe6947c7950da800493dc23cd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089872, "uuid": "fb644a5d-ff4b-4507-8ee5-a5ba83ed7df7", "comment": "Malware payload (Mirai)", "value": "bc56eee6428f9f88833503bee6d32f86e605644f2e4882a977d5afe46d82266f33c96bb7880b88220c28c7a0949a8bf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089872, "uuid": "122ab998-a388-4a79-9d31-450c9e167cf0", "value": "T1BF934B45FC819612C6D5137BFB2E228E376663A8E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089872, "uuid": "66958fcd-54f1-4a5d-b6db-e04475845465", "value": "1536:9ObuOZ1SDp7u1rGmF/fgcPrnyAsWkJ1/j4oYkv1i:9Obu0QpKhB7PryAkDd1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089872, "uuid": "2adf80d6-3dd2-48da-af8c-5757a4beaf63", "value": 92248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089872, "uuid": "e40f00f4-9e6a-4111-a755-7b5f01db0733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089872, "uuid": "90fe2b07-6e27-4db0-91cc-a1d373467f8d", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1558d540-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120626, "uuid": "cfc99255-1512-4470-9b74-6b997a0c4907", "comment": "Malware payload (Efimer)", "value": "13274778f1743d120256d07425de6ed3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120626, "uuid": "8b173281-50c8-41d4-ac46-9d8ccd7777bb", "comment": "Malware payload (Efimer)", "value": "5c339b6d6637750335a938d4320315cf4e0bd7bb1ee0418e794882ba9c120388", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120626, "uuid": "5cbf87d2-7a3a-497b-8ad2-c872ffbe671f", "comment": "Malware payload (Efimer)", "value": "7fe610c203a67fbb96493498da87c1828e7905e8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120626, "uuid": "11564121-7085-4495-9fda-8f9d75f01991", "comment": "Malware payload (Efimer)", "value": "c62f40dd4dc3f282bf5f7eedc5d56d49e19e13ff3818bdd9e686efa65e24534f9e1d4bf25635c0ec87ab2314b1af06b1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120626, "uuid": "7b91d90e-a311-4753-a3a7-f4de955ecff5", "value": "T169D633496EE161FDCB77C4346BE25EF0F09478785675CE1E29A4C336AC274A18E0C89B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120626, "uuid": "0cbaade8-c8ea-43b0-a78a-4e682bf9fe65", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120626, "uuid": "11f34df5-41cf-488f-b5fa-a5f5d13c0a9f", "value": "393216:qOgaKPmiXYejSy4yAXMCHWUjX+cuI3/PGTAI:quKPmiXtJ4yAXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120626, "uuid": "1a3d7f3b-6093-4a01-a189-cb93624bf203", "value": 13850736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120626, "uuid": "0e91f87d-521a-4476-8e27-10b31ea69043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120626, "uuid": "7be9edd6-e9d2-4dea-b744-734d325ccac0", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b661fb69-5276-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779080524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080524, "uuid": "7e39e11a-b4c1-4780-b79f-d0b8c7c77457", "comment": "Malware payload", "value": "c7000b129eed6690265c2428e6fefeed", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080524, "uuid": "0bb19f3c-9126-4b0e-9545-70042214b34d", "comment": "Malware payload", "value": "5cb77f141b57b9d2e30f695787ddfb00cd63dd6999372074c3732c67eb3fe628", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080524, "uuid": "ede4af28-ca01-4fdb-b19c-cb6b60f98941", "comment": "Malware payload", "value": "7e6a15eb66970e06ed305789663982a22787b349", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080524, "uuid": "2a8b6f80-7a75-454c-996e-a17a02c8b90e", "comment": "Malware payload", "value": "60df135131a1929ac03f5de928e06d637ccf44fa1dde6ae2f0d8ce38ebae5564105c5d4c2f3b4d803db7fbb130325055", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080524, "uuid": "90711158-d913-4aab-bc76-fe8c41f3d86a", "value": "T16214E0B1690B49B6E86122375F2E426592CE0FC2C578B63158CD38D2DF6353BC63ED62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080524, "uuid": "22a1e9b8-e00a-4233-8391-6cd6e6634ccb", "value": "3072:5SyOxCq8tfN5lNXlEMDoJDPDB98UK/dpowSqY3psPoLxzTaaoYlR3IK7HGrcFw96:5SHxktl5lNXlEMsBkUK1pownvPo1zbr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779080524, "uuid": "ef9b42ab-5cbb-4acf-877b-13e6c6186718", "value": 191390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779080524, "uuid": "ecb8d5ce-ed8f-4f4e-8807-9637c9500325", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080524, "uuid": "d80c3cff-3a57-49e0-a684-a09d168a50d4", "value": "transferReceipt.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe5966b-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089855, "uuid": "6f7b0c0c-f588-4e9e-ae4a-a86f4934a312", "comment": "Malware payload (Mirai)", "value": "8300f20b2dca4b59c8b4e4f11ed0e7bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089855, "uuid": "1bb3f87c-ae14-4c7f-898b-8a3d12cac5f4", "comment": "Malware payload (Mirai)", "value": "5d59d4353d542a901974aaa79152b8e5b1e121c4a81142da4a7dcde27d03d6a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089855, "uuid": "2217d283-7899-44c4-8775-ce26dfa36f81", "comment": "Malware payload (Mirai)", "value": "fadb7e482472e717c024660a408ff9d81e1aba8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089855, "uuid": "a430c80f-e91a-45f4-88cb-44353b146b56", "comment": "Malware payload (Mirai)", "value": "4e4a193eb0eecfa66a75c6364068092ad5fc13c3ec8d48c74ed19abd3c0635644019c3201eb68971610b278a521111cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089855, "uuid": "96137cdb-0e4b-436e-b27c-38ae202e4c96", "value": "T142A31946F8814A21C5D512BEFA1E318E331357ACE2DE73229E14AF2173865EB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089855, "uuid": "cf57b861-7949-429d-a151-3b976c4218a4", "value": "1536:wAnOCdbU/Amks5gIQLqCqOjmKzXkGE++fNLuaoyekXpDiARi2cHHwS0Q7jt5pYWT:rbMPOjmdKcNLuaoucHHwSr3tTLs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089855, "uuid": "b65c5a54-5b32-4aba-a56c-abc11a731636", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089855, "uuid": "7e257406-fc52-4e27-9b0c-74d9ce49b146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089855, "uuid": "7873efff-8719-487b-9e31-39ae95768ebf", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cf7d66-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091026, "uuid": "b9a20278-409a-434a-8adc-006e6b265f8d", "comment": "Malware payload (Gafgyt)", "value": "d19be4f0224ce89eda865b59a6333fbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091026, "uuid": "fda75ae1-8b38-4029-986c-5d4160a0ec1a", "comment": "Malware payload (Gafgyt)", "value": "5ecdb735ed978c5f220af4d2520b46f2a6f6902429dd5bb3a93ae9098168661e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091026, "uuid": "3311d40d-489b-4540-8496-3caabb7b4d08", "comment": "Malware payload (Gafgyt)", "value": "8f3ce58f54c7c482064e1ef97d593777bb553c93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091026, "uuid": "771edccc-67e5-43d9-9005-5c42123abf20", "comment": "Malware payload (Gafgyt)", "value": "0f16d4a9b4d946c912a3bbae3f3af683cdf397fc489b85aae99185482b424a867a9bd504a48d440baa09758935693514", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091026, "uuid": "9f78d753-7db2-40f1-8dc6-952ac9a6c618", "value": "T1A9144B0B771C0B87C1572EF02AB723F187ABED2116965580F11EFE8413B7AB06615FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091026, "uuid": "eec4d9fc-da02-4378-a160-7867fe74131e", "value": "6144:Qp8Homxa5+ouoXFd6JR1meQqdD/rHJryPFt7GW:N0hu9meQqdD/rHJryPFt7GW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091026, "uuid": "fba916ee-bff5-415a-9574-14edc04f2059", "value": 196898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091026, "uuid": "8cb5cddd-3c67-4f34-b754-0d790be092e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091026, "uuid": "15c36734-bf11-4987-b7a9-a05d81a3b985", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1e7414-52c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779115892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115892, "uuid": "bf5b62e3-1b52-43a3-a6f0-71d1cfa2df9f", "comment": "Malware payload", "value": "61bb276939a60833a5c2efea45db3eda", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115892, "uuid": "5b35dc21-2d77-4801-a9c2-997855da1a50", "comment": "Malware payload", "value": "5f2e38bd0a2eac46d2793d9d0c14deb09937291e87d9347872cda6f55c053685", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115892, "uuid": "6cd44a1a-0083-43f6-ba22-82114f0489b0", "comment": "Malware payload", "value": "dc6dbb51266c0e352e9a780bf814449e8bf63b00", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115892, "uuid": "5883acc1-ac4f-48eb-a720-af130fd956d2", "comment": "Malware payload", "value": "1a09303a6a3479371d221554fec16468765863873d84bdd6c4ef8faa4d08d514e8152d3b8f2b1fe466b1aea1fa411540", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115892, "uuid": "d2e8f7cc-ce38-4ada-bb58-890318be1247", "value": "T1FBD6023FB18BA53EE06E5A397A76E214583B7AA165134C0696F4C88CCF254B01D3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115892, "uuid": "a5ff2e1a-ac91-496d-af6c-9564368e9231", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115892, "uuid": "8f896921-0367-4939-bbd0-b72dd9c079d9", "value": "98304:E5/kLtzYtkaqLcCG3s0tsIuc681U9asJcWBa:gM9uq3F66RasJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779115892, "uuid": "dafd95bd-3134-483a-bace-ac9d72fc15b3", "value": 13653525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779115892, "uuid": "c996da27-0bdf-4a99-86c7-54da00f616e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115892, "uuid": "1f5c34d3-e89f-4773-ae5b-ca6e9dd43236", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805816de-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120806, "uuid": "1f777897-797d-4684-b13e-5e9b0a4d7e69", "comment": "Malware payload (Efimer)", "value": "ffb158cf328c9af911e5186dac1b1aa7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120806, "uuid": "3d520d77-54f5-45d2-b2e7-cf9ed8adbe00", "comment": "Malware payload (Efimer)", "value": "5fc3ec401675e55bd0028823caf04388bec2d279b019d10e2467bda40eae03f0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120806, "uuid": "f9e38204-1cca-481d-8510-ed410dcb0296", "comment": "Malware payload (Efimer)", "value": "f3342842170aaa161c7d4c95693a63a38f0607a4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120806, "uuid": "295d7ae3-247a-493e-82ad-f8fb88ac1217", "comment": "Malware payload (Efimer)", "value": "43d744d2ad69e2aabf535e36c6620d047a51d4bfc50784cf9594b9c08580917616de625602469a6e1cd1df4abc64df71", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120806, "uuid": "93b231e5-d628-4241-8c49-d07d2027f2b5", "value": "T18AD6330993C2F2DCC773C578AAD1ABF8F07874790A728D7B8BE49334AC579508618967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120806, "uuid": "455371e7-0b1b-4e03-958b-83338bae09b8", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120806, "uuid": "aad0b42d-589b-4ed8-919a-c8496464921d", "value": "393216:ezsmCpLGJv4BmDQVK69+DUXMCHWUjXscuI3/PGTAI:ezsgKSQVxXMb8X5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120806, "uuid": "2dfeb264-c11e-4590-937e-5d17c9b1b268", "value": 13857163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120806, "uuid": "6045ddf7-8f5a-4840-99bd-4cb338c8a271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120806, "uuid": "89b48481-70c9-4cf7-83bc-a5ae2b66fcd3", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35209a30-52e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779126263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779126263, "uuid": "7f33e92e-0a9e-4e21-8a3e-a98546829003", "comment": "Malware payload", "value": "957a3fbb694e1da6dd6a88fa40cdc609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779126263, "uuid": "d5e634ce-90f2-4828-b0cf-710385ae21ab", "comment": "Malware payload", "value": "6026b492dc20101a77354196207c2426919311ab6561393f4a990bae6c336c4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779126263, "uuid": "dcab98b6-4c12-43d2-857d-d904dac8b33b", "comment": "Malware payload", "value": "579fcea916e02dc395e7e24cb742536b3312a6f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779126263, "uuid": "6e165477-3877-44a4-8936-686df48299ec", "comment": "Malware payload", "value": "542a9bb81cc9866994d85fdf845b0b3a29623b4ab23343d33c024828295a72aa994231bb73a4f6fd43915f84908ba05b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779126263, "uuid": "ba1cebb9-772f-4455-8169-1361bb37fc5b", "value": "T1EB08337BA524E36DFB7934FD58BC8D3A921A856F12B04C097ACD51A0B2E2306D576FC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779126263, "uuid": "ef0f20a5-9d22-46be-be6a-4df92ae743fc", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779126263, "uuid": "773262b6-95c2-4769-8cac-bcbf5b464666", "value": "1572864:ft9IKPxrUnMATTtKRqVcIghSlaPVRp8yT4qsP9PK+e154TfTtJRTYsP8KKTHvz7:fUKJriMATJKRq6JhSEf4qsP254TfTREJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779126263, "uuid": "05eeac69-aede-45ed-9d37-99c6bb6b0396", "value": 77753607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779126263, "uuid": "ed34010f-bda6-4c30-b20a-fdee1d44c16c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779126263, "uuid": "4edf5708-d7e2-40c4-bc1d-5b1d6ccf11c7", "value": "EliteCheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261d2aab-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091019, "uuid": "2b76e8d1-c002-412a-a205-ef2ce5ef5ed7", "comment": "Malware payload (Gafgyt)", "value": "1f4d959e8734d5faa1a85d6fde5e6770", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091019, "uuid": "b9b14fad-fd77-4025-9e63-09c6feee117a", "comment": "Malware payload (Gafgyt)", "value": "617b103fe31c8d53b7b64bd14c7daaf3b40d09d90658794a144c1217d5fe31fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091019, "uuid": "931fe9c0-3663-478b-a451-64c0e4f075fa", "comment": "Malware payload (Gafgyt)", "value": "00b8f57383f201f511114cffab5b1e4e0f3b4cd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091019, "uuid": "ccba6ac5-95e2-49bf-b853-b37a83734e4c", "comment": "Malware payload (Gafgyt)", "value": "5e482d5354761ab0ec76dac8c41805c3ca9dd5940b05a3121bebbf7cc8d1c0922681c0f25afef22e45c8b627eb9dd902", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091019, "uuid": "f8c3f31a-36d9-4a78-97b5-8c684f47abe4", "value": "T1DBC34A05B752C0F6C1430BB001A79BB90735FD721676EE1AE718BFB48E722817969B2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091019, "uuid": "090c183b-e0c5-471f-9b81-69c79ce20660", "value": "3072:mNYsTaWjhVxEbGNkBfPaOe7udhQB7TByZwBz7DcdQ8:RsTaWjhVxEbGNNCdStnDwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091019, "uuid": "fa328025-3ed6-4de3-bbb4-49a9b55aca6e", "value": 118915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091019, "uuid": "d15f7deb-d2cc-4266-b7ec-cfe618137098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091019, "uuid": "726c2869-ece8-46f1-935a-0eb8a6134ae3", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73536c58-52af-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779104893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779104893, "uuid": "5bb23e2f-6231-4c82-9ff5-fa443dbd0d1c", "comment": "Malware payload (AgentTesla)", "value": "0ea6c1471acd86fc102da6b42b566869", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779104893, "uuid": "d978e367-22c3-48ee-897a-f4a795d52e2f", "comment": "Malware payload (AgentTesla)", "value": "6457c81bdad56f0fc9ab60304efa2773eb9a37f3f9f9b9d223da2958fef65f85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779104893, "uuid": "df1477d1-556a-482c-b280-4d35bee0e558", "comment": "Malware payload (AgentTesla)", "value": "0eadd1292f6aee606cf065521951a4bfb28fd8e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779104893, "uuid": "92e7db79-7204-417c-b900-26c3cb3c3818", "comment": "Malware payload (AgentTesla)", "value": "55ec824a49e01e22ac462c7cbc4a5baff6178cdd16d7c459526c54135e569e308b08026e71dea65dc7ce450b60db6d95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779104893, "uuid": "2c08b48e-2a67-4c7c-b44a-894f1cbe38bc", "value": "T1F21523629A6ECF56E98F1F12813FCD3285A8CC64C8785D5370CF67D08AA0985B583FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779104893, "uuid": "fe9faa35-9214-48ed-b06f-37b7f5dd8a81", "value": "24576:PTgEGHX3sXnoSI/wOh2mCRjm2TUIlYGdEXAdH5KlFrlc:POHnK4nh2mwq2TFTd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779104893, "uuid": "3fdc48d9-c1f5-4b09-85f7-4483c43760f7", "value": 923254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779104893, "uuid": "10aa0e4b-e8b6-44c6-97e6-6a07730527d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779104893, "uuid": "296bd73a-4937-436a-8c41-8d72993dae50", "value": "14052026_0117_13052026_HSBC_BANK_PAYMENT_ADVICE00873567.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d3f9df-52d6-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1779121669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121669, "uuid": "4d01e170-e2b9-4833-b6e9-c0963f83c774", "comment": "Malware payload (GCleaner)", "value": "66476939a53355d3977706a797f3b501", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EUONE", "colour": "#CC7E30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121669, "uuid": "7cb51dfd-c4e4-4cca-96b4-8c64aee3f719", "comment": "Malware payload (GCleaner)", "value": "645acdebf166cd3ebd7c05f9ca116216a274d9f45ad372d17465ac3d9d90a060", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EUONE", "colour": "#CC7E30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121669, "uuid": "b5e27a0b-a157-4dee-972a-16e577e2544e", "comment": "Malware payload (GCleaner)", "value": "691714505d051dadd43da79f291a0a96ca637dca", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EUONE", "colour": "#CC7E30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121669, "uuid": "1859b919-20f2-4591-bbb1-15aa29288278", "comment": "Malware payload (GCleaner)", "value": "d35fe2218eecc0cc4cbe547b9c3a0010b8c817ddb64ef7a549228f284d8d6e3ec8d660a4cc286564c81a9bb2a38d03b6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EUONE", "colour": "#CC7E30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121669, "uuid": "8a47e0c2-128c-4a7b-88a7-b507702bbcf3", "value": "T181F4AE23E1F08837E1772B3D9C2BA3589D29BE412924584A2FF41F485F3D6917B252E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121669, "uuid": "7377e074-3028-4d7c-be99-38977ba9f9c6", "value": "a789e47d7f495df16fbec0289d26c247", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121669, "uuid": "88d0b505-a8f3-407f-8cde-fab9f554cfd3", "value": "12288:71Gk1TTtqLAwP34XbWESfTzGaR0+BQWa1ACvW+VWip197WM/H2nBJE39Y:70MTZ1wPIKZHPC+BQWa1AeFVWSvX39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779121669, "uuid": "3358d06b-a214-4e59-89d3-ea54e35b38ca", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779121669, "uuid": "f26edd8b-3a7f-4ceb-acf2-dc191f5a17de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121669, "uuid": "dec806a4-a8f9-42f0-b7e1-1f69eb52a3e3", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18abe792-52aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779102593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102593, "uuid": "a3d111af-201a-415f-bf2d-2a38c72c7984", "comment": "Malware payload", "value": "9fab8e01c3e06e09e10b7ccbf1935500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102593, "uuid": "03225d6e-bfa7-4eef-b509-c5a5a0228ff6", "comment": "Malware payload", "value": "648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102593, "uuid": "5e191bfa-68a8-4a23-935c-33389cb01f03", "comment": "Malware payload", "value": "17ab1efb12a913d1df62764544e2bf185127fb09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102593, "uuid": "e9488c5f-176c-4086-89f5-1f3733409a4c", "comment": "Malware payload", "value": "6564b2269cc48296bf24c2f528a5af452f995c8417655e969c4571f6f9e4257899bb215395b4414402b024a2591e5621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102593, "uuid": "7267b9ac-bcf0-4f1d-91d8-b287e06db2f7", "value": "T1815523B0ABD8E012C66A47B62C70E3304B368D69DA21D387CEFDBCF7791D6116925253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102593, "uuid": "591d936b-8a48-45ad-94c1-6509436672c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102593, "uuid": "b3347b82-6aa4-40ba-a49a-3a054136c9e5", "value": "24576:LdKXPGcNoSbf23Q4qKb57JInmjWWH2Ow33V44k7P0cFEGEYitehLC0eI3Wewm:M/lSRNenmjvH2OG3VBupviV09Sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779102593, "uuid": "d8afaefd-698d-4dc4-b3fa-d0f0925e901d", "value": 1313280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779102593, "uuid": "16db60e0-0352-41d2-809c-6ab16f65b18f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102593, "uuid": "6307960b-1112-4442-b637-e13fec2fb9b2", "value": "889404755281_signed.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2dd38b-52ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779131885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131885, "uuid": "f5f7597b-a39d-4108-9329-f976e6b79a29", "comment": "Malware payload", "value": "d0006b87bd2694b0b6630640b5468e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131885, "uuid": "3d68fae6-d285-4457-9797-ee2e2cf20b0e", "comment": "Malware payload", "value": "6622eeca881d8eab00a28db53accf0f8c18bb32081a227c9b154322ea57869f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131885, "uuid": "37583054-1f3c-4ee4-a954-c5f29bb2d733", "comment": "Malware payload", "value": "650265e2d076a0887763e687267d3cc918f28049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131885, "uuid": "ac1bf6ea-91af-4e54-b41b-62a08bc76bdc", "comment": "Malware payload", "value": "c9c5b07c485a157ba85df5d8083469abd7557a8fce76dea8bc7aa62b1e94ce788e91e66fd9ec660aaaef21b592095c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131885, "uuid": "2f92abe9-3f0f-4923-9d53-35918c72664c", "value": "T1A608330857ACC396DDEFD6B6D6C0E7D28380C54FDAB2A84F636E3594F8814C5108D7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131885, "uuid": "db6784a0-1472-408d-b329-17744b6ea8b6", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131885, "uuid": "d781d7f1-a944-4e1d-a2d7-aaa99b9d2bf2", "value": "1572864:Jt9IKPPKjNwSrRWYs+v4//v/bwcEOMOUHwDu8vkjUOle+F4lSJ7:JUKabRWwLFOCwS8sjUOle+F3J7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779131885, "uuid": "c3549b91-8772-4a69-88c7-93dc9e3db57f", "value": 77490351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779131885, "uuid": "24f27c78-732a-4da3-949c-430ad364b461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131885, "uuid": "7d5f16b8-8a49-4272-be8e-418afa400e4e", "value": "DAS2_Game_w1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff722a11-52db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779124026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779124026, "uuid": "cbe259db-7727-4548-8a72-267f9f1eec38", "comment": "Malware payload", "value": "b04d6ca3a7e64cd4d58a1b9c722a5301", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779124026, "uuid": "ac4b0c29-04a9-4898-a318-be6b848b7771", "comment": "Malware payload", "value": "66a344904e9e2f3042cb2e186c7a6809724eb961308abb4f396c420f1c784b91", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779124026, "uuid": "e838770c-452a-49c8-8d61-3775f8800d22", "comment": "Malware payload", "value": "0c627bac6cefdc68f6638eda3dd8c01438441b3c", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779124026, "uuid": "3ed3ec8f-feb7-4873-971f-c176fe755de7", "comment": "Malware payload", "value": "0b66e301907e9431830428d8a553190a20c8a6ccaa1ffb79b562bc6bf4469fec96952f2cc7a3b03d0f9b767d7c83dcc7", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779124026, "uuid": "cf30c416-7914-4ee7-a188-3074a613f43d", "value": "T121757E19B7A31884CC77807055B47319DE61379C83409AFF626EC9A92737AC47B393EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779124026, "uuid": "dc2de6bf-1826-4942-8ac7-21be15164731", "value": "24576:pihx1hQVmTTY8l87ebUVncBJtJus0G11BNbPzRzepO1aE:pihx12VmnWfsg8NQp9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779124026, "uuid": "d3b94bc0-d35a-4896-9227-d8226a0be8a0", "value": 1556480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779124026, "uuid": "e6c5e951-1cef-490f-af1d-b0fc55fdafb6", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779124026, "uuid": "231c2a1f-6ed4-4cae-8607-4ba0f0c90c3a", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285d86d8-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091023, "uuid": "4e660426-bcac-4762-bfd6-4705ff31a4b1", "comment": "Malware payload (Gafgyt)", "value": "c0e398034bcc2d4429a8e3700797d1ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091023, "uuid": "e52591d2-9875-4a0c-b58b-f5d823969cac", "comment": "Malware payload (Gafgyt)", "value": "6707cf875e125fde56fd68733f4484ca9f4905b9ef569f35e75fa0eeeaf1f780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091023, "uuid": "27810214-b6ec-43b4-bf6e-c7e4edca1a8e", "comment": "Malware payload (Gafgyt)", "value": "d0b00b0db250e0775cc030a6b3bb2bb3eb25a620", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091023, "uuid": "73b720dc-cfac-4f4f-af8c-3aec7ce7957b", "comment": "Malware payload (Gafgyt)", "value": "0853ba0c713e7531b4decea407064be2dde053153b3430f3de037d86e6bca87b2223551072b082b744705fc3ee0c383e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091023, "uuid": "e22eacc9-225c-4efd-8463-073d003a0d4e", "value": "T1DC041847A8A55EB3C085AEB129B75A740757ED110F4B0B8BB63DF6B4422B8CCB40E774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091023, "uuid": "eff40278-ce72-49bb-b676-899f82d8f28c", "value": "3072:7FcttQFinUxR/oqCMUvW5BwmDdhQNipzDUx8m2Gqd0/ryxrCPFtcC6:7NGUxR/H++5imDdKiQGm2Gqd0/ryxrCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091023, "uuid": "e238b73a-42e8-4a47-a237-a1592579e665", "value": 181550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091023, "uuid": "1c160e35-4980-4e6b-8512-93309aeb322c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091023, "uuid": "090cf6f6-7c39-406d-b12c-03f479f37e54", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba87dfd-52d7-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1779122221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122221, "uuid": "5814f44e-2b37-44b4-a03a-4dfa68b08185", "comment": "Malware payload (CountLoader)", "value": "d647c0e96f02797cd493103640d949b9", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122221, "uuid": "9be70e04-5a30-466c-9c6a-2c515ce9b500", "comment": "Malware payload (CountLoader)", "value": "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122221, "uuid": "9e96efed-b0a1-4c75-8414-acc5282e9aa8", "comment": "Malware payload (CountLoader)", "value": "889bc3e6258ededb6e931e05913f27476d66dce6", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122221, "uuid": "5b513d5e-08c3-4aaa-9568-bdab941915ae", "comment": "Malware payload (CountLoader)", "value": "bc4cb220d2825026f86c0c9f041bdd25868c062e3e3fae7fc8dc80f03704e217994cc7820f762a79accf21d83c58febe", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122221, "uuid": "00d654c2-fe80-4ea7-aa27-83c9f3a14d23", "value": "T1CC062A52A46604BCC1E8B13074F67950EF6174882B3C37970AA3ABA42E3F7C25D76767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122221, "uuid": "f0a9d94a-be4c-4bbe-9310-a4c564c92c53", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122221, "uuid": "3dbd9695-33e0-4219-b9f7-d62bf76e2981", "value": "49152:0dg/8RVNaMqOvu+uDOA0PR9xM4Jf0FIfpBwAAGXxqvmiBv:0dwsXIGvsIBwAAGX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779122221, "uuid": "9029a72a-2e22-4fbf-a207-1ce2361a92cb", "value": 4005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779122221, "uuid": "4ada6a76-a9cf-44b2-9574-2506eb6a6cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122221, "uuid": "de47dcff-7617-4ee7-9e9d-51f61755298d", "value": "WW26A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354db3cb-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120680, "uuid": "f3d3eee6-7f88-4970-924e-e518f4cb8d5a", "comment": "Malware payload (Efimer)", "value": "7236417e5ea89d9f35f0820e7c37e418", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120680, "uuid": "a9dde9d8-c53c-44a7-a563-3dad35a1a491", "comment": "Malware payload (Efimer)", "value": "67a6bc4c9ab9db7c97fed590bdc797d1a492d7c5b5c5bd750f5447a5cf25b8af", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120680, "uuid": "5418d35c-6b59-413b-bbca-e51fd3403263", "comment": "Malware payload (Efimer)", "value": "382ec44e42fbb6b0bb159391a329ecf4fab7488c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120680, "uuid": "e5119be7-13f5-43d2-8e57-2ad409fcaeef", "comment": "Malware payload (Efimer)", "value": "5c8f45f0b26cfae75b1363d02e93bf62b7aa75c661cfca7aa8266d126116056e9d683b44533071fd981a5745a5f0055f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120680, "uuid": "db4af87f-d45e-4c57-8ba3-242ec1c150ca", "value": "T116D6330D56CBB0BFC7B69038FEE016B0A67D74AE52718937AF84E3716C43960492D897", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120680, "uuid": "8b103d7a-07c3-4659-8f91-1d2a7a921216", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120680, "uuid": "3505884c-ad87-410b-8b3b-48886db0c315", "value": "393216:ItDAnelIS3rINQoKxXL9XMCHWUjXLcuI3/PGTAI:I1AeSq0QoK19XMb8XoH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120680, "uuid": "66641e20-81ba-40ae-9389-940ec37ebef6", "value": 13829231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120680, "uuid": "5c8e5ea2-6672-481e-a489-fa11108c074f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120680, "uuid": "d450351e-a57d-46be-8dd7-b85a13d3ddd3", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e51d53-52ec-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1779131127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131127, "uuid": "323a7205-2ee8-4a5d-9e19-a4fc6f9832d7", "comment": "Malware payload (a310Logger)", "value": "5d2a5bf2184131f6993a1436146697cf", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131127, "uuid": "a3eb3394-c67c-4ad7-8e6c-3a41ccee93e5", "comment": "Malware payload (a310Logger)", "value": "67a7cba58174a668ef6769e8ad4e57655de1608cc51401a7ab786d767d66d246", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131127, "uuid": "7bc484d4-86e5-4fb9-b152-14667b923cfa", "comment": "Malware payload (a310Logger)", "value": "265e2fd9b70af5df9ac156f4a48982b985d2c6f8", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131127, "uuid": "7ba50392-bdcd-41b8-bea7-bf2466ea6f71", "comment": "Malware payload (a310Logger)", "value": "b3d411b88cd0ffabe5969a38e8805557087e82f2fee3517f5a7e8a2f9b110859be4f048bb16601c78fbfbfff2054d55d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131127, "uuid": "ac21424b-61aa-44fd-8c47-e77505248167", "value": "T1974522A0366DEB23CDB94BB41971E17213F57D4E9621D316CFE9ACCB391A3149818AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131127, "uuid": "dccef90c-b036-4021-b970-b86a7208cb1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131127, "uuid": "de066484-662d-485f-b351-8d0cb925a5e9", "value": "24576:6MI9bc9FbUvBr5gQgUqVUYDjZv0cRvKTNPH42ikCepgk:fFIvF5ZqVUQFv0aKv1ikCggk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779131127, "uuid": "b5822579-4c79-486f-8cd5-0703352a5e86", "value": 1222144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779131127, "uuid": "75a54892-5ebd-40ec-adfc-1ecabed541a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131127, "uuid": "ff3e9cec-b25d-4fb0-8040-6d8f706837f2", "value": "Recibos de pago_2958_2026_20_04_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c62bbd-530b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144310, "uuid": "b7f060b4-69e4-4cd1-a2c2-1e81635a6d30", "comment": "Malware payload (Mirai)", "value": "ae871055322b964c82ebcef9982866b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144310, "uuid": "221c5e39-52eb-43a2-8c29-fa55673d6e0c", "comment": "Malware payload (Mirai)", "value": "682a0b80e7ff1a67372109579bc3548d4520119b2ece1f6796f3c3ae74f31c8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144310, "uuid": "cc77ad93-f280-4207-9c2d-34ca4066171a", "comment": "Malware payload (Mirai)", "value": "610179a36b23bdbd14346336da885fdee5f40356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144310, "uuid": "9b2e615b-bedf-4501-a478-cf108f9cef6a", "comment": "Malware payload (Mirai)", "value": "b2083aff5125c30e2e34a16bb004d9b64f5615a38de65957d6fa02dbd973961b6c32f08ce7ee61dc050fa3f9dd1b6d1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144310, "uuid": "32540712-b2c5-4bb3-8535-673d340163be", "value": "T146936BC1E253E8F5ED1705751137E33B4B37F539102DD697DBA8AA32BCA2600D5262AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144310, "uuid": "b50bd6da-f79c-48a0-b07a-5f4c65880005", "value": "1536:Lh+jn2+ifI/EIzRBIepUGzX+VCW+XpElUxc2V7VKTiI3nPKxCdg71G+dkChCU:9+jn2tA/EIzPIepUG6VCPulY7VAiI3PQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144310, "uuid": "2c8c68f2-37d6-41f8-997f-02139a2c0cd4", "value": 91860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144310, "uuid": "54dc784d-cda8-4cfa-b70e-f1ec75f784f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144310, "uuid": "18c35769-4c5e-4c94-b000-ef7988b4913d", "value": "heilong.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bfa3e5-5250-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779064202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064202, "uuid": "36872c98-a093-45d0-938a-67974dac1a65", "comment": "Malware payload (Mirai)", "value": "362bfcc58332456162889240f612c0e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064202, "uuid": "bea1cf01-3b78-49e6-b428-4121712f05c5", "comment": "Malware payload (Mirai)", "value": "69033c25ab2f978443f25ca06c7259c6270f176409e35b9d635c1baa9444b9f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064202, "uuid": "fdf377e2-2a8b-4e24-8de9-ef160e7e3a48", "comment": "Malware payload (Mirai)", "value": "8ef8602c961eacb0d96129c2372f68a9c1cf623d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064202, "uuid": "3327bc9d-2535-4efc-809c-7fa23a5d22df", "comment": "Malware payload (Mirai)", "value": "cc23ec64b374857b65eca2a5616b2be9ad905831ef1735a022461a93fca9e2a3a8b66f2da8e1d0ee96590d094d372c24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064202, "uuid": "5a150b96-a901-4feb-8f5a-d2045dda11c4", "value": "T118B3E085B210AE55C02272FCB1870A90D3B16E7B4B9A150B4473F5B46DBCCD47E1AEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064202, "uuid": "cf2965c0-770f-4e0e-b437-f15ed783f1c7", "value": "3072:X5Apzl9NOvXoVLAE375lhYy5SkOXNwuz:aevXCLr59hmNw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064202, "uuid": "d0ab10ba-6972-49cc-8772-ca2279e10abe", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064202, "uuid": "71af1b57-2ec5-4bc7-a7d5-b7b7583874d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064202, "uuid": "1f96ccf5-32a2-437d-9cbb-de02a1338f72", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc9f093-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779120317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120317, "uuid": "f3f23a43-d7c7-4bdb-b47e-d57f8dd97c05", "comment": "Malware payload", "value": "30a6895a8107955510dc65f1c55250ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120317, "uuid": "0c1c566b-2d1a-4a06-a4af-4d0583f2c800", "comment": "Malware payload", "value": "69137fd14c53c01328e57436ab7f123ea2ea667077b87efdcc5b72b5b04a6c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120317, "uuid": "347d26b9-b3e0-441e-9502-243f55febba1", "comment": "Malware payload", "value": "ce8a962fff0e6144cc7248ab8ba35c878c76290a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120317, "uuid": "588d498b-c2e1-45fc-a291-3bb67361fd54", "comment": "Malware payload", "value": "11d2c605f9c10022c3f1cd5cc330de8414d4b81006f6a263541cea9e003345d685038df34cf14d6ca4ec98eb922a2642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120317, "uuid": "c50e2944-4aef-49ce-81f1-8139f108eaf2", "value": "T19534BFA3603CBE9FCDE91F379C8E891753A52FD5C880107E1D94750EFA672082E3A566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120317, "uuid": "a2a5c9bb-5454-4b3f-83e1-b288405f51ff", "value": "4776e99a40d8b72668e173a43de71810", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120317, "uuid": "fb067b1b-a15e-4f69-a97b-f61638605e45", "value": "6144:OftXfOMEuiqMwSBxWj/Fh36jsrQqarDXmdeyYKNiW:OfB6wSM4gEodfYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120317, "uuid": "e2fe65df-f7b8-4b1d-90fc-8d11f6d6f674", "value": 241763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120317, "uuid": "b2a2bb67-3f56-4bf3-9901-e3d2e48f9ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120317, "uuid": "311b0184-7f43-4f63-a8ee-d90b41c88e05", "value": "69137fd14c53c01328e57436ab7f123ea2ea667077b87efdcc5b72b5b04a6c5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d36979-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091021, "uuid": "16a238b8-dff9-48bb-8fd6-cddb6a841658", "comment": "Malware payload (Gafgyt)", "value": "0a1694dc09057d8cec4a286f592efc72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091021, "uuid": "f776cbe3-1634-4718-b9a9-6a78fe19889b", "comment": "Malware payload (Gafgyt)", "value": "69becc116756292000ea90cea79a79be398c2b063c1638125563dbc61f409ff9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091021, "uuid": "8d7acfca-41a0-4979-9ce1-d06c24fc73fc", "comment": "Malware payload (Gafgyt)", "value": "3abc9e7f5987e9744e980fa9d06a2f8139c70f65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091021, "uuid": "635d8dd9-79bf-4d61-becb-47402135ce3b", "comment": "Malware payload (Gafgyt)", "value": "00f54fdf32d3f3714d21c5186523c95b0a750c6da474444ce686445adaffadc216759a317e2aa8d1a699f3fff7198fcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091021, "uuid": "cfbf9a96-6d81-4311-b235-3bfd1a983ab3", "value": "T11A43623B27A71F93D1C1663006972232B96DCE8434B49BEBD8D174A93D35E18385E6CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091021, "uuid": "8096b968-5410-48e6-9e2d-f29438a922c5", "value": "768:pqZ4jFl81CYC4ZQCUPaq8j0gnVzDYJFcwQvwj0Ev4n7Jm2Sq62ScPF8KQhDuw5:pqg6Z+x8jXVNy4n9bPF8KQhDu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091021, "uuid": "4756547c-319f-4860-8d63-3636ddb69261", "value": 58749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091021, "uuid": "c416e345-62fa-40b6-9c65-b7989c0b4a2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091021, "uuid": "340569c6-31d5-482a-910b-70146af5988b", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d0525a-52af-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779104899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779104899, "uuid": "cebe00c7-e64d-4901-84a6-752434251e97", "comment": "Malware payload (AgentTesla)", "value": "6e556c1e7ebe70d374f61ce4aa556007", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779104899, "uuid": "d2a78c3c-6863-45f1-85d2-0db3206fcae8", "comment": "Malware payload (AgentTesla)", "value": "6a43cc3ab93e40b4b844ed68fa3ec383683d3835d7c743a38772022951aa6976", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779104899, "uuid": "b2075e6a-667e-414b-9106-8764bfcb8afa", "comment": "Malware payload (AgentTesla)", "value": "64ec3a4b205bdf5c1091c12e116d2ca6ce6e99d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779104899, "uuid": "e794282a-f81b-4a13-af31-add647ee2221", "comment": "Malware payload (AgentTesla)", "value": "93883baf2119df5bd70b02aa55006a8e5b37a1f7f031f0e5d38d411914808aecc5c91399b2bb0fc32060313335313ae4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779104899, "uuid": "aad9e9bc-11d9-49e1-8fa2-899f5c99ebae", "value": "T1B2251268250AE507CA456B351EB2F3B517AD5DECE112D2139FEDBFEBBA26D401C402C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779104899, "uuid": "a4c15655-ada4-44b5-81c0-4c3ed2830fd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779104899, "uuid": "9b830f5e-e1fd-40bd-a45f-1594f49cd26a", "value": "12288:xCp0vW0FsJYaQ9UMNuYzzLMMvx3JuBkWoJ3wZvtKWpePUFQWSS8FN/dbMkQ4F5RL:gpybMQHz0OV4IVyneIDAdbMULW3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779104899, "uuid": "9e899990-e0ba-416e-b89f-538a8384e1bb", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779104899, "uuid": "4b0dd518-cb80-4996-a769-49f1a2ac881f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779104899, "uuid": "129f224f-57de-4ec0-a3a2-7c81a2a299fa", "value": "HSBC_BANK_PAYMENT_ADVICE00873567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d468a8bb-52de-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779125242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125242, "uuid": "8213f664-e75e-4ef5-ab33-bc76661659a3", "comment": "Malware payload (AgentTesla)", "value": "e44f8cfd2d389cc8ad19474186263ccb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125242, "uuid": "afb0c5cb-eb6e-4476-9fe5-d39e1e720352", "comment": "Malware payload (AgentTesla)", "value": "6ac830bd7321a7add3991a03ed8c82104d17f6d6fa2fff5541cb73dcf773aa21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125242, "uuid": "89e27570-0a7b-4f91-a796-badb3eecb983", "comment": "Malware payload (AgentTesla)", "value": "6066c1578dd87435917a6be4186bc7ec5de517af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125242, "uuid": "4c4c34bc-447d-4017-bd76-76f1bfb24a71", "comment": "Malware payload (AgentTesla)", "value": "838940da583d05a7832b24e512a491fce44487a895844d0362fa25d5a3273715a91da8f4e1dbb38b8b98353318272286", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779125242, "uuid": "3e5ab716-0158-46b9-b3d6-b93967ebe3ba", "value": "T18BC583BA722BB1FCA5458C7C5FC25982FB9613A404E604B16E27E8B21D70347C7E7C66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779125242, "uuid": "ef538167-7219-4c0a-bfcb-8dbee6fc4e68", "value": "768:ebLTbLTbLTbLTbLTbLTbLTbLTbLTbLTbLTbLTbLTbLTbLTbLTbLTbLTbLTbLTbLn:d6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779125242, "uuid": "41136c95-0fda-4a96-b060-36658ac082ac", "value": 2659673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779125242, "uuid": "1f17d961-9f4c-4f1d-aa56-97a293eebdf1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779125242, "uuid": "a1b73914-92b0-4515-948b-28c63b787a6f", "value": "Nueva orden de compra AD31250192.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7f4106-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120852, "uuid": "98a3d16a-06b4-4c79-ae47-0c7a3377a42f", "comment": "Malware payload (Efimer)", "value": "438153f997c507f83d7dea8cf64dd2ef", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120852, "uuid": "18a72004-f671-4d1e-b614-f82216814235", "comment": "Malware payload (Efimer)", "value": "6bcdd2d143cb09ea75e38d35577b68923ed03604ff27a6b07fa16a8594f2c3d4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120852, "uuid": "51758b72-f5f0-4277-b7dd-8a49c5593832", "comment": "Malware payload (Efimer)", "value": "f36c4bff9d1ce0b26ed90ec67b60ecd25bcfc7b3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120852, "uuid": "afe8b64e-d349-4fb6-815d-eca6611da4b1", "comment": "Malware payload (Efimer)", "value": "517d8ded059c5c1deb52e8f0c075ffad26808973f6a5709e327a621877973e94a91b07a7dccf5c3d2158b47a09cdb4dc", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120852, "uuid": "3de804fd-1fc2-4a8f-9db2-469fb3a39da4", "value": "T170D63346A9D270EDCB7380747AE63971B06AF47517344C66ABA4C3B2FC970B4822C4DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120852, "uuid": "9323d075-fc3c-4f7e-9578-8addc6b0ed02", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120852, "uuid": "ee078a43-1014-4863-8437-d87161fc64de", "value": "393216:qdIAedFeUzBBgdUeXMCHWUjXqcuI3/PGTAI:qdK2eBEUeXMb8XHH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120852, "uuid": "9ae8c8ce-f058-4841-b4ae-4a29bf833e48", "value": 13865656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120852, "uuid": "09692ec5-4019-4d23-be30-68e3b4319a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120852, "uuid": "17ea12af-9227-4c63-af29-b0c52fb99d85", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e190ee-5314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779148348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148348, "uuid": "944ac45b-2ae4-4f3f-ba19-e09b59b43e4b", "comment": "Malware payload", "value": "ebe355aa92e88c3017c63eea85ed83a9", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "eeee456-it-com", "colour": "#F79FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "novocoleta-online", "colour": "#F2F857", "exportable": true, "hide_tag": false }, { "name": "sznftk1-it-com", "colour": "#8C72A8", "exportable": true, "hide_tag": false }, { "name": "xelamnces-online", "colour": "#843FAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148348, "uuid": "cbc2eb76-60cc-4132-aac3-649e4deda429", "comment": "Malware payload", "value": "6bd804b150495e241f5791e889b8eaa1c2f16564cca78da4caec91a2d37f2955", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "eeee456-it-com", "colour": "#F79FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "novocoleta-online", "colour": "#F2F857", "exportable": true, "hide_tag": false }, { "name": "sznftk1-it-com", "colour": "#8C72A8", "exportable": true, "hide_tag": false }, { "name": "xelamnces-online", "colour": "#843FAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148348, "uuid": "325a1833-4d90-4b51-b0b2-6a28c954c3f6", "comment": "Malware payload", "value": "1358b93a68bdff52f5798c12639bfc91fca77302", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "eeee456-it-com", "colour": "#F79FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "novocoleta-online", "colour": "#F2F857", "exportable": true, "hide_tag": false }, { "name": "sznftk1-it-com", "colour": "#8C72A8", "exportable": true, "hide_tag": false }, { "name": "xelamnces-online", "colour": "#843FAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148348, "uuid": "c81761b7-acae-48af-a2ea-3d611b55bad5", "comment": "Malware payload", "value": "7f82b45b8e842adb89c61b12c795c48c7305af6075c3729366af2f5f479e20cacfd0a3177b8f6c427639bdc3927071d1", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "eeee456-it-com", "colour": "#F79FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "novocoleta-online", "colour": "#F2F857", "exportable": true, "hide_tag": false }, { "name": "sznftk1-it-com", "colour": "#8C72A8", "exportable": true, "hide_tag": false }, { "name": "xelamnces-online", "colour": "#843FAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779148348, "uuid": "6838bf26-7b54-4f7d-a95e-828197265a3b", "value": "T1BCD6538DE43A95D8DC4735F0BC82188C78495CE59FBD422E442CC46526EB6BD029BBFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779148348, "uuid": "00442084-897f-4874-a8b3-7424c5de71b3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779148348, "uuid": "db0063af-8bca-43ac-b90b-7dcc0122e2bc", "value": "24576:hy325vzqDtQXuEuXjF1wjiourmDtQr7oiZoo4libNUH9Bvr8OUIFTsBbK8uYZ+RG:g3mWDJXKhuiDgXKhuKarl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779148348, "uuid": "922df75b-8f95-4a54-80c3-d41f07fef275", "value": 12989312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779148348, "uuid": "48eec987-ad14-4ba4-84fd-a05158486262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779148348, "uuid": "3e5540d9-49c4-4313-a0a4-09204ffe5699", "value": "libfilezilla-43.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6d5893-5286-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779087134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087134, "uuid": "850475c8-dfa1-47d8-a17e-0453699af979", "comment": "Malware payload", "value": "bdad94cb4c9e61e45272d2ac0875838b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087134, "uuid": "9f71d8c6-3a08-4322-91e3-c3ecc79e5e20", "comment": "Malware payload", "value": "6c7b2aaae4101550fb73fe24d98a3fef8eb0c4ee4dc1444f19c54f6fd67b70f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087134, "uuid": "27a3b303-4fa6-4d06-b6b6-0f4e718f6d95", "comment": "Malware payload", "value": "a8056a5b2d5c7e429c345ee5bd02869ab0b469c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087134, "uuid": "f7ef0b63-2e2b-490f-8b41-f9877ed92d7a", "comment": "Malware payload", "value": "69c7ac3c92a14459d65d9ef1991d180baf15975cda8c4c4833b055888bd012ad6d96181df8e33f1b0df7500c84591dd1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087134, "uuid": "f49229aa-f678-45f6-98eb-fa57f3094ba2", "value": "T1ECE02D37020CCA04039AE06828B03D4D0E250208C92705323E20EF0C9BB01FCF4A2030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087134, "uuid": "74d85c8c-4d65-45f4-b641-818ebfeff780", "value": "6:snye+I4Q75z6CzyK0L4s+wlVqz7rHFfCKTUKRRroKZ1ZKgbRPMGWzmXHK8:sneI48ljzyLLnslKpKRSa1ZKyRSzgHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779087134, "uuid": "2ad1f14b-e2a5-4c6b-a33c-cba183c512da", "value": 313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779087134, "uuid": "6dee1959-a091-44f3-bd22-555b0b212b44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087134, "uuid": "6efb7962-6a6a-4960-bd28-bbe52595787f", "value": "ErrorHandler.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51754c43-52aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779102688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102688, "uuid": "4969c720-fb6c-4426-8993-4ca0c87a30fd", "comment": "Malware payload", "value": "1651b333328de8d8be433d88c70bcae6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102688, "uuid": "b4fc6b7b-fe62-473f-9582-ae908c8043aa", "comment": "Malware payload", "value": "707e67065d3891c63266d34da0e69c20cffc6ae45a3327a5745760b539252473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102688, "uuid": "489275fb-3bd5-4b4d-8d60-6fa2e278557c", "comment": "Malware payload", "value": "17518731c2dc394ce182696365e6ba423aa95efe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102688, "uuid": "90cd960e-b872-4af1-8ac7-e91415281577", "comment": "Malware payload", "value": "31b414def9bd7f985a1b02f4318f2b2a83fa242567732ea648d9e00389ced6dda0f7d3066cc4727134c70755e20aa287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102688, "uuid": "a5579edb-2b88-4fb4-af1b-d5101938feb3", "value": "T1AAF6E0E0EA00BE07E76BA035D434F568D6684190F355F43A38A8E5B8D3F13A436AF59D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102688, "uuid": "224285f0-8d3e-40eb-99c8-8e58ad5f7347", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102688, "uuid": "4367870d-9673-45d6-93a0-0f1eb55e0e88", "value": "196608:791K3uGM1A6fFJz81OmM0QP0G2bjBMv9Ph/4unZ64rElvqZfVIcZdnC9SNFLw5xa:77GMzfbw5QN2bWPhwunZ64rEl2N5Z28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779102688, "uuid": "69b89200-06c3-4d9d-bb32-89c2cb8341cf", "value": 15327926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779102688, "uuid": "b435cbdd-1a22-4481-b88d-c1965c4a0076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102688, "uuid": "f675a9ec-f876-4c7b-b227-9464c3e9a0a6", "value": "1651b333328de8d8be433d88c70bcae6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc95bb4-5309-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779143729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143729, "uuid": "45529bf6-47b5-4143-bb2e-0e1632d9cf5c", "comment": "Malware payload", "value": "19664852875dfa4b965575baf2cac208", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apigrokcloud-icu", "colour": "#06BA4B", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143729, "uuid": "6c9648c8-4fc3-451a-82fb-b368b2bd8dfa", "comment": "Malware payload", "value": "70bcaf6e46dda73cb3ed397abd9b900707133356b5f5253915365cdb5702407d", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apigrokcloud-icu", "colour": "#06BA4B", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143729, "uuid": "3075ca15-1997-466b-8d92-0d2e59a96ad1", "comment": "Malware payload", "value": "1ef299f43417f8a7ab41bb076f442f1a439320aa", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apigrokcloud-icu", "colour": "#06BA4B", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143729, "uuid": "09a763bc-4d4a-4511-8929-b4a3aa8aff30", "comment": "Malware payload", "value": "c40369e3c08c7940a59a0c0b8b09f2766b36a3bdcd440204265bc7ed19794192007fcf67d2090246239d78a23b8fb955", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apigrokcloud-icu", "colour": "#06BA4B", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143729, "uuid": "94112b21-b538-4ec9-b12a-898d49edbd2a", "value": "T10C373356C8E8F4887B9B0B1D7E7F998A029634198FC50CE329AFC0D56C94B53B0791ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143729, "uuid": "1ce69337-603b-400c-93eb-79b5fcdf8be4", "value": "393216:1Gmux+poB4l93IaWor2y47nzlhuFYnm74AaBVY/bAsn54iBtpymkl6H1Y9kdB:MmE+e+rh47nGFVaBVY/b/yMtpY01qQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779143729, "uuid": "391516b5-2f46-402c-a659-4cd5aa27a634", "value": 23398276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779143729, "uuid": "be94cd81-cd21-45b8-9886-fe03c5202345", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143729, "uuid": "f5666eea-285d-4018-aba0-ff7fb613da70", "value": "MA!N_SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef47c830-5294-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779093504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779093504, "uuid": "6f5f79a3-7916-4206-9e71-a2a459c0902f", "comment": "Malware payload (AsyncRAT)", "value": "04975399b06a2a3e065b84a958ba78b7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779093504, "uuid": "33ac7cbb-db6c-44d4-bce9-eb56bcab82d8", "comment": "Malware payload (AsyncRAT)", "value": "72b37313e32fb85efa8b8c0cadd336027a4a097da4ef2342ce10ee24e5a74f32", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779093504, "uuid": "75102935-39f4-4022-a122-6b26ee3a05cf", "comment": "Malware payload (AsyncRAT)", "value": "91bc474885c0dde398743b77043ea91f485569de", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779093504, "uuid": "7a2c1b64-125e-45b8-b11c-1b33b1a75907", "comment": "Malware payload (AsyncRAT)", "value": "1219648e622b15785c91cebfaa5911483bbf19d103631961cb0e8ecd0f2fc4fce669c10079622be28337e3fbd5a5868d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779093504, "uuid": "c536cba4-ef50-4459-a1d8-5c3b99510887", "value": "T103233B003BE9812BF2BE5F78A9F26105467AF2A73603D5491CC452D75713FC68A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779093504, "uuid": "a9ca1310-87cf-4712-b553-cff2921888bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779093504, "uuid": "994e1983-fb81-4e3f-bcec-8a2c1884a14b", "value": "768:XuWq1T1hx/9WU9uloXmo2qzcqz7fzuOPI9zjbrgXsiBhHXFbpafzzYBDZPx:XuWq1T1PsC2zqi393bUXJLH/kzqdPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779093504, "uuid": "c14e3bd8-c3f1-40cf-b1ad-a97f2523fe23", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779093504, "uuid": "a2fadef7-e2bf-4f93-ba21-6adfb28c6cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779093504, "uuid": "244b1f98-dd6e-496c-80f0-3cbdf54df7f2", "value": "scfrrip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afcc5e5-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120743, "uuid": "36a00f91-19bf-4e08-b466-36ee53d92227", "comment": "Malware payload (Efimer)", "value": "cf25ab59c006e8d8fa0c39ea75cfb088", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120743, "uuid": "cd260829-cfd1-4d70-a4c2-035ddc555e42", "comment": "Malware payload (Efimer)", "value": "74593ea5b46c2d38557f7e85d0955562c769b31906b037d0dacdb66f28a70663", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120743, "uuid": "84a13a54-c893-49ec-8fbb-56fb9fd7bfc1", "comment": "Malware payload (Efimer)", "value": "cc06bf5b2b160436a79349dfda3376e20548dbf9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120743, "uuid": "7d0eeeef-7eb3-4086-a6ef-61a9685110d6", "comment": "Malware payload (Efimer)", "value": "acde9e0a143e6e5b6a0d1c3ce407b85a077eba2e784a552b9bdd5326146268ff7adce65b56127a269b7792f3e70f4627", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120743, "uuid": "8e7fe4a3-b893-4cec-aacf-b7f724d7f4b8", "value": "T130D6331986D312EDD7E391B47BE542F2A079BCA40372ACBB5B29E3308C771A1D95C817", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120743, "uuid": "d191b5cf-1504-4562-a86a-a7c66f18ff05", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120743, "uuid": "c87ee072-a101-4720-a9c3-85610cceddab", "value": "393216:jaktien1J8vyhyj1tS1iAb06XMCHWUjXdcuI3/PGTAI:j3ie1JQdoiAg6XMb8XqH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120743, "uuid": "40ab2f04-84d3-4025-b51b-03c8499d8476", "value": 13850522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120743, "uuid": "c171db65-e69d-45e5-acd3-e6260e755af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120743, "uuid": "9b16ae31-036b-4df8-9346-0a6455aab77b", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6acc3e-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089933, "uuid": "dc88fd77-df68-4098-a4ac-cd491eb45fd7", "comment": "Malware payload (Mirai)", "value": "8e41435dfdc4a697c7ea8c958740dc08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089933, "uuid": "536424c6-fd10-4027-8042-e656b12feab8", "comment": "Malware payload (Mirai)", "value": "74991b7ae4252911440f02fac2f832fdfac6c2d15687a569225abbad431b70d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089933, "uuid": "a2c30797-ae07-4cb3-8745-849c81ccb30f", "comment": "Malware payload (Mirai)", "value": "69dc61c724df12d5c57f6e79d1183e45b4265bce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089933, "uuid": "c2a7a442-9d17-4b63-9425-bc16b93f3b42", "comment": "Malware payload (Mirai)", "value": "83c22bef6812570e0311ad2ea521acfede9afd108783ae94e6911bc90365d2c792d4feda3c60a28af55120563836de26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089933, "uuid": "0523c398-1975-44ca-9657-86a298319c3c", "value": "T1B7B2D036E9D589A0C170C0B1E7358A8136E74375C3FE7BA17A0186A861C25497FFC8C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089933, "uuid": "12108f5f-2287-4317-b4f3-622041ad09b1", "value": "384:tVUAgwrUshIYowFf/IHqkWQIouYHG0MW3nQFud8iN8A4kGEo/8KhymdGUop5huw1:zYwpAHq/QhuIG0MAYud8OGp/9s3UozMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089933, "uuid": "1affb7eb-e9a5-4f6d-a2e0-88ae001d57eb", "value": 25128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089933, "uuid": "96edb189-7719-4386-bdf3-7bb9621278ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089933, "uuid": "632b62d7-429f-4d6f-b73a-996741742e2b", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4399d33d-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1779089780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089780, "uuid": "d441d820-340c-41bb-9e4d-fdd5ddcb86e5", "comment": "Malware payload (PureHVNC)", "value": "14b9313395043e7add3fd065539a8056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089780, "uuid": "7ed3f333-bb4f-49f6-a7b3-fff58a00ba1e", "comment": "Malware payload (PureHVNC)", "value": "767974490348bf90c69d4c0d98ced96890b7262bcd9d7045b1cb78550b5cd423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089780, "uuid": "61a577a0-67ea-4f9f-ba41-75beedfe8a65", "comment": "Malware payload (PureHVNC)", "value": "1adccaced647a717b1e64ccae9c3df63697622fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089780, "uuid": "269c9c1b-9f18-4c12-8539-499b85c0257d", "comment": "Malware payload (PureHVNC)", "value": "c3947df973499eff1a283ad84cf15348b0965e102b265645e21c3faa83ae43f44eeee1ba83829f88c193a7efcaf3ce96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089780, "uuid": "69c2a4bc-6701-4506-88c3-2162f3ffd5af", "value": "T110D48D6B76168E20D1885333D6CB890063F0A596BA7BE70F748813E615473BADE1B3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089780, "uuid": "96456d79-9137-48f9-918d-ead9a6510e79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089780, "uuid": "fa230a83-2ee6-4bfe-ad9b-c7bdfd6016ce", "value": "12288:i4LzTvkrAp4IcQF6pCI08JWoYr8muZx/InxCqgR:dLzjkrK4IL6pCIGrEqE7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089780, "uuid": "17d96c4d-902a-466e-94a8-2043818e5031", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089780, "uuid": "de72c037-88bf-48d0-8eb8-30b31cd612d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089780, "uuid": "2479ec0a-6c48-4341-acb4-c643bb66bb8b", "value": "14b9313395043e7add3fd065539a8056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e969418-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120642, "uuid": "c13ee057-176e-4be4-b74a-74322396430b", "comment": "Malware payload (Efimer)", "value": "d07ac206530acf3e27ca112007602a0c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120642, "uuid": "a69921c1-53b2-475a-b5f9-9909e6379e03", "comment": "Malware payload (Efimer)", "value": "76dbb522ce12358316971faad7358fa534fd9c6b5063b8ce115222f0f1d973b9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120642, "uuid": "82fc4151-fa04-4af3-852e-780ebd77f093", "comment": "Malware payload (Efimer)", "value": "d7191655af804881830a9f7700d220c0e75e92bc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120642, "uuid": "aab5c2df-df32-47d9-8032-bec8c20cf133", "comment": "Malware payload (Efimer)", "value": "9a68c5194914f8a292de0c36b48d2f1a1eb3e16395601b614a4c8b7a7105ce00ae8cdccdf2a224967c7262ed26ff2832", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120642, "uuid": "bbe6bd6c-1377-4a10-b039-fe39a680d525", "value": "T185D6338CA5C2B2AECAF7E238BEE917F0F03C74B50635486ED694CA711C6B5E4456448F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120642, "uuid": "53d5be65-41a1-4287-8cb9-dc8c043f8780", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120642, "uuid": "09a5fd01-f125-425c-a1c7-0db035efec06", "value": "393216:KOGbSVSf9kumnT25XMCHWUjX4cuI3/PGTAI:KOGmA9TmnGXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120642, "uuid": "b3fd0172-6c55-4b03-b60f-eab275cab6d2", "value": 13844566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120642, "uuid": "51cbaf7f-bbbf-464e-b421-20dde93e01ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120642, "uuid": "a189c3dd-973b-4678-b4f3-94fb67eee316", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a36a9c-52e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779129344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779129344, "uuid": "e33cb558-1ed7-4cf4-ac40-676f1ff0248a", "comment": "Malware payload", "value": "64d956aeeffe580d55e469a077677ea0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779129344, "uuid": "d12e88f3-6045-455e-ad36-600690219ef0", "comment": "Malware payload", "value": "770646498f37d2d832a552727537ac5eec7f1177ed34e37030dd35a44765e867", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779129344, "uuid": "b9965599-e090-4211-8c4a-2c8b87d349fe", "comment": "Malware payload", "value": "f9431bea1c60f509066b183d1519d92ee04c48de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779129344, "uuid": "7f43677b-59a9-4d70-986c-782e57a31f63", "comment": "Malware payload", "value": "33ffc5cf5ec65f952dc4fbfe9920c778b77cc169ab56def67594838a8f8a1d8089f18d9008858ae100f2ad1805c73850", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779129344, "uuid": "baa94f1c-a75a-41c0-bfdc-13aa911b7f5f", "value": "T1DE763B87B8924952C4E43A37BCBE81C432634EB99BC7565B6D04EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779129344, "uuid": "7a0614a2-4249-4667-bf75-3d51da4bed94", "value": "49152:p5xNekq7aBHAYP59wlLVmCveTH2mkG46RU25cO78gyqj5E+:lNu7s9h9wlLVmCvezcO78zqVE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779129344, "uuid": "eb8862ff-6a3d-4ba3-9936-a7e93de7368b", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779129344, "uuid": "aad61333-f3b6-4bdf-a512-c95e46259b07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779129344, "uuid": "c506e895-6765-4d29-8e0d-2b16e64bd9f8", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492a9599-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120713, "uuid": "82b520b4-0d61-4b4b-9fe5-357955bb1303", "comment": "Malware payload (Efimer)", "value": "e2c3c0f82e2bbc3aa264769a2db3bdea", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120713, "uuid": "548d1242-64a7-4407-a828-429de32b025c", "comment": "Malware payload (Efimer)", "value": "77dd9a1447289fda51b9891a7fada0edab87f640bf95d4c9d97c38eed027eb90", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120713, "uuid": "96331946-c3b7-4481-9caf-403bc23dbfaa", "comment": "Malware payload (Efimer)", "value": "bebd74c57e237294896aceaf041102e4f4321741", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120713, "uuid": "6d958a60-a86b-4f96-9393-f63f214d630a", "comment": "Malware payload (Efimer)", "value": "e18c7061398a84841ce68d279c4fc22ce8f624a59d9f733c3a1423f5d5b0c8fcc6b03481cf06ecc5b73e743a4851e3c2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120713, "uuid": "f42656d5-abb7-4a56-aef4-87fe3750b82e", "value": "T106D6330C69D7B1AEC777A0B4B5E16AB1F474B4789732DA6F1214C37138A3160DA3D48B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120713, "uuid": "e98de59c-735f-4ae4-a606-b5af4565cec2", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120713, "uuid": "fa71b298-5b93-4127-9a97-2c178496254c", "value": "393216:ymbSnkbiZYDFmpXMCHWUjXmcuI3/PGTAI:y+euiZYDFmpXMb8XbH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120713, "uuid": "d15498af-a8a4-47e2-8bd9-1a44cd3bcc71", "value": 13851254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120713, "uuid": "757467c4-0927-4712-9deb-80a3ea01dd9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120713, "uuid": "cad95825-90bf-4a76-9704-a42bb5a3b30e", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed1dd85-5311-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779147003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147003, "uuid": "994afce9-470a-47a6-9459-36e8cfc5fe51", "comment": "Malware payload", "value": "819f35ecb6a2bda166db5a53b446bece", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147003, "uuid": "a583e249-dfd8-46a3-8e81-a3da8f27c0b4", "comment": "Malware payload", "value": "78d8a9e25c0d347af8b99d941b31ef0d3ccb8402d2bcd241206ac9b911df242d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147003, "uuid": "dc24a40b-8125-40c9-a676-f4bd06d8da2c", "comment": "Malware payload", "value": "253ef17556419d519e03389a61629e402e514753", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147003, "uuid": "a09d7595-0887-4908-9075-fdcfbe900358", "comment": "Malware payload", "value": "fb0dfe9901ddfd7dd8ad3ea8d05a2fb43c771500aa85bb27b8d656e909a66d861aa734c330ce692d5b323653399fd72b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779147003, "uuid": "eb3b1d84-b87e-4baa-ae90-688c098dab11", "value": "T1BFD3D5B71253BEDF4B730E41D5082591DCA8747FBE2096E8BF8515C246E2688CEA9DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779147003, "uuid": "e5ff1e23-7181-4958-98b8-49bb227e542e", "value": "1536:NQ4kkhqxTq2w/U+He99ss1taBZNBH7AA7R3niyXD1ekwX1Akx6KtFwGzBaWNKs5U:NQ4k1ct/U9t0ZNBPb8ckMsnfh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779147003, "uuid": "dd03a886-d1d8-4e9c-879b-bdba3f68c2a2", "value": 134491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779147003, "uuid": "c1426de7-cb40-4485-8c86-3adaab01152c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779147003, "uuid": "477e6ba4-b36e-4500-93b7-7623945f6eb2", "value": "9uJ2y18akW.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e72388-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779143928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143928, "uuid": "799852cf-d1b4-4e3f-add5-8771bb8b36c7", "comment": "Malware payload (RemusStealer)", "value": "449635fa4c915aa00396716ad93a8a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143928, "uuid": "d7accf52-1a88-4334-981d-deeccd027e68", "comment": "Malware payload (RemusStealer)", "value": "7af50893e74afa011adeb91cd7c0bf627a77f38b725a83112a3e88ec88b1f2de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143928, "uuid": "cdbc8fbe-8ad0-47a2-8542-39ca0cb57629", "comment": "Malware payload (RemusStealer)", "value": "0fcae748dd1fef7bea5e9856a0530cbc2cf4a99a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143928, "uuid": "07e411ed-c402-4f1d-a5d8-62d569a1d149", "comment": "Malware payload (RemusStealer)", "value": "ef03695296912aa7c88048818b1ad688fee13698c3ede6f0a5b2cf9c878122fb628a58c1cea124e3c8ce31f93e5b335e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143928, "uuid": "4a6fb119-be98-4e79-bca2-58b4d749cc0c", "value": "T1D2D55A03E82148BDD1DAF13568F57540AE2174046B3833D71AA3ABA42F3BBC15E7676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143928, "uuid": "20fcd86d-0fa5-4706-b219-dfe6e227993b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143928, "uuid": "1f996cb8-5cd2-489e-a896-7b56fef91ea5", "value": "49152:jSWJeWBCB1ViEMJec5HArGvruWKT7GKGAH0eLbFEkUY3gR:jVazib4c5OGvruWKHG3AH0evFEkUYwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779143928, "uuid": "d7a249ff-43dd-4af5-a485-a74780772c5c", "value": 2917032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779143928, "uuid": "f4d02f96-3863-4ad9-800a-6aba6ab733a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143928, "uuid": "8bbe3a77-e695-4ac6-8685-d8961e287546", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35004242-52b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779107795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107795, "uuid": "2b004277-cc6d-4f19-b9bc-a30abafd3221", "comment": "Malware payload", "value": "a14f43222eea58afe0a5d6f36e1f271c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107795, "uuid": "f680625d-723d-48fc-9cf1-a4a87c309010", "comment": "Malware payload", "value": "7b4ee18123d9ee42edfe5aff6cd6917dcf31df12804b6f4974334b2a8e1bcb2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107795, "uuid": "a6eea5c6-4f7b-4309-85f2-9fe03a69c7fa", "comment": "Malware payload", "value": "39fdec1d50b65d209559bef7ccd62fc8e368a5d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107795, "uuid": "02a9aaee-419e-4283-b87c-277fa90e224e", "comment": "Malware payload", "value": "462d4e69e9351b486dab3c099faa00367ba430b186aa39a00be97b642ba657fc566396ba3750bb0624f18a10116863be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107795, "uuid": "b37346a4-0d36-4327-ae37-5bce36ea3b4d", "value": "T146738690B7D4BC48036B1BEB672BF0F1E16E15AAFC944207ED40FE94A670716E9E0631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107795, "uuid": "825f9829-00e5-4483-8ba9-688f2883bfe0", "value": "768:Dag+TKS5VXR/VjTxR8i7Pr+BTjwUQIUgvjHkgdg6rl5/bhHKTU+6eBBjZuJFLGdB:DA5ZMED+mTd1htWLhjaC6JijdIHN+MlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779107795, "uuid": "89901f0e-38ff-4c1d-85da-bd7c24fd7f13", "value": 76551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779107795, "uuid": "424919e9-96b8-4a31-92ce-7416c53157b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107795, "uuid": "fd24a6d0-160c-489f-acaf-1374fe1471f5", "value": "REVISED PURCHASE ORDER 18-05-2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8c5a82-52f0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779132643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132643, "uuid": "9b014719-fc9e-4ea4-88c0-fa1059515545", "comment": "Malware payload (AsyncRAT)", "value": "0106316cb1d34fb20f684ec762072966", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132643, "uuid": "c842305d-1ff8-42ff-917e-8cd5108f1da3", "comment": "Malware payload (AsyncRAT)", "value": "7bbef0e6695e63164cd22fd4f98ee48bd2a418f61f8bf60288d3e094dda8d22c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132643, "uuid": "fa7ba969-9139-46f5-a6be-2a4bcfda3c16", "comment": "Malware payload (AsyncRAT)", "value": "bc665c38d8fcccbe15acac87c3fcaa53b93fa266", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132643, "uuid": "9650b5df-b825-453a-a9e4-9acc08977419", "comment": "Malware payload (AsyncRAT)", "value": "68398b605e9090834c4fd22360c46042db4a62f06e0c8d3e411ec419304c9828277d001bc25117b6851db41eeb7e38b0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132643, "uuid": "6d4cfefc-d805-4ff4-a05a-f9b52984801e", "value": "T10CF35B82B791C2A1E4BD4A73D0A7EAF14F32BD1BEB06651F3484BB473533141AD1369A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132643, "uuid": "7932c10d-f598-4101-a5cd-34614a78b738", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132643, "uuid": "13d11422-6329-4ee3-9851-067588081d6f", "value": "3072:V6gySj3uGbKAQ1lOUqaBz65/M6If+3Js+3JFkKeTnF:Vpy9GbK71JxBt25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779132643, "uuid": "c94484b7-755b-45c8-b13a-e72d26a60ee6", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779132643, "uuid": "66fe3807-71cc-492c-8e2a-4728ec177364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132643, "uuid": "7ee92733-1765-40fe-851d-55d19cc1f092", "value": "tiktok.mp3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61304726-52aa-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1779102715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102715, "uuid": "54601baf-2f8b-40ec-bc4e-0c3c1324ef6d", "comment": "Malware payload (DiscordTokenStealer)", "value": "16c8217ea207517eef7128f422995596", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102715, "uuid": "94026d8a-54bb-4094-84b8-6f14678de7f5", "comment": "Malware payload (DiscordTokenStealer)", "value": "7c3dd6e8cb94b89eb21fb3e98576474edb13726c4b0c213c408edb0388a49118", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102715, "uuid": "e5f0232e-d0fe-4c67-9646-128f156fad7c", "comment": "Malware payload (DiscordTokenStealer)", "value": "140e40e24fccf2773416a4458c22e38f83598faf", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102715, "uuid": "16b681c1-2dfd-46c5-b9dd-cdea6131c93c", "comment": "Malware payload (DiscordTokenStealer)", "value": "1d6d77cf4ed3a8d5c051c456494cab7bad5a154c4ea91f811d58a028ab74a28ab1bbfe08390510ef51c266dd373502f7", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102715, "uuid": "10d35078-7376-4fa9-bcd0-d2373506ae34", "value": "T1F7257C3E965801BDE0B3D2F8CE270C82E6797446133169FF17E059661F1A9FCA63AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102715, "uuid": "0693c7b5-c44c-4fd4-9143-fc54553bece9", "value": "ad60c221012a164d0a5401fdfd02885d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102715, "uuid": "b7e05869-b2ee-405d-898d-d62d4e199977", "value": "12288:alWEfDdDE/g3uiGNrCq925PZwZ1JTJAWAdkoOfud2qWzsG0k7U/We2uiYovWg:alWKOg3xsr925P+XJiWiif8V9z/Tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779102715, "uuid": "c504e025-ce9c-422d-abf7-dd3db1252eb1", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779102715, "uuid": "afdb9b40-60d3-4343-94fd-f78fe1cd45d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102715, "uuid": "c52ec7ae-18e5-48c9-b886-a92cdc0d0d3a", "value": "16c8217ea207517eef7128f422995596.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c67b137-528c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779089929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089929, "uuid": "db8decb2-bdfc-41b2-92a1-cc95ea122245", "comment": "Malware payload", "value": "99b72aca2ddc498fa11b0ce5735ed01e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089929, "uuid": "9dcea85d-57b0-4fdd-aade-36fa75d59fc0", "comment": "Malware payload", "value": "7cf0edca209e384c0fca9a322b26a53350c26147365736781979d22827ac9354", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089929, "uuid": "2794cc42-7fdb-47d4-98b9-5a0717726951", "comment": "Malware payload", "value": "692d8e8c49ba161ddec1de1d46f839f0134113e0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089929, "uuid": "94beda2c-b064-4ff3-969f-004f4c7b3e80", "comment": "Malware payload", "value": "46b25fada4d3f1ae232288ad679fef9aade9cf7387597a9f06a692279cc419ac330727c520522778c64c8c6c8c62bc75", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089929, "uuid": "863e4589-7c5d-4ad1-a0d1-50c62de47e8f", "value": "T1F7416D8E42019BF11E09DBFC7F73A9C8704451E3D9EA9B94E8ED4C1575A46CCA608B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089929, "uuid": "4b28a8b8-5c6e-4464-bff3-d63acf52ec0e", "value": "48:ThpS2C+2hgNw7OLobOLo7sLo1LoqLohWqTW5WhMb87nvAhp7ycYfrzO2VJxKT7bE:Thg2C+26Nw7OsbOsws1sqshWwQcn4hZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089929, "uuid": "aea3554b-0b02-41ca-b52d-726dda25ea96", "value": 2062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089929, "uuid": "219b92b6-80e5-4371-ae5d-f6f7929e18e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089929, "uuid": "ef081bb6-5c44-4e54-ae98-a59d829c22bd", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7cc5c60-5309-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779143770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143770, "uuid": "c5c9799b-0ac4-48e2-9499-ab180ba4488d", "comment": "Malware payload", "value": "6dfe51b8ad246cf5faaab0c9e695e5f3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apigrokcloud-icu", "colour": "#06BA4B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143770, "uuid": "2cde56dd-a250-4338-b5ae-9120d0c50210", "comment": "Malware payload", "value": "7d05190a714ab0665e5fdeb3822c0bd9ce299397cc329568157dde669485d4bc", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apigrokcloud-icu", "colour": "#06BA4B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143770, "uuid": "108baf9b-979c-4fe0-b590-be535a0f9b28", "comment": "Malware payload", "value": "ea8ecc3c8a1cd0fb3a1436376bd387dcc4dd4402", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apigrokcloud-icu", "colour": "#06BA4B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143770, "uuid": "365499e6-2467-41af-b4bd-acd599cd6707", "comment": "Malware payload", "value": "eedf6252dfd21df277ae81f32864e1d28a5f5e92bce1d972c55fec56f3959cba72429d6a8148ddd7b50de18cadfd9ad5", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apigrokcloud-icu", "colour": "#06BA4B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143770, "uuid": "688c1be8-ce24-45ff-b29e-739b5e3fd1af", "value": "T18D268D1177F84A28F2BB1B76657019284A79FC469B71D3CF22592A9E0CB1BC18D32773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143770, "uuid": "ee47c8d9-b9e3-4cbb-8968-31b25c10e27a", "value": "2f307598ade8fe7e1696a56203dfaaa5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143770, "uuid": "e86b6748-8009-44fc-82ba-48684d4a850a", "value": "98304:sH6CZQ89R9vGCbGYOh80rj8lLDxOgcNn5DXgxH:sK89R9vZbGYOh80rj8lLNOB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779143770, "uuid": "8c491242-5623-44ed-aeef-ad9e235b6973", "value": 4623008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779143770, "uuid": "cf24544e-c315-43d9-9b40-0df3de269a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143770, "uuid": "016bd4df-04d6-4529-bca4-73640a6e2e71", "value": "VulcanMessage5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6bfee8-52df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779125502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125502, "uuid": "e8da5311-5830-4b95-b84d-03751e3bbd7f", "comment": "Malware payload", "value": "9f7b71a120ec494bca7f4cf34f90a8e4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125502, "uuid": "8719b202-41a9-4197-9e18-0b7e8506908b", "comment": "Malware payload", "value": "7d26e665e53863f631bc7e3ca3f2b2e07f437310353e0f124d876d10ffa27785", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125502, "uuid": "3c7cc1e2-67a9-4444-9144-a09125676b64", "comment": "Malware payload", "value": "ef37b7e4098cf9c5d2614a862e25731786e1444d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779125502, "uuid": "75b73e27-881b-4e47-aaf1-57e99c6d0e83", "comment": "Malware payload", "value": "e400fa2797851bd4e0489da676820d0854baa4ce259d5b882e471b371611b647dfea928802cec9ca739d0d5ac38cabf1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779125502, "uuid": "9b7b36a8-81da-488e-a114-889cf7182eae", "value": "T109C4E70ABF71C47AFA839138070CF1637A39C598A045F23B75E059194BB1D673E6BAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779125502, "uuid": "07bb7752-5adf-4d12-b95e-dcbbed3fdcb2", "value": "12288:gAx32DNPeCLJ9MGEICGKdc7C9RTAP/KZ9VDCX3AgOIBpzSjwsXU8+wOqdfP7lJ:gAR2JdYGAGKmWjMK9VDwiIQTXU8+wOqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779125502, "uuid": "b451fbf0-da76-49b4-9844-d1f079a5a5ce", "value": 579594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779125502, "uuid": "75dffb0b-09f4-4953-bb2a-23a401cc5656", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779125502, "uuid": "03904412-d714-4aac-bc57-9be81e8181a3", "value": "KryptonPlus.0.10.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c053a8-52c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779115873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115873, "uuid": "835918e7-1851-4617-903c-e007d30197c5", "comment": "Malware payload", "value": "ac689ba288ccaf8c00bf6df7c24d6d55", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115873, "uuid": "a44fa625-67b0-4d0c-abe0-c92629070117", "comment": "Malware payload", "value": "7d5bd738051678a7958b7ad87b7af4609567560c2dc286fe871cbf9937455169", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115873, "uuid": "dcea2099-6098-4da2-a59a-e5a9c3d9738e", "comment": "Malware payload", "value": "1fd2802487b039cbb9a1642b2db2a832c4bed96d", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115873, "uuid": "6945ed16-f730-4190-9cb3-c02d40f974b4", "comment": "Malware payload", "value": "ab08d5dbc05ecd4e969fe8af2117c22ccc88a22ffc7e26f99957c0e2377939e51990a750cddcef72eb8020cdc305c20b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115873, "uuid": "d9e8534a-5d59-4cea-891d-ad77f41b915f", "value": "T1B614A537E7738CBDC2ABD2B07682D9F17471BC540220AC6B42859B227F5FD105EAD899", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115873, "uuid": "61e841b3-e06e-49b8-b314-50ee89fc7c77", "value": "06c7cc19995f3760a5d18db2167f1f5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115873, "uuid": "27eab7bb-c68e-44b2-9dc2-c2dba9c769bd", "value": "3072:xbCMy5+hD2n5/AL0AryTLFhNeUIxl+SIUA8e/wvaJP5L5FD:xb6QnyTLFhNjFUA8e4vaJP5L5FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779115873, "uuid": "22760f4c-0722-49a1-bcd5-aa55cc4d17e8", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779115873, "uuid": "d46f32d7-b529-4592-a810-80ed047cdf9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115873, "uuid": "1b07aa42-99b1-40e1-b8c2-eb96edcdb625", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb8a15c-5277-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779080748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080748, "uuid": "32821bb4-6812-4f20-a7e7-ef4f2e7cad15", "comment": "Malware payload", "value": "4380815c58695ef5cb8f86740c7786cc", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080748, "uuid": "b9ed5817-9c12-4797-bd84-2a9e01a5b85c", "comment": "Malware payload", "value": "7d682669a90fce48d8cfba7144bb68ba9353b3c5c9d3b6cef1298634bd12de3b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080748, "uuid": "c59f5249-9971-476f-a210-fe84b2b23d16", "comment": "Malware payload", "value": "e51088093a70f94405af9802c284f5bb49bf08b2", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080748, "uuid": "64287cc3-4b16-410a-9487-df84644838f3", "comment": "Malware payload", "value": "936815b35b3e60275cd6c1094befa76e7f8efa8d49b523a9fe2911b862f107353e0a742c46c9710db3e74b7316bcaf79", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080748, "uuid": "8019f2d7-b9dd-49a7-b998-18a66aa1f32f", "value": "T125E423A492BC9EC548BB1CDD53C80AD94D3E2E5CD5FE082E5F489A881A7E7C32607774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080748, "uuid": "858d3c17-87e6-40e9-8764-17160d05a63e", "value": "12288:W0+MXxM9pZ/l5KhD+cOh8QSt6wFBX5OJaObH74VbZFA1wg7SKhaFo/IvswHsEEkI:1dXx8n/Tn8QSjXg4FA97SeaOgiqkWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779080748, "uuid": "5a2df13d-9142-4e41-9fe1-65fc1118b7a4", "value": 715600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779080748, "uuid": "3fde4333-7b49-4861-ab97-829d26a020e4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080748, "uuid": "adf201a4-4e1d-4776-9746-f602bd67dd5e", "value": "AvisoXdeXpago.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83150646-52c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779113939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113939, "uuid": "b6dabb40-2897-4243-924a-f20c9eabaaed", "comment": "Malware payload", "value": "043fbf936e002c182852a1f1b79520a8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113939, "uuid": "f4678542-3fad-409a-bf08-1332483325fc", "comment": "Malware payload", "value": "7d9f5311c4519bd8db2c764a8cda7ef17584620d8386771846488638929f595c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113939, "uuid": "93e0f23f-7082-42a6-b143-d974879d5d27", "comment": "Malware payload", "value": "18da1dfccb37ef80ea47a774ed3626d1b9463a00", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113939, "uuid": "d6e0ac52-4905-485f-affb-beab4aeacd5a", "comment": "Malware payload", "value": "405ec3478bd3324b31510afc71818f5696af30d27691348054807571170993a1a5f13a4284121b55461b2bbc3d68ce9e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113939, "uuid": "3a672620-d40b-44af-beff-d8137ebd8b76", "value": "T16B136D6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113939, "uuid": "5897b6e9-a957-4e0e-9e83-3572702956cd", "value": "768:Xr9NyXsZztCF9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:7HusZrco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779113939, "uuid": "c1740e40-502d-4c3d-8c43-22e485045555", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779113939, "uuid": "ad6b569b-70dd-4374-979e-77d94558feab", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113939, "uuid": "2b63539f-a938-49d2-a0c5-217ae40fb788", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e347dbd-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091033, "uuid": "701eb01a-8d30-40ab-8dec-ee590e1a668f", "comment": "Malware payload (Gafgyt)", "value": "4fa243748502115a51e669b69b42d12c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091033, "uuid": "191c8fde-4824-481b-a4eb-58ed72f27662", "comment": "Malware payload (Gafgyt)", "value": "7ea3e22bf3f1c64e391c17cddb890551bb45c74fa62a4247ea57895dd955f1a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091033, "uuid": "9316bc1e-932a-4270-9665-36b594394957", "comment": "Malware payload (Gafgyt)", "value": "06f9c9c53820bce5d709b52096ddcd8d1f0f172e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091033, "uuid": "946b967c-e197-4517-95ee-64ff3c49dda6", "comment": "Malware payload (Gafgyt)", "value": "a726caa769b5725aaa94eaacb4ebc3a172fbee4a7611821003e3cfb4cbd453e9c3ab038d2cb11a9933a7f3a64ffa1835", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091033, "uuid": "b4a1a697-3d0b-406f-94b7-3fb12fd30865", "value": "T1E944A72A3E22AF7FE568873107F38A708799259226E1D746F26CE71C1F7028D584F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091033, "uuid": "b57c20fc-5c18-4ff5-bd48-bd677cb1c6aa", "value": "6144:CwH8VOAH4QgJfddycpmB65LrZYdQT8zPxlop:WVOzHDmB65LrZYdQT8zPxlop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091033, "uuid": "b00e5bb0-8ed2-49e9-8f7c-d91407e40c7c", "value": 266018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091033, "uuid": "ddb9d20e-4fe0-4801-9f27-3526ce9e6b34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091033, "uuid": "08b7e8c7-c4c0-492c-b8e6-17969f96f565", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87e616d-5313-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779148012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148012, "uuid": "b737dc35-72b9-44bd-9156-58e9ce73b692", "comment": "Malware payload", "value": "0b1c32b73e09e30ebccc00f9c8b8cf25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148012, "uuid": "c749a213-a2ee-449b-9f0a-129282a12ef2", "comment": "Malware payload", "value": "7edec0f7720e8f387ef093741094b5ce139f2e451a6b6f3730f5e6728b1db226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148012, "uuid": "370ae9ff-744f-432a-b96c-dd1e929a61f5", "comment": "Malware payload", "value": "18212940f69340cb80b3a7c0a0ebcf93751e9098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779148012, "uuid": "e6d8e922-a697-40cb-a646-717c0a2124f3", "comment": "Malware payload", "value": "65a7a029f9a22604ffd6060f964ad3dffff9518d1d21aa5d8e01afe6cca7ae32cc306309b3ffd03f79bcbfc6321682c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779148012, "uuid": "15f10779-421f-4d59-8174-db264c427509", "value": "T1EAE733EA329B7819EC26973D988DE65ED1EBEC41C03793494144B7F11EB83164F8A83D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779148012, "uuid": "eb29f0c1-8d8d-4e2b-8356-c3c7d57d023f", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779148012, "uuid": "c628544f-89f6-43d6-9c57-5e53890e32fe", "value": "1572864:Zhc9/hPf+kKF1jO6ZPnEfkWEQQSciBzv6fr7Wp/g3Yd4:Zh8J+7FAgQfcYv6D7WpgS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779148012, "uuid": "d8070398-42e7-4811-ad79-eb0fa3065cb3", "value": 64627440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779148012, "uuid": "c4d18191-7176-42a6-b8a8-20cde1dea8b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779148012, "uuid": "36f3c381-2e3e-428d-961d-a62c361c7a5d", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e6a62d-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120790, "uuid": "8adc9922-c13f-4ac8-844c-67ff9cd78afa", "comment": "Malware payload (Efimer)", "value": "2e11a305630442009a49a25536b2358d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120790, "uuid": "7e1eba1b-690e-4f84-8bbd-51f4bceec1d2", "comment": "Malware payload (Efimer)", "value": "7ee379149c0a6c41895f67c1d6efd99e0fb89eff5e6ac8de2e64268bfefa18f4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120790, "uuid": "a953b104-5a98-4987-b009-d295bf0f3414", "comment": "Malware payload (Efimer)", "value": "f48e2ddb5d41f6a873a4fc45a06b7d9c51e7dce4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120790, "uuid": "aecaf009-93eb-4db9-b4e8-38f9029d26f3", "comment": "Malware payload (Efimer)", "value": "55ae887efa69a6acb452490917336eb0768551f8c21172fd45d99ad46e26c95d9abff75119c05887a821b4822ac369c1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120790, "uuid": "33c395ca-09d1-4c60-bded-9ca4a235c8f3", "value": "T1A9D6331996E1A1DCC27692B8F7F0BBB9F4B5B8B0057A4C6E5711C3B02967A788C3C417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120790, "uuid": "d7c0d2d0-666f-44ff-8014-6932503efb51", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120790, "uuid": "1144bb09-1c2b-4833-b772-f8f5a686d6ad", "value": "393216:UOk7MTc9V/kximBlVg+K1ncXMCHWUjXbcuI3/PGTAI:UOk7EsVc0yqIXMb8XYH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120790, "uuid": "4078fc8d-51be-400d-94f2-a60b5f16113c", "value": 13865633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120790, "uuid": "1a1fa5b0-7093-4281-a8ae-ec942f2be1a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120790, "uuid": "425f30bf-572c-4152-ac90-fdaa9c726e8b", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd57ac0e-5276-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779080589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080589, "uuid": "311f751a-1758-4c12-b4a5-d1662fe7a5e5", "comment": "Malware payload (Formbook)", "value": "a25572bc03c57dc0ac0b2a19a3e7c663", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080589, "uuid": "81077ee8-429d-4494-aded-58a2139a81a2", "comment": "Malware payload (Formbook)", "value": "7f64979036591699c1adaaa1b8d4bf1edcf092a016ecd03b18121a8f8b5aa9b4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080589, "uuid": "215d29df-3870-46ac-8604-69847e659967", "comment": "Malware payload (Formbook)", "value": "fefba1e48b8818901603d64678d83c4dcd65fe6b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080589, "uuid": "c8fad7a3-ae29-4593-af48-a18b03eeba93", "comment": "Malware payload (Formbook)", "value": "f400aba127441df348bacbc5064d606413647574a28bbb546cf157ee095e638c5cbfe0ea1b5bbce3415b1566792c8f14", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080589, "uuid": "de0b16ce-ad45-454c-8dc1-5cf2e8582d52", "value": "T1ED9422111BC054A988FA846DEB0F793FEAD4C5E29784F7C903AE61DF004EE5B1367A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080589, "uuid": "9ccc1ff3-3242-4f69-ad4d-6e18800cc34a", "value": "12288:/k0uHL6cJLHYsEHWdzWx43yN5DP8DhAlBmvciu:c5LhRYsE2UaCtP8DYAvcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779080589, "uuid": "387be8f7-16a4-4995-b832-0c1d72b83463", "value": 438735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779080589, "uuid": "16bfffb8-777e-40b6-b512-e9cf73a120eb", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080589, "uuid": "7412dd44-89b9-45a9-8c35-3794e85572e6", "value": "INQUIRY NO. E-2024-06-41R1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f3153f-525e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779069975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069975, "uuid": "3c23d1ca-5358-4da2-b677-2a6b9ebf7b7a", "comment": "Malware payload", "value": "f68a157948fa66632d87e789d1ded5e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069975, "uuid": "aad6002a-7f39-43b1-8382-8d5ac81b3aea", "comment": "Malware payload", "value": "7f94d36cce0a066f0b71182150af1af7382b06944acbd3c7e019df0506f24927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069975, "uuid": "24eb215a-83a3-4299-b9fb-4b24d5acf8a1", "comment": "Malware payload", "value": "21ade438768f43f09790b75afd1c104868257ca3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069975, "uuid": "1f327ded-ec17-4cfe-a722-2e78c47b1b7b", "comment": "Malware payload", "value": "d54ca00835d111da2f3afebf0bd0be241675cbb576e7a4fcf01bdd4c5c797a1594faa7486b639714a1702b435f08668b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069975, "uuid": "ce8089cc-8ebb-4e3a-b23c-ba9b1356a079", "value": "T12C73E788FE15971BC7D272FBF79D038D7A2A1F69E3E6311599316EA033C5A90253E120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069975, "uuid": "e1ef2b58-abc4-40f3-8266-4bc0088f37e7", "value": "1536:6QkoTPPn5rtRB8Z+Z//ZgmWXNoS6vFrI5EItJojHipODr+3:LkoTX5vFd2mW9oSLEtHz+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779069975, "uuid": "9a51fc27-4a7e-49d9-bdee-b4b2f039c722", "value": 78040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779069975, "uuid": "8cb8b801-10ff-4639-9484-344887136554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069975, "uuid": "0caa0393-a2a1-4ebd-8b34-4bc057415be5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f62694-52d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779123050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123050, "uuid": "9229e7f4-4802-4a30-9b96-b5418ab26470", "comment": "Malware payload (Mirai)", "value": "6c841ec2c629ddcb2de48d5122d972e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123050, "uuid": "2f09d0b8-9631-4f23-a066-f9b84da5ff45", "comment": "Malware payload (Mirai)", "value": "80c87dcbcb852d88391c447e3b28e50b282785ba3a7d117306cb48c4a8de38f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123050, "uuid": "f8a00343-ae3b-4154-9cab-43332a152164", "comment": "Malware payload (Mirai)", "value": "fbb8705555f0d99fe8af92ecf2b0aeb314823236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123050, "uuid": "ff3340a1-739c-4110-a006-658baa2bb866", "comment": "Malware payload (Mirai)", "value": "5fd83c902c53f6715f341969c00bddb13ecee96370486c5480863a6cb92c69051faa0dcab1e844aad6f3b019de7aa63e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779123050, "uuid": "ea2a94b8-6720-4fc4-b14f-b9293c7a256b", "value": "T119D3390BB8D0C0FDC4D9C1744BAEF13AD932B06D1238B25F2784AB266E49E305F6DA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779123050, "uuid": "9a58ccdf-ed58-4c48-ba78-c9150112525d", "value": "3072:HY9LzvgRWZt2jql6q2pYXDKGG+diuKKbvo:HY9LzvgRs1QL+diF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779123050, "uuid": "f9164f9e-1ffd-4aec-85fa-d5d684609bd4", "value": 138904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779123050, "uuid": "c1d53082-d2ac-4dfc-840d-2b741324d497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779123050, "uuid": "61137f1d-fde2-4af8-8613-fc654a3251bc", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ca445b-528e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779090834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090834, "uuid": "8cb3bf2a-6ba5-4862-a04f-d2084a5cb24a", "comment": "Malware payload", "value": "a52925727dbbc7a754a2a0b8439c6b61", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090834, "uuid": "6392dbec-3337-4547-8c96-2434556c13f9", "comment": "Malware payload", "value": "81f190a98e9ecaa0ee31c1e7d5b217e324f795d94e4e74db05f879ae3e8c89c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090834, "uuid": "590be4cd-73ce-4384-853a-43f3835633c2", "comment": "Malware payload", "value": "8f55066ad4632b76570166629559919f5f5c553d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090834, "uuid": "39847fd8-18c7-427d-a337-72ff07e515e9", "comment": "Malware payload", "value": "5455d43145e6e5d3949f23f4a14220328c43d552b0383206b0efbea0c52a3efe6e513914dc188e3f1e34aa84b7eac2a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090834, "uuid": "e679ecf4-e357-400f-8b64-6c832b39fbd3", "value": "T175836B11B5D1C471DABF1A311864CBA28B3DB910DEE0DD6B67990A7E4E702C0DE34E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090834, "uuid": "0f0f40f2-929b-4558-87f6-22f2abfa8c51", "value": "eac05df480f0337c83d3179acccab006", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090834, "uuid": "eb047faf-be2d-4cc4-966b-a2f50368f69a", "value": "1536:8ubh2bcj3HDKkS286mbTbcRaQxZSRm6sW3+cdl+RlZposC:8ud4cDDKkhmbqi1l+RlZpop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779090834, "uuid": "88245059-5daf-45cd-b5fc-ddc2fe6142b9", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779090834, "uuid": "65117159-eb1b-433e-a13a-ef9b88780a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090834, "uuid": "695e454a-8ac9-4007-be4a-973a3d061694", "value": "CNCLID.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7461ed-52d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779120053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120053, "uuid": "22c83283-330b-4ce7-97de-89e5e68f1c6e", "comment": "Malware payload (Formbook)", "value": "9fdcff1d8ef4ed31d3e808bd85056731", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120053, "uuid": "2d490133-7b48-4b95-bb5e-6e41f4a3ab0e", "comment": "Malware payload (Formbook)", "value": "820b4103051393c162b7b00e461a2b86a9cf92f5feb9bc9b77782d680a9d6f89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120053, "uuid": "284fd070-4c76-4907-ab58-12cf0188d94f", "comment": "Malware payload (Formbook)", "value": "9731ce8fa988bc398422e790960151ada1295f18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120053, "uuid": "3b359c71-da76-451d-a050-aa67f55e0781", "comment": "Malware payload (Formbook)", "value": "be891e81322e02a3ce76af72c0bc39d9f70fb07351c489e7f0b0d3c70b8c08137f1e9b8ab022036cf18dc88f6991aaac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120053, "uuid": "9ab11d8b-855f-41b6-aa36-3013f7216634", "value": "T11F334876AD113976BFD068A423031F40566C546FA1FB99EDF607BBFE8944E2088520FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120053, "uuid": "e662ca80-df35-4cc9-9eb2-e8be68d0d069", "value": "384:8oxdtwglncPCMKCY7PhZH481xN4zd5t59dHS5Yb2N7+hiFvTStQRQs9DLe64Qupv:8oO5a3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120053, "uuid": "39ac057c-55ad-436d-a969-f92a3979a7a3", "value": 53975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120053, "uuid": "3ebcb9d0-c349-4a9d-9003-51380e2aad13", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120053, "uuid": "bd65408b-9dde-45e5-a0fa-8687132879f2", "value": "699312.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279d5e2e-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091022, "uuid": "ffeeffd1-a5e7-4ba6-9bf7-0d5a0b36f91e", "comment": "Malware payload (Gafgyt)", "value": "e39c3de552786c6adb09bca625e44628", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091022, "uuid": "31164df1-ecf9-470b-b576-6385f6720590", "comment": "Malware payload (Gafgyt)", "value": "83d5ca61a8be05075cdaa48cff27cb698288a56642a5dd36e1917e98234c8c3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091022, "uuid": "4f29d81b-828b-43d5-8d5e-f36585dbe8c5", "comment": "Malware payload (Gafgyt)", "value": "7b78b8a425672c55239f4e963415010ccf3e21cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091022, "uuid": "f33726fc-72f8-410b-88ff-ac538d52c932", "comment": "Malware payload (Gafgyt)", "value": "b48c15de6dfe491fcdf8e3ba3099f8bcff159f253f901f23ea4029838a887c57ff14ba188bb2b556d5eac413368899c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091022, "uuid": "d211cefe-cd46-4997-baec-dd3462284f87", "value": "T12824F601E8544B67C6C22BBBF79A42CD37365F5897D73302AA287EB42F9679C1E39110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091022, "uuid": "03f767e7-529f-4fbc-8da9-3b23a14290c1", "value": "6144:ORA4QXj9AvvM4d5My8JgRtmEQLcGFZOvAxi7EOa+W:mA4w6lbmEQLcGFYvAxi7EOa+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091022, "uuid": "1bfb0fdc-b3d1-4415-920a-42eb863a33d1", "value": 211561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091022, "uuid": "fd7888ae-2060-4771-bc69-62f8f69c5875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091022, "uuid": "7c8850ff-6c8d-4e56-8c34-d66bca48b53b", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5882f18-52e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779129968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779129968, "uuid": "62ef088a-12ac-462a-a478-2c1b5627df02", "comment": "Malware payload", "value": "78f26d9180c556fd1b5ce86d0eebad3f", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779129968, "uuid": "63654920-b5b9-44dd-a4a0-b0324752a07d", "comment": "Malware payload", "value": "84e5968ddf92fe598af3d458b63c86662d5984c7731bb21948ab2210f6b794bc", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779129968, "uuid": "7a8d2500-4f02-442f-a39f-e8559ee9b7c9", "comment": "Malware payload", "value": "2aec4b83ade4fb1c1fdb11bc92d722e646de196d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779129968, "uuid": "bdb6b309-4772-484d-9568-d3db0742fdcc", "comment": "Malware payload", "value": "6a0520a2372e888d7af941cce8e26d77aefcbcee46ca81a488910522c938402fc9a3bd6708c58542916b582fdb203738", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779129968, "uuid": "2279f944-19d6-4c49-a56d-98bb2810b555", "value": "T1BA640871874599ED221FD2871D10686847AEA9F7302194DA6F6E0BB9CEE7F60CFC3814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779129968, "uuid": "4140daaa-43a0-43f5-b77f-99448a1f3a47", "value": "6144:xm81i2otNkQqts0HeFMPEKSPlVY7dx+VD:xQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779129968, "uuid": "0b4fd9e8-0b3d-4ead-ad40-93a565f65b81", "value": 330949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779129968, "uuid": "0f7d2c0a-3356-4c2b-b571-867080143854", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779129968, "uuid": "947ce725-b500-4089-b35b-e83cba9e52dd", "value": "OneDrive.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3948bd27-5253-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779065282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065282, "uuid": "93005dd9-7f47-46ed-863e-7bf5bb66e9ab", "comment": "Malware payload", "value": "9202c924cd40a3ccc62a6f293e8c5631", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065282, "uuid": "6bb0c55d-424a-4a09-b7da-6d3df30e95fb", "comment": "Malware payload", "value": "85abcf95cb94a9be4ec343aa7298e9437563b41e498d2cc03b8b8247e910afaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065282, "uuid": "2b5ccf0c-a0c8-4703-9799-58080df1bf30", "comment": "Malware payload", "value": "7fb163c2c7bc065a10adde1fc603b5ced3108a37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065282, "uuid": "8f7dd6d5-92a6-4ca1-9b3d-3f18488af48c", "comment": "Malware payload", "value": "90ed8af88c93f8a49e8ae999e9e0e41ebaf37dbe594a6bbaca0335c65e424fc8d1a52a3ebcac38168d72c5e4e67ae0a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065282, "uuid": "2b4a777b-0dc2-4669-952d-5e8c8db75319", "value": "T18083E788FE15971BC7D272FBEB8D038D7A2B1F69E3E6311699315E6033C5A90643E120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065282, "uuid": "51ec9e91-6b7a-494b-a496-612a210f5421", "value": "1536:HQ0oTPPn5rt9hLxRi//ZgmWHtjeuEIg54NafqlBWm6OUovLH3:w0oTX5jx62mWNjefq9XWiLH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779065282, "uuid": "33bc87a9-dc0e-44ca-9315-2e85c614fa2a", "value": 82136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779065282, "uuid": "26f05140-50cd-4b61-ba89-0ff9fd9ae702", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065282, "uuid": "a6addc63-9860-46df-bf04-09b2a04eeb92", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7777c79-52ed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779131743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131743, "uuid": "13111539-e3ba-48cc-8a9b-41137834f5d6", "comment": "Malware payload (Mirai)", "value": "0728b0fc10f2aba78d50fd8cc7246ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131743, "uuid": "c820849e-d521-42ac-81cf-c2833e235d90", "comment": "Malware payload (Mirai)", "value": "8642de44f98c760469019862619d35599792f05727f0ed2e3081ecab5cc21ef8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131743, "uuid": "49461ff2-3515-41c8-9e37-c1d600106f4f", "comment": "Malware payload (Mirai)", "value": "b7edfd83bc1ad01fa186d56489fa7e3b84a6a578", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131743, "uuid": "2475e8e8-8cff-4b36-8b46-f4e0a608ce36", "comment": "Malware payload (Mirai)", "value": "9961731895397dfc3c1cf8a545a6517a8248778d2fe05e3b5f5e000bbcb530036e6e23d20e77ef43d9559549b2128f81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131743, "uuid": "10f25044-516e-4e17-ad2b-d7984dd034a7", "value": "T13282C038A55DAA30E3309E39E97DDB4167D603B8F6E93321298889BCD3B2C0645B55C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131743, "uuid": "cd9225f5-9866-4aef-b135-8fdc6e008d63", "value": "384:igd13SpUiL90jYb+jhC++48YcRL7KC3C+hymdGUop5hX7:iC3Sp7LajYSu42l7KCps3UozJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779131743, "uuid": "0018277a-d76f-402e-953b-001014d758c4", "value": 18716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779131743, "uuid": "108de9db-6194-4eb6-a676-1370f2d05561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131743, "uuid": "074d4434-10b9-440d-91d0-0200e53b21d3", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088533e4-5309-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779143368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143368, "uuid": "81c90554-5817-4bfd-9269-6e04fbd8934e", "comment": "Malware payload", "value": "b9505f8362a91565e5df960adad76595", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143368, "uuid": "ce67377f-8c47-4a89-bb11-2bf20fd9e4d9", "comment": "Malware payload", "value": "87cad69f724d9a372ba26df845d27df013d8916e9f0d2ee05ec1585553cbe632", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143368, "uuid": "6e2633d5-4c6b-4363-9b97-b20d537aa100", "comment": "Malware payload", "value": "ef97cbfa90931550580742226464bfb452496ff7", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143368, "uuid": "5312be5e-dc70-4312-bc10-44ef8971e79a", "comment": "Malware payload", "value": "f70f4ffc1d8fc2446138a3acdfacca4ed9fc8c45a0df3e2a1d98f6a4800321e630d98d270d16aca8d473c37f98fc9c4c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143368, "uuid": "9acc7fa0-bdfe-430e-ad00-2bc5db65fb06", "value": "T11A069D0073EC8D19F9AF6B79907506265739FA9197B3C7CF1309696E1CA27C08E62363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143368, "uuid": "ae4ad75a-4e3a-42de-b12b-aa8a5a1fd711", "value": "2f307598ade8fe7e1696a56203dfaaa5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143368, "uuid": "c68c16e1-658e-4a6b-bca3-d473258972f5", "value": "98304:aH6CZg89R9vGCbGYOh80rj8lLOr+12sU9lI2Qkt8w:a289R9vZbGYOh80rj8lLOa1U9lPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779143368, "uuid": "cc4a35c1-6225-449d-b430-a27089ebe1d2", "value": 3858776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779143368, "uuid": "bb2075b8-990c-4caa-88fe-9f9c06a3a65b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143368, "uuid": "4ed432b0-828c-4302-b7fd-80db543fb27d", "value": "VulcanMessage5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159dcfa0-5286-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779087126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087126, "uuid": "a185b449-64b4-4816-812d-6acdd4c2122a", "comment": "Malware payload", "value": "41889943c2ad6880ed7529b3132857a3", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087126, "uuid": "debbf278-6d82-4bb8-841a-7760f2d2b2f2", "comment": "Malware payload", "value": "88119be028596ae376318a37d8baa146d7b2f7a97ae3acac4a73db3abeaea866", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087126, "uuid": "13d86c41-08d0-4fc0-8826-7810472ade38", "comment": "Malware payload", "value": "8db3f91addb22a506ead3d0f7b9242a3f6ced640", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087126, "uuid": "25faba40-d93a-474e-90ab-fdbb50732bfb", "comment": "Malware payload", "value": "f4bab3fa58f3d8b2b3120005c85879aab1ea6be7abb27399597ce5695ec5483aca7a924901ae819de249678764ead896", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087126, "uuid": "ba89e081-c12a-499c-9db1-b353ca301689", "value": "T12B646B22F9409136E9D20176E6FC4FB79D7D9924273990E3FBD444B45A209E2F638B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087126, "uuid": "8834ab37-b460-4f26-bccf-c825b93026be", "value": "0081953af0d2a2fa0a7ad0ed33ecd11b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087126, "uuid": "e7f5f9ed-c117-4d03-9e5e-0495bbfcb430", "value": "6144:ivjOx39oI+14DcHixx+Xlaw3Mc8BxT0hnzeJPiCyg1LTF+TyS4W/ytOVducixNJ7:ivjOx3D+14DcHixx+hccLha9QaTF+TyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779087126, "uuid": "dfa9e201-809e-4289-a11d-57a89b654f6e", "value": 322256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779087126, "uuid": "31a7df36-8b52-451a-9f39-5fed4d7425c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087126, "uuid": "6aa99aae-2fe9-42a5-8201-9805222401e8", "value": "ShellExperienceHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a75c357-5309-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779143425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143425, "uuid": "763be60d-c6cf-49eb-8b3e-649f1801bd26", "comment": "Malware payload", "value": "f773ef00867934e759a7e23bc919fe06", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143425, "uuid": "18dad1f4-8090-4bbf-8cfc-906bf868156d", "comment": "Malware payload", "value": "894e95162d51b37b895de95c8bffd2c43a09e96d9ecfbc6f2f1de8a8287e7a1f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143425, "uuid": "4d875cae-ead0-495e-a81d-601705b8a79a", "comment": "Malware payload", "value": "9167e4a1df1bf34b9b032f2b4f9d3c46683a2c5f", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143425, "uuid": "1ab55ef7-a312-4b61-9c45-e7a69b362c4f", "comment": "Malware payload", "value": "2ad8bdc7f74225fc0fd9f81496e8869469dec9bc646ce90fd73be17b3585821a8a8d71b17ffa986996aa752f94727226", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143425, "uuid": "7ae12acc-25cd-4556-9ddc-15275a7750ce", "value": "T1B2073327E0EA5391FD52137E642E9C0B01526F878E882D1C26EEE0E0EA55FD357361ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143425, "uuid": "d76a8449-24e5-4c97-bafb-d9028d5d62de", "value": "393216:HOhBtyritPLZYGJPOxw8kdI98rCjOEgfxUYz0vQ82VVZoAMsZKtfTz:uhBE+PLD4q8kdHOTg90vb2qrsZ4ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779143425, "uuid": "e464bf91-c45b-412e-a29a-927b69eb060e", "value": 18051707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779143425, "uuid": "6e1cb3e6-0059-4428-8ca9-7af7dca67797", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143425, "uuid": "4235dd47-ebfa-4a71-8edc-41ec2daea7e3", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99dd0f02-528c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779089925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089925, "uuid": "732297f1-7a18-4307-98c5-168f92473a61", "comment": "Malware payload", "value": "0dfae9fae3cd5688a3677da87139feac", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089925, "uuid": "3f015fee-82d0-460d-ae1e-20718d418b57", "comment": "Malware payload", "value": "89c4d6b6729e8cc9735752ed73e1e1587508afc5cbe7aa6eb7e6fd5f618f27c8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089925, "uuid": "e694ec0a-0024-473c-8811-d5b6067fcf7b", "comment": "Malware payload", "value": "613eadfada6b5eb4bde815a32d77c3d7d202b927", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089925, "uuid": "a8c0246e-b6d0-4ba0-a47d-ae910311320a", "comment": "Malware payload", "value": "08d56a339d4ffc3565625bc4c1187212ff5ec392825a3f466448121cb20e032386ded437fc2c35b353487418f9164f88", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089925, "uuid": "b67e698b-2030-4988-8720-338459223d27", "value": "T12C251268BDC11D5BBBB5012FB0C18643DB6881C3193595FE42DD02B6435FF89A2BAB1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089925, "uuid": "f213a925-ab24-4a26-b9d1-16b62418b43d", "value": "24576:cKMDOvOzleoNyXawfBLf3TRpMNpyk4vuYmW6tLNviQBBryS4/S:U3BeLLL3StYH6tLNKQBB+S4/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089925, "uuid": "d525a18e-d36f-42af-a104-51839720db20", "value": 1055971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089925, "uuid": "51a3dcb6-74be-440c-80b5-28e2b1252dca", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089925, "uuid": "f34d1976-f3bc-42e1-a90f-323fa4a807ff", "value": "BSRLGAPO.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d6f840-52b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779107803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107803, "uuid": "583b04d8-4aca-46a7-9ca4-aa448ab68192", "comment": "Malware payload", "value": "abb53280681083050d0b769690f68ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107803, "uuid": "de97f3da-ac18-498e-9948-d515eb6600d5", "comment": "Malware payload", "value": "8ab6d9a4c7bc2437d0ca5ba30d9d51dbf53ebbc5c244c5986d1771fe93324660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107803, "uuid": "edd4dc15-fda2-4581-b5f5-3433aa48f1b8", "comment": "Malware payload", "value": "55204072ca17d39fd893678d292938c87f664961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107803, "uuid": "b4bff82e-cff3-4894-b034-49c25ca37d00", "comment": "Malware payload", "value": "8380adabd20ff305a613ed4ee699cead421421e5f68ca635cb73fb54945a37b3b49c8cc8f77df850b835d2c1d1829cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107803, "uuid": "194a1797-5556-4c74-be4f-de546bf7d491", "value": "T122738690B7D4BC48036B1BEB672BF0F1E56E15AAFC944207ED40FE94A670716E9E0631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107803, "uuid": "b977ac3a-8d0d-423e-a31e-8432edd93bac", "value": "768:Dag+TKS5VXR/VjTxR8i7Pr+BTjwUYIUgvjHkgdg6rl5/bhHKTU+6eBBjZuJFLGdl:DA5ZMED+mFd1htWLhjaC6JijdIHNaMlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779107803, "uuid": "6ef14f1e-a9c6-4bea-8431-ecc638b9d44b", "value": 76549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779107803, "uuid": "44383dc5-35f9-4c8b-b17d-309954fda28e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107803, "uuid": "303e4e96-c2c2-443c-82ff-fe73d3f14958", "value": "Requesting for quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad36c115-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120881, "uuid": "e0e88e8e-95fb-4a07-9da2-6f89ffac1daf", "comment": "Malware payload (Efimer)", "value": "037684ba03f67cd8fbeb5736872154fd", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120881, "uuid": "bb6dd309-4455-41b7-ab7b-7229e2f81012", "comment": "Malware payload (Efimer)", "value": "8afb9b5ed705b7f12fae115f06206d5e4eddd08dd919bb140cfa78ee7acefeb9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120881, "uuid": "51e7bb9e-09c0-4926-8d92-39217bf176d1", "comment": "Malware payload (Efimer)", "value": "8d2b0ddcb2e584ff5079f7fe58da9fa93365ef8d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120881, "uuid": "49d3a217-1b20-401b-a7f7-6b787fa85321", "comment": "Malware payload (Efimer)", "value": "23453856b5db704410ad4d39391d2af9cfb2849365fe0b0892d7bcf93e757c22d0059a8a6a19960ddac640797f347a7a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120881, "uuid": "61147dde-3c20-4893-a52b-35bf937df4a6", "value": "T1BFD6330C6FCA11EED6F79034FEBA17B0B465703509BA8D6B579CD9B16C3B241862C42B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120881, "uuid": "8b1283c2-4781-480c-92b8-caecd8c23fe4", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120881, "uuid": "487c994d-b0c5-4bab-b94c-0b9cdaa1f4f3", "value": "393216:2A80U3motTItDgPZZXMCHWUjXHcuI3/PGTAI:2A1U3motktDgnXMb8X8H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120881, "uuid": "116588be-287c-4d15-a047-14e8c509f7dd", "value": 13863497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120881, "uuid": "d17b8831-7ae3-44a1-91fd-ae0094d7bce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120881, "uuid": "9370eb57-3528-443d-ae98-db4225c04a0b", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465fbd9d-5309-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779143472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143472, "uuid": "d714bcad-034a-4bc9-9457-818d33ecc609", "comment": "Malware payload", "value": "886db440049f1ec018b7f8e6dae7f8a0", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143472, "uuid": "7a2f6268-28d7-4007-9fe7-d2d2626c6430", "comment": "Malware payload", "value": "8b873ff9b31fa9b0d9c6e9bb0e5a3b0f4a948a67aaad521b8358bcd065d26ef1", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143472, "uuid": "4105de27-8772-409f-82fe-37c62ff74ea4", "comment": "Malware payload", "value": "e28aa8c23c96bde501b8df69f70656daee8e3b1f", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143472, "uuid": "ce96b0d9-c571-487e-befa-a42ca920dd04", "comment": "Malware payload", "value": "b5fc0a99de56fc467eedfc4b6d62d87f2fc4414e129f949e09d18aa5396ff6b800cfcad58ba98c39f07cbcee4d0858eb", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "getauthdash-icu", "colour": "#B63DFA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143472, "uuid": "9cec4cf5-e269-407f-b008-2a4da8ad4837", "value": "T15295BF22BB85C0BDD1DD013D2628BBAEA67DA2A80F124DD7B3C459FD8D348C19E35617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143472, "uuid": "fdaf462c-f195-4b83-a745-7707a6e2d8f8", "value": "2f307598ade8fe7e1696a56203dfaaa5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143472, "uuid": "5f5484c9-64ef-4102-98bb-38f8bee1b2f3", "value": "49152:dH6CoyxYmdLNWWS5VyO1bAAii6x1fH4ia5At/y:dH6CZNlOdkoA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779143472, "uuid": "ba649d18-21d4-4966-8304-29fbb6d81686", "value": 1990728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779143472, "uuid": "06b21565-6b34-4a04-a9f3-2862908af08a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143472, "uuid": "b35ebcf0-b9d1-4d11-800d-ce7e979f638f", "value": "VulcanMessage5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ac01c5-52b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779105855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105855, "uuid": "0b985bdb-7d1f-450d-baeb-e4c5650b1f4e", "comment": "Malware payload", "value": "3b7f8284091739e34a597b57b550d7d1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105855, "uuid": "58eb555e-b8d2-49ad-93e9-2ef0ae7dd27d", "comment": "Malware payload", "value": "8c220443452ef683e65598bb63713c59ec034c22128ab0127f760d475110a90f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105855, "uuid": "f0386f02-64ae-4773-b258-64c95da34c0a", "comment": "Malware payload", "value": "37cba580d6ca8c7fbf854b3103a02327304a6f4e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105855, "uuid": "1eca6980-1bf0-4293-a2f9-0144d2d53612", "comment": "Malware payload", "value": "2e395bcf232b5323c7eebba10231b95c7573d2adfc825b9c42549861193f4b9ee71ed17b7ee763a582ee63c4cc07fab3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105855, "uuid": "ed9a49a3-c744-4afc-ba43-da30e01b95f3", "value": "T11251DA2566C91B25C3B64E3E687EE6169A71B8C3EE53CE6D03A1918C4894601F834F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105855, "uuid": "ba09e9bf-8f3f-4799-bac9-10b1e5f7708d", "value": "24:8sJmOP2IKAyx+/Z5xAuJSuUMA+/Xsqe5CwZT4I02quWgncWgI:8jil9A1PMANRZMIUucI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779105855, "uuid": "157d010d-41d2-4d32-ba12-3a685c1ba05c", "value": 2712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779105855, "uuid": "83252d6b-4d8c-431b-96a3-4b2dd12ccfa2", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105855, "uuid": "13849284-b614-41b4-892b-6d72eb1fadf4", "value": "candidates-guide.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886d410c-5256-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779066703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066703, "uuid": "ce6f04bd-fbfa-4b59-8662-876c0e45f981", "comment": "Malware payload (Mirai)", "value": "4d86b76bd0553388e09ee5880c20a5d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066703, "uuid": "ac434b9f-e249-4d42-a7f9-c3845253984c", "comment": "Malware payload (Mirai)", "value": "8c5a6c22d5c310980c1467b9534ac9a8e5495bc08ca2ada9176fa74678877e90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066703, "uuid": "e4720929-82ff-4452-9ac5-4591b9946b78", "comment": "Malware payload (Mirai)", "value": "324be225cefda8aa19f9f08ed3942c252c5fe56a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066703, "uuid": "b2b12a46-ed01-4e2f-adb3-5a2426eb77b9", "comment": "Malware payload (Mirai)", "value": "7148c62228e73fc3ca3a0b368fe2867ed33e09733f3845b772dc7ac2c5b0bc5ca061ec92c8598acc37eca1ab5d6d34a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066703, "uuid": "8a43c6e6-a84e-4d26-9817-9f98c19ab6fb", "value": "T1E7F33C47B7208FB1C368D67009B3CB67A6E6269216E19985E76DCD107A3075C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066703, "uuid": "698f1601-062d-41be-b9c1-e2caf1262693", "value": "3072:o3VJgzikZXyrNo/tqTHmnsHgCtEUQW0l/1wLxpvEcJz3nRfau:oFJMZBtqCnFCtE1R1WpvDpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779066703, "uuid": "0539b555-1e37-4447-a334-5d492656e5d3", "value": 166944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779066703, "uuid": "a8e39f4f-a8c3-4cfd-875c-710a7b543c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066703, "uuid": "fc5e953f-1b96-4e2a-b0d6-97eb4ecea943", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147de9a0-5256-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779066508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066508, "uuid": "92686b26-818d-4660-a0ad-e09b351e1e68", "comment": "Malware payload (Mirai)", "value": "67faecda7d6b3ac3159589802a892dce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066508, "uuid": "c34a55ea-cb89-4cd0-8b6c-f74543278147", "comment": "Malware payload (Mirai)", "value": "8ce6a36e74541d39aa6f11c1c47c7b6b7de8451beb024af1df44597051c86e8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066508, "uuid": "0a8450b2-ce0c-4268-9e5e-25f8107d2dff", "comment": "Malware payload (Mirai)", "value": "8a70d17d7b11d145e7cf9a52668a204e45ab4686", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066508, "uuid": "0af0a51e-9042-4bce-80b9-bd03389f869e", "comment": "Malware payload (Mirai)", "value": "7ef2a8305f1494e061d9795c069745a205995d5171f93979ceffb4edc1792d8636ea1a7878510cd4b7f19f793b02a753", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066508, "uuid": "d1fab821-7f11-454c-aeb3-0e64785ac283", "value": "T1BEC36C82EBD3C0F1EA8706701067F75F8A34DD259068CB89EF952E71ACA5B46961F31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066508, "uuid": "4a9683b6-a539-4bb2-87f2-4cd13275e009", "value": "1536:xuk+cE5W+7JA/d0Aws9fW8Txk0UXQLZH4s7Oh1ufLa04TYz2LC1f/hCfor:xEcpE8TC7gLBXW1Ya04TYz2LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779066508, "uuid": "dcbc8f81-d159-40f7-8f0a-debf5b70dfcb", "value": 124692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779066508, "uuid": "658f91e6-152c-4c27-ad0e-8c9d62e20604", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066508, "uuid": "125d0ad8-a400-4463-8976-16bc94df6e24", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b6e6a6-5286-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779087130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087130, "uuid": "8c251436-149b-4113-8b7c-8decac349f5e", "comment": "Malware payload", "value": "922dddb3121574feb416ec6818ff98c4", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087130, "uuid": "73e7c07c-a12d-4052-9248-d85e9592d315", "comment": "Malware payload", "value": "8d4504640a1e8caabfe0fea92d62bc197633a67cd541bd0a2cb2cff30d7baef9", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087130, "uuid": "b10c74ba-55a7-4165-ad64-ee7a93e76d06", "comment": "Malware payload", "value": "878b0e3e265c55275db565b39e35caa945dcff82", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779087130, "uuid": "8be473ea-2567-4db1-8f19-36a0d16b725c", "comment": "Malware payload", "value": "2a83103a466cf1e87c203dadd8af98af72dbaa29c051266af4815131cda08b03de71551793744fbfa6af420d9d7f8d80", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087130, "uuid": "81423c9f-a8da-4566-9c1c-02377f9b3275", "value": "T13D052310469CD316CD6637B8B0E84B205B76F54DB62AD39B191D92FA2B927034F703BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087130, "uuid": "3b0c3001-f09b-4802-a803-6e96502af1e0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087130, "uuid": "720d81f4-569a-4c8c-bb42-4f8c5ac8df62", "value": "12288:bwzwtrmF+Xr0Cn7dN/nc7IhkMc2eKT7QDMgUtyD+/EfQYmrbrSiIUEkM2DIinv:4kb0CnRN/cVMZvoM9fcoYmbSKEoDIinv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779087130, "uuid": "811779ab-61c2-41a3-944f-506a937b4fd8", "value": 806696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779087130, "uuid": "bcfa7029-f0d9-4b4b-9608-c694f5928ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779087130, "uuid": "176c15be-0e01-4896-abc9-bbffd2896520", "value": "_con_.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a8e7b0-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120550, "uuid": "62564fe1-d03a-46d8-93fd-32d72f4a170f", "comment": "Malware payload (Efimer)", "value": "fbb4c43599e26a2721e56c7d84e04867", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120550, "uuid": "32f2ef48-cf18-45b3-9c77-f40f1cc2d9b2", "comment": "Malware payload (Efimer)", "value": "8e4b1512a0ae037deb594de326b160ff9a7509277000a03522cf76ae59ddbf7c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120550, "uuid": "d4cfd95a-fd39-473b-9465-26df9019ae67", "comment": "Malware payload (Efimer)", "value": "9c2ab3c0997252355198b71323d724fcfb31f6cb", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120550, "uuid": "15fef71b-e8f3-48cf-ab8e-dca39e46756d", "comment": "Malware payload (Efimer)", "value": "a2c84c58ba4b897f8b5373bf36b141fd75d0929ba2d2a124831318a783b223f88c44d49d3a173718f7c609138952f19d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120550, "uuid": "c8765a21-3f90-44aa-a4cd-5a8272b69b68", "value": "T116D6334BE5B1A1FCC6E6A078FDD865B170DCFC390273DA3A55A9C7752C1B46089ACC0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120550, "uuid": "2561ab7e-cabe-4b4b-815a-cd8b1c37e3db", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120550, "uuid": "88c88bfa-0658-4725-8ed4-801a2fefe288", "value": "393216:/mfkGnmmYaBvwM6fGOhuNq/sXMCHWUjXfcuI3/PGTAI:/mfkwmmtBvw4MkXMb8X0H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120550, "uuid": "91f5306f-50c9-4a2f-8c69-941751663c1d", "value": 13847153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120550, "uuid": "b784702c-8c43-4d70-a9db-eb425e8c3a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120550, "uuid": "383d6983-3676-4d56-93c4-ccfdefed711c", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958b5bb9-5257-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779067154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067154, "uuid": "94c02c3a-21be-461d-b968-c9b4daf4bf13", "comment": "Malware payload", "value": "0a7baba1ec8a3c3c17b63e58ef2aac12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067154, "uuid": "47893024-74e9-4f88-a986-914519ec3279", "comment": "Malware payload", "value": "8e93cb30cd5700e3c2e619b9c208e51a43e4c4ae69ad02bca55ace7b3f9b9bfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067154, "uuid": "e5d10315-9883-43d2-823c-a02f4e36090a", "comment": "Malware payload", "value": "708d85b661846c270fbafc3c4537b16aee2721dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067154, "uuid": "65f89493-a11d-4cce-ae28-024abbc6513b", "comment": "Malware payload", "value": "5b2ac1ff5b3e45dc642558f3f12bebf9a8fb14fa9d85eab0957c1b74cc495079d344ace54eb7f9f88ee4597adf1d2ff3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067154, "uuid": "b20abf42-b9c3-4140-9598-df7f2f304f4f", "value": "T111B3532ABB61AFBBDC1FCD7301A94501208CA45A12D92F6FF1B4D628E38AD4F45E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067154, "uuid": "7d12b0cc-666f-4331-8463-571629274ddb", "value": "1536:lpLupAZOcFrHTCbWYyLaNHBcncm8EE0I4K0Hy7:znOBxFley7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779067154, "uuid": "4cfd76d7-7e40-47e7-a686-ce0163a1a852", "value": 112948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779067154, "uuid": "b4a8ad48-7bb7-4d03-bc2b-88d345e794b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067154, "uuid": "5102f4a9-c929-420c-a8ac-a5866a78e114", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb73729-52f8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779136292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779136292, "uuid": "a23ea011-68b8-484e-a197-83e7c6843160", "comment": "Malware payload (AgentTesla)", "value": "7107409de4c46002d941b925c11351b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779136292, "uuid": "6dfd475d-b499-4329-b33a-32af94cdd507", "comment": "Malware payload (AgentTesla)", "value": "8efda310e1548c396caa8fe3e31168c386215e880ac3000b57047643d2702f25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779136292, "uuid": "7b662726-ce0a-479b-8845-2534049d7345", "comment": "Malware payload (AgentTesla)", "value": "7c1a74c7d2923b31ca7abafc33096808c8c77181", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779136292, "uuid": "57f5dea6-4fca-4e52-82f5-abfee1108972", "comment": "Malware payload (AgentTesla)", "value": "34587d25705a6d4d69d571ae821ccef6fb741d1d1d6e8953cf640de1c00e9b865fc7ccbb3b033bb517a0a242b9aa541d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779136292, "uuid": "20ea5638-31d2-401e-8238-ea16235652cf", "value": "T19FA540472070015CF01541D2F580A5DDD22EDCBC155EE6BBEFB96C6128AABE32AEF16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779136292, "uuid": "035afda0-63c7-4828-86f1-58ba3bc13e24", "value": "768:Tffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffb:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779136292, "uuid": "c8d8fceb-bdab-42ba-a81e-48f6c0153efa", "value": 2245183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779136292, "uuid": "d337208d-2c22-4205-94b5-85b436b4ea38", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779136292, "uuid": "703bdb89-8d3b-4f7b-bbe9-6e75cfe2cfe4", "value": "DELIVERYNOTE-DHL-ARRIVAL850123324624623569354868707.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b97bb80-524f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779063729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779063729, "uuid": "dec71c19-34fa-4760-8fac-36fe43744fee", "comment": "Malware payload (Mirai)", "value": "cdf5d6d9b3bb4a24b3cc90f10bf3cc4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779063729, "uuid": "b39bf598-3e2f-445b-9d71-5429b4e8ec8d", "comment": "Malware payload (Mirai)", "value": "903b4771836b5d15d001ce1016694b79b2d7bd3cd07f750128fe6ebe6e9c7d6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779063729, "uuid": "48d67242-4cc5-4f0b-aa40-689fce840d75", "comment": "Malware payload (Mirai)", "value": "cde67ddce4d851b052bc200ce70ebd5431c9f0a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779063729, "uuid": "a95f4294-9785-45ac-9232-0c6b53a3ce86", "comment": "Malware payload (Mirai)", "value": "36e7273f651282ba7fd97dc8a3dd62d0128a9061ca2832e7e2214786a0d19597cf52efd58e232b47580e20c0b7248827", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779063729, "uuid": "6a01da70-6873-4d26-b489-7d61bb2beeea", "value": "T1F2C31B01BA418B13C5C21BB6B7DF47593B22B664D7DB3302A9297FB42F4778D1E2A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779063729, "uuid": "0d426af3-c41f-4ac9-a639-d611761e25b7", "value": "3072:VKghWbDZCABGb4ypl65//hZn0C5dCzewPQyBWjHGx:YgBAWpc5nhZn0hzewPQyBWjHGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779063729, "uuid": "afdca412-4c87-4f6e-b070-70d7b8733f63", "value": 118221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779063729, "uuid": "4a188eb4-20bd-4a59-b0c2-76c3ff23ce90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779063729, "uuid": "ecbfbacf-ba24-4638-9995-d472210efad2", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e10331-52b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779106239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106239, "uuid": "3a2b1f5a-3a81-47f8-b926-82fc3bd71ea2", "comment": "Malware payload (Formbook)", "value": "6f60e2b72ebf4d4f9c109d7233d7e0b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106239, "uuid": "f3306416-ea1e-4d74-857e-1068241bcc59", "comment": "Malware payload (Formbook)", "value": "9182751ecb4be8a481174c472ecdd3fca9f95c7b5d3670b29f8a6d51d0bed5aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106239, "uuid": "18157f0e-2c16-4b86-9f5c-b304b88a1421", "comment": "Malware payload (Formbook)", "value": "97e20c21259a8af0a0dab957be3b924e32bb9d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106239, "uuid": "dbcb0546-21ba-4ec9-84b0-b77d3619aa27", "comment": "Malware payload (Formbook)", "value": "2c84d5f1ac0d613e6143f9cfdca8c10f09f035f4c6323cf0fd3d2cb527927ece3f0e1244f702c8505acf17a4a5a15750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106239, "uuid": "dd782195-0dea-47e6-be1a-d22b4e059a0a", "value": "T1C894DC203AFA5019B1F3AF59AEF474E69D6FBE633B26945D1051034A0B23E40DDA173B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106239, "uuid": "7352c895-37b7-4e45-be21-211cf18386e6", "value": "12288:bZxY2qpq/cI/LDmzIthUz0YMICbIXlEnS4R:8GkMA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779106239, "uuid": "4edc9620-9348-42a4-9f8b-5f95eb2422fc", "value": 433032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779106239, "uuid": "8ee432cb-d965-40ed-bc9e-7b3cf2b3b0dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106239, "uuid": "985b25ce-b5bb-47c8-8442-840d16a10aa3", "value": "FNB Proof of Payment.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a88c1ae-52e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779127588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127588, "uuid": "7d292c79-ad9e-47f9-b480-9ea78b3dc018", "comment": "Malware payload", "value": "f4aa57a17d8afe6f03835dedfa96c6a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127588, "uuid": "f2f9f64b-0249-404e-9072-db697209daa8", "comment": "Malware payload", "value": "9191dfe8495726e9ade2b3cd66cfb1c47d613e87dddfc6038eab2953e988fc2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127588, "uuid": "97688391-74ff-4446-ae90-057a8e22b628", "comment": "Malware payload", "value": "5a828dbe3e04d50a690029a624d3d4b23573eda7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127588, "uuid": "a6833f64-e4d4-4fc1-8471-ab6eff716a11", "comment": "Malware payload", "value": "eb142554a77a777be99bf47714d03f677bd9448afeee62d0cb581bdf265af139853352125401094761a93eb918d6ac11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127588, "uuid": "4da8d6b6-0e00-40de-8c22-5c636b73a7bf", "value": "T1D1567C8773A60185C16BD23CCA8BC617D6B3704447628BDB216ACE592F337E26E7E744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127588, "uuid": "da188e07-9ef8-45ee-9f7a-0928e698350b", "value": "3e9ad50c4da66460cdb140e11a29ea41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127588, "uuid": "3ae3dfb0-ee75-459f-bf4d-6f702ae54b48", "value": "98304:pyXoLshbZZAM6ifxLtL2fBTKH3YCQiigLIyz4Iwsa:pyXoLshbZZAM6ifxLtL2fEHigLr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779127588, "uuid": "78479c80-7c81-4f56-8241-4dbd01876d8b", "value": 6105600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779127588, "uuid": "bcdcf627-e4ad-4891-8a1c-2b6f9fdc6ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127588, "uuid": "487f5b14-3436-4b52-b01d-94240cda3ae2", "value": "Qt5Widgets.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84dbb55f-52f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779134128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134128, "uuid": "7672a15a-5a0d-4020-b283-429ae6074b35", "comment": "Malware payload", "value": "32ac3164c6589ffc26442720954e1efb", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134128, "uuid": "d974b9cf-9ade-47d3-ac40-545aa706d3b3", "comment": "Malware payload", "value": "92cdaacfc4e272fbacde76e218596ad5b681429850020c44105e29e33765664a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134128, "uuid": "cc25dd10-646a-4d8a-a8d2-4572e5f96a40", "comment": "Malware payload", "value": "2a3d830bdd868623e7b6cf090f1fd3b8014a65a5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134128, "uuid": "bccbd0ee-c61c-4cba-9562-a800f264fac5", "comment": "Malware payload", "value": "b7f6c8e6da48164ff268b8f92885eebc9d56b229045781dff01928d787ad273f9b000ef8ffad17f7eca92254d4def2a4", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134128, "uuid": "bef772ce-86f8-4b66-9677-480715bd350c", "value": "T18EB1C6202EEB10C8F27B577127C8BAFB0996E4B5692DB2F461009A448771981DCB2B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134128, "uuid": "491f9bca-c935-4ed3-b384-fb3bfb48f1b1", "value": "96:8yAVihjRheSAM0QDLZH6ESAMVSAMaVyDLZH6QPgLj3L+SAMw4SAMjsxbpKVKdig+:8ybxeS4QPJ6ESZSWVyPJ6QPsjCShSH64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779134128, "uuid": "b55605db-3d8a-42b3-87be-47639e1cda3c", "value": 5400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779134128, "uuid": "b90e44e9-9f85-4665-ad6c-dc4742439778", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134128, "uuid": "f4aed739-cb84-4674-a7bc-ff6df7189c95", "value": "image~2026-03-28_23-10-03.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5345ba-5313-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779147908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147908, "uuid": "009ee4d9-b709-42c1-8315-200b2737e611", "comment": "Malware payload", "value": "1455ccb9adc47bd06401f2804613c148", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147908, "uuid": "e7840cfb-94c6-47eb-8e98-246bb214e80d", "comment": "Malware payload", "value": "9343b30ce86a72ea2babe867acdf844efc45e2fba296d98e6ab94ffde7825c98", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147908, "uuid": "2debaa61-9b22-4af0-ac3a-e6ef604c47c5", "comment": "Malware payload", "value": "ca606997392c8dd5098048d7054e80f5b4d701ff", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779147908, "uuid": "c1423df7-7efc-4447-948c-0790d670e133", "comment": "Malware payload", "value": "126bb1914397d741e6662c98c304286c3639ae6299b9d3d23c39233939334b67109f6fcce1406bf100a8c8f8f8ce4585", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779147908, "uuid": "9789722f-de47-45e6-8172-805c0b8fcd60", "value": "T14304133C27F21A4995AF419CB6FDD62038B68D3280685F08F67CC6E54B2DE725B1754C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779147908, "uuid": "a5fda499-334f-476c-a620-3e65944edc49", "value": "3072:8AYVshLoVCGlPyGiotY1kXbU9BND9Zfli8ypqMBTdNS3ywCbRoL/AfKh8PQHHfS:oe0VCvs5yBVrfcvpqATdNAywECrAfKin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779147908, "uuid": "ad6bb75a-6807-4c82-8f0c-b6e1149c0f77", "value": 175482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779147908, "uuid": "9658fd3a-833b-43ed-ad3b-369b023d43dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779147908, "uuid": "43a9ccf0-c6c8-4755-8d78-1ba51d57d80e", "value": "LIVE.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bffb37a-528f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779091029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091029, "uuid": "9437a7b6-60f1-4973-97cd-24e3a9245a2f", "comment": "Malware payload", "value": "66b6df7803ff301b42d98ca011faf3b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091029, "uuid": "8e32e365-e932-47ff-82cc-f8d8816dc6a6", "comment": "Malware payload", "value": "936a9efab6070da781915b9b293567a5fdf9a10d4e95d415cab5fd9352588435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091029, "uuid": "40617f20-04db-470a-824c-f1b62d7a001a", "comment": "Malware payload", "value": "f1d7eed33657e8500a4e0b842fdd0d32119b7d45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091029, "uuid": "86628fce-587b-42a1-a5ca-72f38db769b3", "comment": "Malware payload", "value": "f9c0e9efa74f07d9873a8bef07faff4d9372112d6f33bac84995999be42538408ee6b3d6f2d690b6ed56cee0bcec42e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091029, "uuid": "f82ea37c-81b7-42d2-a5e4-9fc5d08ce5b9", "value": "T1EAE2535FAA62CE3ED080E3340AEB85A0E07074B1BF73B047665161BB7E857544B3DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091029, "uuid": "04a816de-7b6a-4c26-96f4-6edfd085b90b", "value": "384:Frm74B3TNwYD6vbezngQOf0EyasBceEgrJ3YI5KlPAD7P:FPhTqYmWEg13t5KVAD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091029, "uuid": "983389e0-8815-4ed7-945e-2af88455bd97", "value": 31192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091029, "uuid": "348da769-64aa-40cf-a6bd-bca62c4fae43", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091029, "uuid": "7ec2666d-078c-4297-9895-94a67963317b", "value": "server", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd240f85-5258-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779067650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067650, "uuid": "4310cfa5-3d33-4cce-a89d-56a3c57edb1c", "comment": "Malware payload (Mirai)", "value": "54379eab948538010f53581a8401f685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067650, "uuid": "7de32eb2-711f-4eb1-9511-78fbe74efcda", "comment": "Malware payload (Mirai)", "value": "93aebf8b0fd05f039fa5e38c02382f7a538fbbb72ec023316aaaf72927870e6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067650, "uuid": "d25cdd97-a831-4750-bcc2-5df13f5b4da1", "comment": "Malware payload (Mirai)", "value": "fc46885ddfc8b71fd82456406c13847fae931828", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067650, "uuid": "025a3340-d81c-470e-8a92-7f1539672980", "comment": "Malware payload (Mirai)", "value": "35e2480affc124e68a6a0f58bfd2f24444006289dd0d640001faafcf41d9bf7025265a9b89ab908e320bfcc81fc51792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067650, "uuid": "779747b5-9030-41e3-860e-32b07c8d5321", "value": "T1A1C3F185FB636991D0A342FDA4C00AC387912E318BA217480699F774387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067650, "uuid": "386c10b4-19bf-470c-9907-6f0b6d0193d9", "value": "3072:SBdQK+TG2nIjnRdZaUXUSgkLCCVwHWiEiBtbMMTnX:eMQRtXU9kLCP8ifbxTnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779067650, "uuid": "e4eda8a2-6a4c-4ae3-ac2b-2afa57734d96", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779067650, "uuid": "282c39e8-e959-47cd-a1f5-0c53a13c4d75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067650, "uuid": "05536086-b271-4d17-9dab-0da5d7acd2e2", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee934881-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120991, "uuid": "84a311f3-43e9-446b-8bfe-867b82d85c21", "comment": "Malware payload (Efimer)", "value": "c69a9ef3ff9bcbc02c7db900f40efa61", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120991, "uuid": "2f0f4406-bcf4-4158-8c19-d4c9c8db5943", "comment": "Malware payload (Efimer)", "value": "9523a2256a563ef90d5fce3cbf5d0f649665406901ffa7617e4f8309efe962e4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120991, "uuid": "8ce19bbb-85d4-4ad3-bd9d-cfc75b659e17", "comment": "Malware payload (Efimer)", "value": "020ff3041f9954be8e3dd03031b68156dce27cdd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120991, "uuid": "357c8e50-5355-4cf1-b0a6-320d43d48e70", "comment": "Malware payload (Efimer)", "value": "065595e13aea2bc5e8fce8453a27d70ea1e3a1861336dc0a033995c025e6777842cfd3ada8f7bd57f122bf63f9c940ab", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120991, "uuid": "562215c4-1ece-4750-9ceb-897af1949a0b", "value": "T1F9D6335C58D191ECC7939438BBE26EF454B6BA751671EE3BB318E670AC53EA0C20C847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120991, "uuid": "5ab37a59-ef0a-4dc8-b147-3d54b3acc3fb", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120991, "uuid": "bf4b2e1c-6118-4ba4-b489-8d03d3444fd5", "value": "393216:RAxTaVOW/Y9doKZwh18cVYXMCHWUjXScuI3/PGTAI:RA9aEW/2N292XMb8XvH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120991, "uuid": "a57f6599-83be-4aa6-b04a-abedee8296b5", "value": 13804223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120991, "uuid": "4646a132-5f67-40dc-8c18-377cc2cffb5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120991, "uuid": "76e5d0d9-46d5-43e0-bc5e-5fa54fdb5186", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ce8a06-5256-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779066507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066507, "uuid": "985d4b12-d298-46e0-9b34-f532e36d252b", "comment": "Malware payload (Mirai)", "value": "ab2e06f5431658855f6e2666136a4177", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066507, "uuid": "f70f81e2-30f2-41dd-83fb-1232599b01c3", "comment": "Malware payload (Mirai)", "value": "96667b03154b6b8514d4bb786c9af193ec5a433fe8971b6fa3d08d81e19e97ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066507, "uuid": "9a5ca0a3-37e9-439a-8283-020dbf501768", "comment": "Malware payload (Mirai)", "value": "1b67a77fd85ecc29c999f87579d6bc9dc5f58428", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066507, "uuid": "8b2b4ea7-df74-464c-8a83-559fe645671f", "comment": "Malware payload (Mirai)", "value": "2542496679a5fe55e7b6b68fbc8e2e7f6d78b6cc98174e7f0f72505d14680e29809401732f7228d7e4a464ed3cb9b98e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066507, "uuid": "701ce3a1-2d94-4235-96c9-65da54acd774", "value": "T115043A8AEE710FDFC0AFCE30025B832715DD589A92F5633A96BCDC48709E6485AD3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066507, "uuid": "113aac7e-0544-4182-a1d2-5312c362db49", "value": "3072:Ib1TivkT6rFMgINc3+YRnr5KZy9pIMxUscs92onUDNgS8+DH8gmLQzTy4G3OCOUe:I5TivkT6rFMgINc3+YRnr5KZy9pIMxUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779066507, "uuid": "781a0271-63c4-4773-a8f2-912183f11fcf", "value": 183496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779066507, "uuid": "6375499a-3c8c-4bda-9859-7c5d37155f7c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066507, "uuid": "4d97099c-4007-4ecc-818c-e23c8d75b4a2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ac4095-5251-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779064678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064678, "uuid": "3c3a2d1d-efbf-4d37-8ab8-b4af7e547e87", "comment": "Malware payload (Mirai)", "value": "e1758231f04c5f93f55b215670ad000b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064678, "uuid": "d207f905-822c-47ff-b966-ed4b498371b0", "comment": "Malware payload (Mirai)", "value": "9685d9bf268852a383694557b1bf2b2c0c584792425cb923fb7ff9de0b71357e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064678, "uuid": "0b49dd69-ac8d-4d0f-b517-b157424a62ca", "comment": "Malware payload (Mirai)", "value": "190a7043b12f2984cd549560f98bd6c49ba2bb8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064678, "uuid": "f37db91a-24b5-4130-a628-25c90cb81ac6", "comment": "Malware payload (Mirai)", "value": "565d00d98a21eae536adec9c4c30017dcae63378cdf4cd07668e3e97c95f2cde483010d3d283f2b90565cd33b3b71d6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064678, "uuid": "924f42fe-5a06-4fa9-a1e4-3e86cf8fba3b", "value": "T12B932AD3F800DDBFF40AE73B88530D09B171E7A55A830B7A6357B927A8361945862F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064678, "uuid": "02a89f64-c1b2-48c9-9db9-40eef904b59d", "value": "1536:s1O55VulgpB2Gw/wUbL9D86y231CYwGWa4c0nF9+TnxhoJaPDDVzkZn:gOs2p3wYUbL9Hy231CGCcgFgoaPD5QZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064678, "uuid": "84ff6c73-4a0b-4219-963a-8c970919e655", "value": 92132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064678, "uuid": "db36637a-01fa-4c8d-b4d7-4df13714d80d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064678, "uuid": "9c7816d8-0ba9-447a-8174-c156eebf63ec", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e6e43b-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120929, "uuid": "f79d0829-9276-4daa-89d7-b3d55805d8f1", "comment": "Malware payload (Efimer)", "value": "f7a9252f4fa457ac64497697f8672881", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120929, "uuid": "6e12f042-256f-46b7-a53a-db2f3d91fcde", "comment": "Malware payload (Efimer)", "value": "96edfec9092f6751bfe76f540848e631079f30d713aafd4324692c23f4000e3d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120929, "uuid": "9bedd1b1-05cc-4dfc-985a-c8740f72424d", "comment": "Malware payload (Efimer)", "value": "300c9a813f24f1c915f50ffc71b9bc1be84d6cf0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120929, "uuid": "fb18a48c-d62d-459b-9c24-ed10e3792054", "comment": "Malware payload (Efimer)", "value": "50c721f1e9abda71f4c067e86adf054960029c4eaa52f502f25f6fb7639f33a295e3f1de6d0b558cc4dfcc0c449534eb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120929, "uuid": "ab12133d-9366-47fd-a820-ae36c54c24ee", "value": "T1A4D6330AF1D312EDC6A3C1BCBFD2B3B1E82974395F619DBB6A54C172E4576009A2C847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120929, "uuid": "42c92ce9-ef37-49a9-a827-5a4d5a4b90f3", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120929, "uuid": "10793eea-1d33-45a6-9861-5f7b14bc71d6", "value": "393216:UkgbzsyrHY+3ojmhVjEDm7nHIe36PwvBXMCHWUjX2cuI3/PGTAI:UkIoaht1HIe36ovBXMb8XLH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120929, "uuid": "83c18159-955a-4514-a053-48240b1afbf2", "value": 13794968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120929, "uuid": "b067a62d-04fa-4bc8-a04d-a166712a3312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120929, "uuid": "7c1bd71f-b531-4b08-a80c-f74ada67fc3a", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414e7d5d-52f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779136592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779136592, "uuid": "96a7ac30-96fe-446e-bd13-bbf48f2f8f7f", "comment": "Malware payload", "value": "93e7cc4c7580d5caf4dc32c027e99ac8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779136592, "uuid": "c727d138-77db-4783-84d8-9d696b7768c5", "comment": "Malware payload", "value": "976c17bb7dcbfa6dff7c54fa98cb9bc85d18daa7af8e8e9462310ee42b401dd1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779136592, "uuid": "bd854fd5-68cd-4b82-b442-c8d857301e67", "comment": "Malware payload", "value": "0e30b8d591e0994630512e43ff9985195935dc40", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779136592, "uuid": "0474048c-a9fd-4dec-9f55-d14773b8ad13", "comment": "Malware payload", "value": "9550a62e07f005e67781a3ede728d893b9c1a13ef8412f79751d1686289045324bcfbf1a1832e078a51ac22535d59e52", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779136592, "uuid": "07c42c20-f8fe-458c-bf80-e5a8f28abe5c", "value": "T1BEF412B467A8DB9AC9798BF419A1F23143B54C0ED522D3AACBEDBCDB35193104C19393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779136592, "uuid": "e44c6d6b-ffc9-4289-9132-874dbe0bcde5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779136592, "uuid": "370cfd26-62ea-45ea-9f9c-0e4cb6f00071", "value": "12288:CmaJHUk9iseEW+URJcSBq/RZ9u1ZYOEIrveNiG0rwfv+UcFcEOZfgaG+8:9alUw4FCRjmGIr2p7MFcEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779136592, "uuid": "deb5297f-46f5-4e48-98cd-fd41b71c8d58", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779136592, "uuid": "c5fc88a5-3003-4f45-84cc-6750244c20ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779136592, "uuid": "a91331e3-292c-413c-b3e6-64136036bf4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83918170-52b0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779105350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105350, "uuid": "6b93e7c8-7b98-4aad-b938-332e6453c12e", "comment": "Malware payload (AgentTesla)", "value": "95a14b8ce0e233a8693edeb089d8bda7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105350, "uuid": "e02245ca-2e60-43f1-8d58-a067c573e7bd", "comment": "Malware payload (AgentTesla)", "value": "986011efb401d8e711b35820e4d31c73975cc3e6c680c1be5892ee69c9f24faf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105350, "uuid": "9b499c12-e571-485a-8173-c8c8ed9d7ab1", "comment": "Malware payload (AgentTesla)", "value": "1dbba7b8f32a9794ba5982ee4bb6bed6e1f9b926", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105350, "uuid": "8328d42a-65f3-409f-bd04-0abd810cb85e", "comment": "Malware payload (AgentTesla)", "value": "e08909e44c0b96260b5835f7592d2ddc682cc3e3363d0efeaebec8871fe7a83dc0a82b5a295383f03168f1deb15e3b20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105350, "uuid": "3a621274-1b2a-46f4-843c-e0efb5c77c7d", "value": "T1C154122637A4D1ABD26742324E25C77B6EF6A51A00F9425F53F46B1E7832291CE0FB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105350, "uuid": "12b21efe-a4f3-4a20-a60e-180243ad1f79", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105350, "uuid": "536ee673-9598-4715-b3c0-bce0e432d8c8", "value": "6144:8gORay9pfRg5gL+ufM1LlIYRw2PE8SZrna:8g+9LgS/fM1uYC8y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779105350, "uuid": "81e563f6-76ef-42b0-b1c5-cec2ab5f1675", "value": 293504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779105350, "uuid": "4e6ba73d-a3a5-434c-aa63-cc518cd7ffdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105350, "uuid": "56a0e4c0-da6e-4daf-b74b-37bd168d2dc8", "value": "0000999287273665341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbcad09-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144179, "uuid": "343eca51-13d0-44a4-a401-de380ddb7646", "comment": "Malware payload (Mirai)", "value": "c72bb6a7d9e7dd2f8575e077626909de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144179, "uuid": "d94b4152-724b-4376-ab0b-78da6e29e1df", "comment": "Malware payload (Mirai)", "value": "9b255e7a6c13c4eb277ad004c3f1949956185096995500b4c2c43360c0c82de9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144179, "uuid": "d89adc38-4473-4db4-ad8a-394f441462e9", "comment": "Malware payload (Mirai)", "value": "c3d2a386997e187a08282fde7f5b7e9c960feb7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144179, "uuid": "6f597af5-7c5f-4867-9be7-1afd67de5090", "comment": "Malware payload (Mirai)", "value": "bf9f060398a4b5bf98af575850bebaf28bf9a5c83883bb8981530a75cff7617a276c1e13c73cc636658cd6556fbc8134", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144179, "uuid": "819e0ec4-f25f-4122-b39f-11fc05c2933a", "value": "T111B32986BD826622C5D423BBFA6E418E771623A8D3EF72138D215F2037C692F0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144179, "uuid": "6b68424f-897d-487b-881a-f4076cd14db3", "value": "1536:fOlvWIlGPodwHHK7CDvDNUsdnYkqlGBPRLUv7agWzT70Vhg41clTWzutuIeU:fOlezoONUsdnYkq4CzvWzHbnWyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144179, "uuid": "4fb7c074-a13d-4c96-9879-e77e52e8b020", "value": 107924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144179, "uuid": "b3835a43-ab78-4517-a035-69cf0212482a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144179, "uuid": "2a4418db-0392-4969-87cf-b145cc7c9f56", "value": "heilong.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af12bd8b-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120455, "uuid": "a820fef1-7c04-4dea-b0b8-3378b65d337d", "comment": "Malware payload (Efimer)", "value": "9aa551bd00f721406377dcd19d8e381f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120455, "uuid": "920e8009-7cae-4142-9a1d-4219bd419037", "comment": "Malware payload (Efimer)", "value": "9b3add8cac0a6883f92923d98e7e2b1fa15d7551f3bc335512d549a36c4f9067", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120455, "uuid": "492efc54-2f82-4dec-b38e-3b3bba9078db", "comment": "Malware payload (Efimer)", "value": "7c113db0455905cea9c86a3ed37559a0e6c84c31", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120455, "uuid": "9ec70c66-2f01-4a1e-b1db-9be5f97a4e0a", "comment": "Malware payload (Efimer)", "value": "5a8ae5d6b0f08e3578a959f343b8439b4d38321895e21a3d757014cf7ce5dad0141d9340761313396f3bb80e47f2c443", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120455, "uuid": "676093aa-0722-4f5d-ad22-852aa20eb51c", "value": "T12ED63389A6F261FCDAB3D038B6D076B4F830B4542236EC269774E7F174474A09B2C56B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120455, "uuid": "cdaf3b89-912d-4de3-acc6-dcfaff828aa5", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120455, "uuid": "da754f87-58fd-4573-beda-44a6034bc3e6", "value": "393216:ggwm9uU+hATY3k2YRdGXMCHWUjXHcuI3/PGTAI:g3FUPU3GRdGXMb8X8H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120455, "uuid": "0e3c98c0-3545-4477-a168-982bbb4e0587", "value": 13870922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120455, "uuid": "44ba12fd-daea-4366-9c2d-473a486a2836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120455, "uuid": "11b0d203-3b03-49a0-a4b1-dcb8f9589f50", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ab89fd-52b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779106398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106398, "uuid": "8a05283e-b7d0-4cdd-a686-4167c1cc1258", "comment": "Malware payload", "value": "53820b31470e2448f1abf35ce5a8f47f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106398, "uuid": "20935b2d-e336-4cdc-b6e5-cf1899549523", "comment": "Malware payload", "value": "9c6449738f5d072b60a0d8bce10925593ec7154ae5151e5e159a7d1e25395c1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106398, "uuid": "c667b540-1da8-4928-85cb-2f685af4a18a", "comment": "Malware payload", "value": "849053add7b7e5447557df7b923381b214f99029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106398, "uuid": "2ecfce17-e79e-4d36-9907-8cd7d63bdd7d", "comment": "Malware payload", "value": "28a4f0026d05c8337650b3bdce79da2516c9a1efd4521969d38e22f9c41774c380183b054ddbfdb4b82c03a4d2f32a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106398, "uuid": "b15548c7-5431-4206-8d19-07c3cf10d290", "value": "T169B67C03EC6625E8C1ADD27189A39252BF717C494B7223D76B50B2343F76BD06DBA390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106398, "uuid": "cabc2c7f-9e60-4406-b394-4bf9b3f9ddb6", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106398, "uuid": "fc13be3e-aae3-4d5f-9fdb-2badec1551c6", "value": "98304:vZL5YgyvkzLk49rlEG6GZlns0Xa+8hP9KstBC45EOp6qK2U+6ADD:vVWRik4qgBsSa+oPhdplKK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779106398, "uuid": "65573054-2138-454f-9d14-01c45a968f72", "value": 10880512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779106398, "uuid": "9eb9f672-4b33-47c0-918f-995a7631ce05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106398, "uuid": "62e01c79-fa5a-4615-b07f-10636843cf18", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dda02b9-52fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779138653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779138653, "uuid": "87076ab8-f88b-4882-b08c-76b729d19067", "comment": "Malware payload", "value": "a63b164f2e82ec8dc681c5ac280cc52b", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779138653, "uuid": "8bb6d9c6-7e37-4bc1-8ab8-0385c23c99dd", "comment": "Malware payload", "value": "9d5057a8d0ceacc3507323eaeea65cc0d9a840254663014050a109afe6f12ade", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779138653, "uuid": "90bf263d-25b0-4136-8212-bc2d117a466f", "comment": "Malware payload", "value": "c9ea5467106b9ce64403fdb879f38d6a9c7b6c18", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779138653, "uuid": "d0ea813c-190b-454e-8d93-a6d3e9ad8a42", "comment": "Malware payload", "value": "f04bcf2da44b3bb2f4f6466bec36837d1582c53150104c5af785bccb9b0e150cfc5fdfe36c8ac0f05607b57aafedecff", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779138653, "uuid": "23562c61-171f-4e65-ae89-93dc818fcf82", "value": "T1EFA4CF07FA9148F9E05BC07482164A73AA77FCCA0B31AA3F27E446312F56A715F2DB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779138653, "uuid": "01ea8a1b-d251-4a0c-a040-0d5a11421d9a", "value": "5eb9193504c5cdbc3eb593d11baa3812", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779138653, "uuid": "74913cc2-2d3f-40f9-ab78-24a11794d295", "value": "6144:kYlXlswut5s5fVugPvk8tWPbpixq2mccUqzUh2YOPie7sRph16aE1dCtzTAnQtNk:JFum4c88oPbIqhUh2tXSIaq0tzlNGKjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779138653, "uuid": "6c438ad1-56ca-44db-aac0-d31955ab6155", "value": 477933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779138653, "uuid": "27d1d2da-b085-48fc-94a1-bef89b878469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779138653, "uuid": "59894a69-1a9f-49f5-99e4-99d990601c07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fdc057-52eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779130533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130533, "uuid": "242075e6-f6ad-48a0-9768-d02910734f52", "comment": "Malware payload", "value": "ceb6c27e83ce578d7423d3c220878115", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130533, "uuid": "4c1f6ea1-43fc-404b-a5f8-fc347a3b1b24", "comment": "Malware payload", "value": "9d5909e4d9af6969cdfed4a0c44babd414507baf0d27eec85503bf087b738245", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130533, "uuid": "750755b0-2665-4560-8d53-10f45e0c4471", "comment": "Malware payload", "value": "abcb5a9c9e6ea2ecc4adab2765ffbb37e97c9e19", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130533, "uuid": "9d4dd645-65dd-452e-9fc4-a5d5b88ba8dd", "comment": "Malware payload", "value": "7fc1ac6770d304b379452e571c95d0a13c68c1a911389e35a8dbbbc10c497db0f04a5160e4d4153f27ef1fb247479944", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130533, "uuid": "d8f10700-3774-4f40-a572-3d481f99d02f", "value": "T139C4089B6E9005F7D65EE13484B3732DD33BB83927E28F8F925A2E155F332984D29211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130533, "uuid": "939b7e69-b6bd-4a30-bf6d-931f1a69d898", "value": "10dd6864f54dce0b385834998bbc5c11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130533, "uuid": "54cfbeb8-dcc4-4e30-b5e9-6e7c28aa15ad", "value": "12288:XWT+xdch/svz4q79HUcrWlKbP2h5jftO:XNxdch/sUuHdpbP2h6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779130533, "uuid": "3ffc5b60-5963-4943-bef8-6648714ce167", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779130533, "uuid": "5c12c0a4-b527-46a2-ac14-c8db1fc894b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130533, "uuid": "6697c391-0198-4d9e-954f-cecc9957d6d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a1c5c2-524d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779062915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779062915, "uuid": "8b5b3b94-0a6b-4595-8b92-c7292ae7c65e", "comment": "Malware payload (Mirai)", "value": "764e7b0efafe512682f43be0d9a1634c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779062915, "uuid": "baf6e5e3-205e-4113-9136-ef951af9ea2d", "comment": "Malware payload (Mirai)", "value": "9d9671995b6153ee5d1ca494fbd6f69c1383d6f3a7e345c9c3df65e48cd6cc87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779062915, "uuid": "f15c36b8-34a7-4af7-859f-9a7eec6d8f2b", "comment": "Malware payload (Mirai)", "value": "2b7cc1e5a59b07c4e80b02486825f2a67833835a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779062915, "uuid": "7982c173-ba1d-44ba-aae8-7b27b3477f21", "comment": "Malware payload (Mirai)", "value": "951032341d40da19e61acae5a68d4ff8f3d62911d165b1109f0082122f2c34cbffc0a5d38cf03bdee7985ea1818a11e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779062915, "uuid": "1a6cf07a-5fc6-457f-b2c0-bbeee85d7c6a", "value": "T148D3CF32E0086DA0DD2116B4347659BC0340DEB40BD59283EFBEE59E28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779062915, "uuid": "fa8f24f6-fcf5-48b1-a55d-3dce40e5900e", "value": "3072:kNulV+GOAc3YSmDEjdX/VuHVv3WDRGGRhaUNZkP0Z5a:yulo2ubIVv3sXL5NZmO5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779062915, "uuid": "22ebe479-c421-4607-bb30-69c6f7e8c7f1", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779062915, "uuid": "10028f67-fc86-4910-8b43-7722f492755e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779062915, "uuid": "80df8a14-6bdc-4395-97bd-2e3847096e29", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9193048a-52d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779122982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122982, "uuid": "95309576-daf9-4749-9b71-3d8ffa794c35", "comment": "Malware payload (Mirai)", "value": "388af509ef937ae6f21dafb467ed32cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122982, "uuid": "05975d28-e685-4386-b2ad-44b7c9a03033", "comment": "Malware payload (Mirai)", "value": "9eff5a31d9597921c77598523b1f4eecfdc194508e0d34def6a99bba54900964", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122982, "uuid": "8a3e7555-78a4-4617-b97b-cb37af9e365a", "comment": "Malware payload (Mirai)", "value": "ead988bb238174da50ae4e4d44f072a4a55b5688", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122982, "uuid": "aef67a7d-b261-4059-9525-bf4a27b0961e", "comment": "Malware payload (Mirai)", "value": "b9f7f2caa5d51fd2a2c232b750f65410331a6325096ca3101ce35bd98ec0cfedf8c50c726447d61adc6b95de8bec15ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122982, "uuid": "99e9c5b1-dd98-4a54-b260-de77e5822274", "value": "T1F233F1F37C7FDB74D82E16B60CE6A384F6663C1B8229936E488561BE0CE39565121D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122982, "uuid": "38c5704c-ee38-448e-8d99-2d5869686bcf", "value": "768:qRx6CKC8TpTtGjkjGgmmKluun/9YF/C+ZpHdd0BGk0H2TU9x0kVz:qb657tagmF/n1izpH7OGD2El5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779122982, "uuid": "2dee1a1f-418f-47ec-ba5d-7183b6a5c41e", "value": 51960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779122982, "uuid": "32ed8fd9-5f9b-42e9-bd8d-c207b417be3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122982, "uuid": "be67ff99-03b0-4bdf-b706-8cce88aeec8f", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2872923a-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120659, "uuid": "5972616c-c56a-44c9-88ea-383af2655ab0", "comment": "Malware payload (Efimer)", "value": "21657e755c3d8a8253d0a7e5545aaf04", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120659, "uuid": "ee2e75e1-a04f-4140-9a08-eb0961a3bc22", "comment": "Malware payload (Efimer)", "value": "a128ae63bf436649f28617650fd6a137a1323a501ff5badfc189c880f6e43c71", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120659, "uuid": "d88565a5-7ab9-4da6-9941-c45634d502ac", "comment": "Malware payload (Efimer)", "value": "159ab179b10fa7606589929f5ee3486facf0f365", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120659, "uuid": "ecd8a5cb-625e-454e-b4cd-c10996134f46", "comment": "Malware payload (Efimer)", "value": "d37ec8dada29394e85be2291fb866d5abcec83bdf855d9167422b1f407d1a9593a2eb85649be0cd0471cb6e711a228bb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120659, "uuid": "3703584e-a671-4091-869c-fb942a584a4f", "value": "T197D6332D65E271EEDAB3C1B07AD707F9B420B431237158768FA4D2F06D631029A3E59B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120659, "uuid": "74a083bb-4607-46fc-b177-b45da2563c75", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120659, "uuid": "adbc41cb-8606-4a3d-b51d-c172e8dc56bc", "value": "393216:TYOLdYhKHBh/pi80xIKjO+WXMCHWUjXCcuI3/PGTAI:TqKhh/pSIKj7WXMb8X/H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120659, "uuid": "64934547-a62c-4746-8aaf-747dfaf18f99", "value": 13853243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120659, "uuid": "25e67a89-6d6b-4e6d-818a-0c4b52a2b2d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120659, "uuid": "f39547fb-b74f-4724-8e48-639cb88ee2c3", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d75a1cc-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091032, "uuid": "d6a65839-f04a-4412-a519-3f2ecd89c328", "comment": "Malware payload (Gafgyt)", "value": "55805d21dc69136950f43435ef2ec656", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091032, "uuid": "602ad70e-ab75-4660-950b-c75e966ce61a", "comment": "Malware payload (Gafgyt)", "value": "a1eb2a4c7598f230a637cd7105e71ad84063b11165625e266757f9de850b9e3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091032, "uuid": "e7c3bfbb-fac2-4efe-9337-3c1b3de919e8", "comment": "Malware payload (Gafgyt)", "value": "f96950d6085e6b952c0b9c1107ea211a4c54c9be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091032, "uuid": "3bdbe263-2063-49f6-a604-faeebbe4670c", "comment": "Malware payload (Gafgyt)", "value": "96202ce5ff27d908110f4313859a6caf4984d35d372cb494a40931bb879e2ff16eff4633293170357947a7b5bc4d6228", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091032, "uuid": "0c26b158-47a6-4f97-8b61-1797b3ee4643", "value": "T191F34B41A646C5F3C8830FB102A79AA50722FC3A5A3FEE48F32D7DB44B765D8B119758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091032, "uuid": "36ab9bad-b5d4-4bb8-a220-f123e7b8adba", "value": "3072:EBq4rxPpIVj3WuuG7HobBQaOb98b9sZwFjdhQT74l4+foxTmRuLTY/75hytPGttt:EkSxPpIVj3WuuG77CqZwFjdfToTmRuLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091032, "uuid": "700a1aab-8fa6-4af7-94b3-912fdc9ae0db", "value": 171861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091032, "uuid": "860c38c9-6c3d-4752-8c2c-6b0b92be4af8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091032, "uuid": "913d4c41-ca13-4eb1-a33e-55748fd82e4c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df047c6-525a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779068430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068430, "uuid": "0798d1e8-fc38-4f69-a486-1fe8381c3596", "comment": "Malware payload (Mirai)", "value": "d9d4337deaa07315cb1921cfc68623f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068430, "uuid": "36bc97a0-6554-430b-8827-dbef27c48016", "comment": "Malware payload (Mirai)", "value": "a25858eb58d90477c9c900ab9c8c272e4c01b7f3e7c44bd78bb7a91364ed18c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068430, "uuid": "ff34adf0-68a1-4b66-a9d0-c1d19968f5d4", "comment": "Malware payload (Mirai)", "value": "f70c38bb0ae9ed2d93fa0d2cd04ab5e8933be3eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068430, "uuid": "93ee74d5-7809-4244-9234-019d0a8a9f1e", "comment": "Malware payload (Mirai)", "value": "44be0691f397030e886254438a4b386710541526a18d19bf4043c8970cfbef759e75d4a3e7ce09f5e64e2b434afa3e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068430, "uuid": "ed7291b1-f241-4d2d-b705-da5e2eb0e383", "value": "T1C053122B26B4C05ED8B5CB371B5CCCA183BA41599B24861BE169F5BF2D41D05F850F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068430, "uuid": "ea9da3a0-d119-4d87-a4e1-b1a79b3776bc", "value": "1536:zoZ/Yzn9l6maZh7RybbM6EwryUxNW78z77SshPDVAQd:cSn9jaBybw6E4yUu707bhPSQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779068430, "uuid": "72621328-4c4b-4a39-acc0-f992afa53340", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779068430, "uuid": "3ec4fd30-bf4b-4054-b8e9-6ef190e0ebe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068430, "uuid": "e531cbff-f708-4a32-94ef-0ea4876e0326", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d39afe-52cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779118638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118638, "uuid": "56c0ded9-3b01-4934-9d8b-d2330d3ce889", "comment": "Malware payload", "value": "7a78e7cba5db4bdf434f230fc4497744", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118638, "uuid": "5678e373-9d12-4385-a350-2b5fcd6409fa", "comment": "Malware payload", "value": "a592eb6302c4b7de408c64bf8b5a9e8255beb0c9f2a737ec0981dd56f3bf9035", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118638, "uuid": "6113e4c2-9f3d-4eb1-b306-0df7778ce071", "comment": "Malware payload", "value": "52492daacbb3cc33def844459ab59757bf9642e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118638, "uuid": "c91e1843-8f80-4b6c-80e2-5f20e47c19c1", "comment": "Malware payload", "value": "e939e928f468ac85923a3d6fb74f9ee6155790f801a30fbc7b14542fd7950146f222498af5c266fcaa535acc98bc5378", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779118638, "uuid": "b479e9ca-edcb-4d51-a09c-28ca55d424a2", "value": "T182D09516E0C3529530FC48D218D15DDC703F3C4C301D4C0DC6595BAC1912751741CDB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779118638, "uuid": "baffb08f-2be9-48cb-ae5a-17a001469087", "value": "6:iay2AOzckHHy7nhippHuIxhVBippHvcwGivkKLNmeH03n:iQFkiKlGivkD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779118638, "uuid": "3868fd8f-fc6c-4dde-ac8f-5b7c544fc2e0", "value": 241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779118638, "uuid": "9c3a644f-e886-4950-8541-a81a43968ba8", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779118638, "uuid": "1df8f331-b9f3-4d10-b30b-be7fca4c24be", "value": "121.180.243.232_1779118619582337_hello.world_ADd_allow_url_include_3d1_ADd_auto_prepend_file_3dphp_input.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a8826b-5259-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779067770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067770, "uuid": "2477d39b-3e95-45cb-9e50-a6d074ac0651", "comment": "Malware payload (Mirai)", "value": "bf4d0718f793cb7ddaf9b49d094a9c1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067770, "uuid": "63022626-bd74-437b-83d5-ae96552507dc", "comment": "Malware payload (Mirai)", "value": "a7f6b75e03e37ad27d1c090d4fb8ace97caa9e8eb6cd8af15bd5040a279a8f67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067770, "uuid": "fd867d6e-5ae8-4699-8df6-5c3113bbebab", "comment": "Malware payload (Mirai)", "value": "8db2e578a08d1ba1d083f2d2a1dea186a2b5b8dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067770, "uuid": "6829a263-8133-481f-b14d-630b227b2e8d", "comment": "Malware payload (Mirai)", "value": "c654335551bbe562d2c30b9527f71529b7bfd13791e2e68d794f5a8dfa7ec25c5a60dde040a9a55809665d307807f560", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067770, "uuid": "8f0d826a-d5c0-4785-ae1d-ed1b0f58e26b", "value": "T1D6C33B96F840CE52C6C12A7AFA5E528C33530BB8D3DE3102AD155F7436EF95A0F3A646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067770, "uuid": "786168ad-953e-41b8-93ef-cdb3fec6fe20", "value": "3072:8K5BaEQlE+OIRXhhWXxl/ir2uyiyIzvxwkwz1EnpF:8yBaEQlEb3bir2uyiyIzxTygp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779067770, "uuid": "966703cd-ce36-47dc-a9f9-22964baaf46d", "value": 124912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779067770, "uuid": "3b75bcf5-2d45-44d2-aaa9-3cb22e45f405", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067770, "uuid": "0a7cdafc-111a-482b-b80f-7f54e6cc159c", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9b9297-5256-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779066903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066903, "uuid": "5d0586d7-d34c-4e0f-ad32-e1aa433f52b8", "comment": "Malware payload (Mirai)", "value": "ccc381bde3a852ef6e3e5ee9a79db3ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066903, "uuid": "49838d94-c5d0-420c-ab32-ff3edeedb5c4", "comment": "Malware payload (Mirai)", "value": "a86b1ce27facb1e90ff1d4a99ae5e997cda168ce3371065fb50599db11be316a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066903, "uuid": "184774ce-d1f0-4a6e-a410-7b69d5ff7ac6", "comment": "Malware payload (Mirai)", "value": "ba7e25e82a4da43cf8ee0ef1d34488d2c448704e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066903, "uuid": "2b3d2602-c86d-40d2-b0d7-5db04f632088", "comment": "Malware payload (Mirai)", "value": "6a556a1a7bc2fcb0696e6906309f801d3831d6abd27b9958d8323f90178a22b6b4037f1b1432f6a0cb9f529e60c48dfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066903, "uuid": "5983fef4-b87f-4b0c-ba02-4685769d2580", "value": "T140835B32BA76192BC5D0A47621F34336F2F647D620BC8A1E7D710E8DAF247503617BA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066903, "uuid": "1a17c544-b721-420e-9f83-3b542617629d", "value": "1536:6XEdXUgl3NeUpPGQUklnDf9APUTtsQZqNm5AqtCPSeJtQlmhp:6XEjppPGQUkRpTCQgNOGlhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779066903, "uuid": "00ae4e50-756b-45a6-b421-30bcf7f9ae65", "value": 88500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779066903, "uuid": "1cdb29ee-433e-4017-b988-291fae80c0e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066903, "uuid": "283c57cf-f5f5-47da-882e-0c53a4400035", "value": "bin.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c91c09-52e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779126402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779126402, "uuid": "75e125f6-bc30-4277-89e2-8d176fbb1281", "comment": "Malware payload", "value": "200c0dfe91be98c4cee1a6e4368be806", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779126402, "uuid": "2b442b66-a963-4db9-9b3b-91dbdf372783", "comment": "Malware payload", "value": "a874492c6f55cc2f88a3c412d8c9b93defdecfff92d5d7219ae30459d6ca0229", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779126402, "uuid": "8f0c8d80-d814-458c-999c-a9efe05a6a9b", "comment": "Malware payload", "value": "baa49d1ca3c00cbb3983551163309fdb29d29d24", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779126402, "uuid": "1f92a967-f32e-4dd3-82c1-541a324fc4c9", "comment": "Malware payload", "value": "1b233242a7aa62a08a689f42fbdb150835b56d665c6fbb5fcca61b4f834e7f6b33f64e7664c6cc0224dab9badc7265b0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779126402, "uuid": "0259c4d3-a0b8-4651-b7c3-3ddc781a3c8e", "value": "T19257332CD4198397E47D84348DB6A5D6E3B7AC145652CC432722BBBAB2F27F432F2149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779126402, "uuid": "3d21bf88-2aae-4e8f-8fc2-87e835f6c6ef", "value": "786432:xjuCTU+6e6DKpi5qF08DktbEUSbYMYnCOfMwKy+7:YuKGFho7VCOkwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779126402, "uuid": "70f41828-381e-4ddb-ac64-55205741fe5c", "value": 28954624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779126402, "uuid": "4bd33890-7be6-46b2-b9c0-5993a568fd7f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779126402, "uuid": "3392147f-7226-4bb8-8bf0-972b24726c98", "value": "vc_redist.x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d424ae-5253-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779065403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065403, "uuid": "b0522840-9321-4ebe-802a-b7cc7b59f21e", "comment": "Malware payload (Mirai)", "value": "3360d490758fa5b2f2637e0af5b645e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065403, "uuid": "c68c5bfa-b286-4eb9-aaee-73abd1940f7b", "comment": "Malware payload (Mirai)", "value": "a94da43bdbb1fcdee40090d5db164c836ce7158276cf31394152d5ff7106ab93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065403, "uuid": "ce52bc83-8f34-4e65-b168-e961730b0bd2", "comment": "Malware payload (Mirai)", "value": "025f8d4628861f6ba25fc0f9ed81cdfb9807d820", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065403, "uuid": "5a11d596-5a00-4f79-80cc-db4cf992d6b2", "comment": "Malware payload (Mirai)", "value": "0ad0ad64d6e98618c7121d883400fa0a345f57db38584d2cd21824f91c990729feb6eeb0b530b079c1c970640403f91d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065403, "uuid": "a1085c4f-ffd8-4738-9c26-afac7635a5ee", "value": "T11773AE63DC326D08C15489B4B4B29E792363F4A482870FFB7AD5C66A9493EDCF5423B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065403, "uuid": "e95a938a-529c-4a65-bdd5-f78803cff615", "value": "1536:xy4Tu24LKsUe/E5wlHjwHKLKIJ7iHWYuCau2R9tli7:xy4Tu24LKfe/hHkqL5gWYusE9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779065403, "uuid": "2571936d-3ade-4c0c-a5ce-8a83e9f9f414", "value": 79684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779065403, "uuid": "e4a9c375-0679-49f9-9e6a-19fd776adcb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065403, "uuid": "f4da7aa9-a7b1-468c-bc1d-fae7454332dd", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574757b1-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089813, "uuid": "6b63d8b7-3bb6-4d3c-9b5c-c3ae9cb44722", "comment": "Malware payload (Mirai)", "value": "b2db5346a7ec22e785bc9b8b80117c37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089813, "uuid": "970a4ed2-0325-4c27-97bc-cc5c6e309e47", "comment": "Malware payload (Mirai)", "value": "a9dd40f43bfe6199d3fe6b6c607b1bd50ed811b09918cf00a74bfb9980a46414", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089813, "uuid": "28846ae8-502d-48ce-96f3-81eea255739b", "comment": "Malware payload (Mirai)", "value": "8667b1e02bacfd1e96f51dd346f8c0f9628ac397", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089813, "uuid": "a4e704c0-6069-4f75-a362-36629ae59d84", "comment": "Malware payload (Mirai)", "value": "3fa6091bf957ce69c4f5fe50820a2ea99a347ad852c4642725350a224e7fc6dd3979ff117ed2f5a7b1f629dcaa044c4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089813, "uuid": "f163130d-0836-4368-937f-aa240b54952f", "value": "T10613E16A231215AAEA91C07045F60B953BE64FE6D044DA0C3FD2D5908A9E2F83571CF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089813, "uuid": "61fa3f94-af7d-4ad4-a090-335103b2ca32", "value": "768:mVSrYS3JuIk8or7wskZ6BQucjRmHazJ1FzqoatCyZ5vAzG4JgGlzDpbuR1J2:m8DY8oXwsbQucjY6zJ10JtrtAzG4VJuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089813, "uuid": "9f87e77e-a718-4055-a3dc-e768bf4f1953", "value": 43280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089813, "uuid": "4e66c747-384e-430f-b3d9-9a604caeae62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089813, "uuid": "3c6795bb-7fa4-4720-ab23-3043ab7cf2a9", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64330420-5256-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779066642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066642, "uuid": "d16d0827-56a1-40c8-86ed-0d4a69739f3a", "comment": "Malware payload (Mirai)", "value": "6beabc210548402b46f76b6020f9ac90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066642, "uuid": "1cd71c42-ba85-4441-a0e3-41572bd10ad5", "comment": "Malware payload (Mirai)", "value": "aa471f443a6fcc97bdf7f4f053d4f01b8e7780a1e575611fb096ef0112ee324b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066642, "uuid": "adbfa5a7-2ebe-4ae9-898e-c3629303d245", "comment": "Malware payload (Mirai)", "value": "c6a12b89f0ce0562b2941d690f916ddd179aa8ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066642, "uuid": "f0936b02-2a6d-40a8-af02-146f60203c8d", "comment": "Malware payload (Mirai)", "value": "dbd08259513ca1ca3924ee715f15792a91da965520a435283c643a90d3d5c464870acd121aa3c8cc45ce2809653dd417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066642, "uuid": "f188a865-a8cb-42c0-ae09-58d2a2d95432", "value": "T16673022B514F4AB3D1F9DD33B00B7F30AE79A023E8E53F04F851A045AA1DDB66145679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066642, "uuid": "ab57e0dc-fa0b-4b44-a881-726e1b9fcd4c", "value": "1536:rOlDJ9nqHLw+ZQeuFvQfPbYGiNw7VI/rW0wvnEJ3gzE94e/ohOF2VborV:ypn40+ZsvaTYbeO/VwP/zE99/ohY2Vbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779066642, "uuid": "aeb17f3d-32f9-46aa-b49c-492463077323", "value": 74732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779066642, "uuid": "b28d85ae-5adf-4f0c-acf7-13a20dea72de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066642, "uuid": "5005d9a3-15ed-4e09-a551-0e7911e2b0e4", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa33f67a-52b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779109280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109280, "uuid": "0ed113cb-eb09-46f6-8966-832b4e979305", "comment": "Malware payload", "value": "643a62ab784d4a82fad7e29766136de1", "object_relation": "md5", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109280, "uuid": "20cc90f0-1d03-4ed6-94f7-380b1c60a5ba", "comment": "Malware payload", "value": "ab2df544db70a9af9ae70572c5eab2ec213a0e03544dca643719729f55f518c4", "object_relation": "sha256", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109280, "uuid": "3ebb2f29-eb2a-4072-b0db-b5f3d439c755", "comment": "Malware payload", "value": "2ce907a3cdc3df8825d49e9367a1f43fa83ccd84", "object_relation": "sha1", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109280, "uuid": "ebf4bda0-587b-46a7-bd90-ea416f0f8dff", "comment": "Malware payload", "value": "81f9343180edd668a6863519593bc155fb448b561e90bd4dd837cd9f02a9927ba66d626e640e221da4482a416238dba1", "object_relation": "sha3-384", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109280, "uuid": "7a8d50f4-fb5e-42e9-8f83-aaf91d9b5107", "value": "T1A8A59F57A3B400EDD163C2B8C9165607E772F81A13306ADF53D08A966F27AE51BFB720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109280, "uuid": "ad1fa3ec-1fb6-4559-b811-f8d750cf2023", "value": "af1fd296178dbd76922e2f31fcde60cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109280, "uuid": "faf1e1b6-185f-472d-ba52-900822c7a993", "value": "24576:EX2iYTGaOjjtTq8tQ6LXduVDTM1wzdN3A5P1w0+ldOb+o0TMfzuqBX8Qkn4xDAC:cJLXqMG/AXw0otu8Qkns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779109280, "uuid": "7e065085-bbdb-4742-bb8e-631c3b631e8e", "value": 2212352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779109280, "uuid": "072a8b8a-39c0-402e-9d00-1fc86addbc4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109280, "uuid": "c3336418-7ae9-4cda-99f5-ef4ef7251a66", "value": "ab2df544db70a9af9ae70572c5eab2ec213a0e03544dca643719729f55f518c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec731683-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144180, "uuid": "23f67608-c47e-4003-a843-c21839b99da9", "comment": "Malware payload (Mirai)", "value": "1db54838d702e32697d97c66e11b7d2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144180, "uuid": "fd9cd708-209e-454c-aa7d-0095727d17bd", "comment": "Malware payload (Mirai)", "value": "abebdc879a1a60ce9504fd3715e7521c1bd1e0c36f360ff8fbb207a97c465910", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144180, "uuid": "aadc1522-303c-4800-af8f-90b45f6fb1c6", "comment": "Malware payload (Mirai)", "value": "1e4c1f2f3b35b368ee0eccb634920cd71438af73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144180, "uuid": "9a84cf12-8c0a-4d86-8269-6171ad484977", "comment": "Malware payload (Mirai)", "value": "acf4b658a9cec7711f112b74e86ec275755388d86e1a43d8fa606763f13c6397e13f6db65a6d9d5ab1b0c196dc6358be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144180, "uuid": "08164f70-c8e5-4718-87ee-90da6b46b820", "value": "T19ED32A46A9415E12D5D732FAFAAE408933137F79E3FA7102DD205F5023C9A9B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144180, "uuid": "6ad6bfe7-3abe-41d7-a9da-7018c3f8c2ba", "value": "3072:7+P2y1xiqVpO4nnHfGxKWER3RsBcaJYC8E8ABgc4f3610uGjYHC:fy1hznHexKWEdRGcaJYC8Ebgc460TkHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144180, "uuid": "ef03f60c-e338-4ed6-909c-c7ca667a940c", "value": 135532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144180, "uuid": "20aaa9e8-6ca3-4b99-b342-d09286ca823b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144180, "uuid": "07611c85-9fbf-4067-a163-51d991a99ed6", "value": "heilong.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aedc4e1-52d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779119938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779119938, "uuid": "3deadfd1-eef3-4079-8fd4-0afd5df2e3fe", "comment": "Malware payload", "value": "c352f70ccd001d0e21accdd96ac48072", "object_relation": "md5", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779119938, "uuid": "b46b4c09-6f64-4af6-b980-1ec80b1bcfb7", "comment": "Malware payload", "value": "ac6f79a9986bead7133a4747891c44996b1619d85f7fc46e1c14364abc05ac9a", "object_relation": "sha256", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779119938, "uuid": "c8f88e5e-1262-418d-8d98-59c16a9b9106", "comment": "Malware payload", "value": "bf935f49dfd9de31ac57972a79548675f2cabd12", "object_relation": "sha1", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779119938, "uuid": "6d403d0f-d87a-482a-875e-dcc003361e18", "comment": "Malware payload", "value": "02e636a3724c3cb437420b93211da008b31f7ad1c926fec306c0e8699b7f0b750991dea2173bfc160b66e2b02f1c1585", "object_relation": "sha3-384", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779119938, "uuid": "68c293b5-f799-4d97-80de-08ca11345ebb", "value": "T1685733ADB824491985E920653CF31826A609F9BD2E70FAB31BD3F35DF37521D2321E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779119938, "uuid": "d44fbc0d-655a-4abc-a49f-2a6cb849a778", "value": "786432:0DTvKMB8CM7NV1XgK11MZbAr3LIeraQX9KWUUYu:bk8nNV1wK11cbSLIerau9K/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779119938, "uuid": "303f2a7c-2361-42f5-9eb0-61f0b891b095", "value": 28078345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779119938, "uuid": "714c0929-c307-41ba-a702-560ec5f04a8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779119938, "uuid": "c2be295c-3179-4650-88b6-474cfb1b20af", "value": "05.15Statement of Account.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe094d0-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120913, "uuid": "a5392002-468a-461d-a434-b496a8469466", "comment": "Malware payload (Efimer)", "value": "5ff9341d4d2c3515d71ef63c8e5c4019", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120913, "uuid": "788a66f4-aa98-402f-9515-01c8e18171b8", "comment": "Malware payload (Efimer)", "value": "acb85de01521d66644da5bc04173d425f199a37f78137e89024fdefc8e0b626f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120913, "uuid": "1d19a084-51ff-440a-bdba-4bca9d5ce247", "comment": "Malware payload (Efimer)", "value": "4ba9dfc749085cc1fca3ac52a5bae2d08ef05f7d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120913, "uuid": "a7d78408-9c66-4366-9fcc-f8818b4b318e", "comment": "Malware payload (Efimer)", "value": "ea4c6c872f6721e425e634aafe5df937b2b39cebfa0c247dbdba16e22e6f7d83af235517ab892a858b6a457774604e64", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120913, "uuid": "c9d7b83e-935b-4ee0-901d-4ff8420bd2cc", "value": "T19FD6332C89D750EDC36F9170BED16AF0F87871512A7D4A6F4BA8E3B2AD67040C91C85B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120913, "uuid": "e0881d8b-4d1e-4c18-83eb-55f3e260b959", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120913, "uuid": "5dc96921-1b44-4063-944d-df7b7a3e7e38", "value": "393216:F8dLWF6Td66Qe7Af8A7XMCHWUjXccuI3/PGTAI:F4LWHe7AkA7XMb8XJH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120913, "uuid": "b590a021-8299-4e19-8b4a-aae5498c0712", "value": 13823347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120913, "uuid": "5cc49b54-3d92-4660-a099-1ffc090010be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120913, "uuid": "55cc6a65-42bc-4d48-844a-9e0fe70b1c13", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883b5894-5251-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779064555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064555, "uuid": "551d4d59-bb59-4528-8a4d-5f4c96087219", "comment": "Malware payload (Mirai)", "value": "8a3a2f01812ffa7f6030920330e14ef9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064555, "uuid": "5ee4374d-84e0-48dd-b3a5-c083f5b86803", "comment": "Malware payload (Mirai)", "value": "ad5321bf0b55b159b503001e39150f3b14529a217321fa5b1c96d9d442444b64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064555, "uuid": "e62dab37-16ad-4d40-9fd2-13aab62cbfb5", "comment": "Malware payload (Mirai)", "value": "6b2d0b9dd2dfb8f4a9e9a4047c6db14fe7cdef67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064555, "uuid": "33fe545c-476a-41e7-b23e-2dd47b69f3e8", "comment": "Malware payload (Mirai)", "value": "4eadd9910bf1b4bee034c77c88fe29d9de1152380af3efb1aae5320c254f73bd7074178173a6d6c8b4bcadf2486e0903", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064555, "uuid": "cc54f7b7-63fa-4027-93a1-6fa7e94b9022", "value": "T11153F8837A41CA77E14320F112EA9F221631FE3B6862E55FDB957C71DB242C0A62277D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064555, "uuid": "712dfed4-040b-4446-88f2-6e6213b21b5a", "value": "1536:6k2slYQOSak8ixXolLvRgg8HWw7FetZ8:6k2slYQOSak8ixXyLv6g7w70Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064555, "uuid": "5d636ef5-34f1-412d-a129-93bcab739890", "value": 60896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064555, "uuid": "9edee1c7-0743-450d-b372-ae4206085c81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064555, "uuid": "a43cd5cc-c0f3-44c9-b653-a55ea3e192e7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f060c3cf-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120564, "uuid": "67220bd0-603d-435e-addf-eabbd48b15d5", "comment": "Malware payload (Efimer)", "value": "5897d115493f487b065d3656c9461816", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120564, "uuid": "60884ad1-e3ce-4ce5-997d-e4a0c2a767de", "comment": "Malware payload (Efimer)", "value": "ae2279f98e5aae9a3f957c9f863651712d7d90e72d0695ccdb0543a3b4949a40", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120564, "uuid": "8e4c9b4b-f594-46e2-af59-7867fcd1eaec", "comment": "Malware payload (Efimer)", "value": "6c1b02a75a2f169be4ccbdf2a5fdaab57757f569", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120564, "uuid": "629da1ae-6b25-4d4c-838f-55e468861997", "comment": "Malware payload (Efimer)", "value": "624251210498a148366378df78bcfe96ff91435f0008afe5693d4ae988ebfcecd6b20aa425e0166fd4ce6913f670f37f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120564, "uuid": "a32ffb0b-1579-4ef8-9172-f27ca6b29449", "value": "T185D6331875E660DDD673D0B4AFE26AF17468342403358D2FD724C3B8ACA72B4DA7942B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120564, "uuid": "a716ca8b-5dce-4cfc-b40d-b93a89754a67", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120564, "uuid": "d89330f1-92ff-4ff4-b74a-3eece859b63d", "value": "393216:3pSmTEdzSWYz8WH7UxKXMCHWUjX2cuI3/PGTAI:ZSmTEdzrYzgxKXMb8XLH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120564, "uuid": "a9fa26d4-c890-433e-ac6b-8e3855749d24", "value": 13839694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120564, "uuid": "ed7ec222-9d46-4119-b76e-f93604256ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120564, "uuid": "3fe1ad2b-2105-444a-80dc-e53c9a529791", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d6220e-5294-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779093239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779093239, "uuid": "4e60ed99-c83e-4b34-98b5-85c5ab479f5e", "comment": "Malware payload (AsyncRAT)", "value": "bd70f4ae62b55869b24a0f7c3d256d99", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779093239, "uuid": "710bc754-a215-4a89-bcee-9d1954c6795f", "comment": "Malware payload (AsyncRAT)", "value": "ae66a1886568773ce378dee2b63c4eb3a4d4a2ce0b02dfecb378ca069d9710b5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779093239, "uuid": "bc6be4c5-04b3-4e36-917c-1b14aafbd723", "comment": "Malware payload (AsyncRAT)", "value": "32bd40efe15848e4bf8f31407e0a6348594dea5a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779093239, "uuid": "83e81795-2cb8-4bb4-b10d-11f784f85fee", "comment": "Malware payload (AsyncRAT)", "value": "5827fc20070acd1a4dc123b3431e9ba99d6671b74f711d6bd2414d2e5bbf740173bbb10f296b7483d466de63e2b71659", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779093239, "uuid": "dbbb9a8f-ab4d-46de-b3b6-eb1bce07610e", "value": "T1B5634B1077CB8226E2BE8B7448F263454779F3673A03E74A2CC411DA9E23BC65F516E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779093239, "uuid": "924dff3d-ec25-4cf3-b019-c41dc27f54fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779093239, "uuid": "e31ff898-431d-473a-88a5-9b80a956fbeb", "value": "1536:U4WEOasVzwxKCh/3TcvOhQio+Q0eK5v/nd7Dtu5e9R:cHkxKmQAro+Q65v/dHtumR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779093239, "uuid": "cd18abfc-c278-4872-9a4d-86c7e8ba5717", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779093239, "uuid": "180a77ab-a8c5-4c10-b2e5-285e94b73c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779093239, "uuid": "1672f33d-4513-45b9-9a89-f8cbfa66f3cb", "value": "SYN-FLOOD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9cb280-5283-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779085849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779085849, "uuid": "80779206-294d-4526-a099-1d8a6f346fbb", "comment": "Malware payload", "value": "0587f0dcce6794b1024e2c071c4af47b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779085849, "uuid": "2b0d8281-d887-4978-9657-d0827d68abf1", "comment": "Malware payload", "value": "b04755491492ac37d898dae7ade6c3707379f302c5e62f318cd8ceb94a60d7de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779085849, "uuid": "0b6fbb6a-c37c-4997-86d2-12773a93a7ef", "comment": "Malware payload", "value": "e1e9de51b621bce4955b3daa085fecc8a62d9ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779085849, "uuid": "edbc225e-7778-4087-a2e8-e8f513f15b8b", "comment": "Malware payload", "value": "b00bbe46fd066b860a60d11a847e000c2db53d3e93f37f3760912aaf26658b2aa55bb9c573e6b649ebc55f030a12349f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779085849, "uuid": "dc42eb83-d06d-4c57-9a34-c1b9651531d7", "value": "T13FC68E06B3D446A5D466CA30C62BE733CB7DBC650A35C35F1916E3C92F33B918B6A225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779085849, "uuid": "3e630341-874d-4131-aa4e-74f0f5f031d5", "value": "7a7691e14690847075373b415cc758cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779085849, "uuid": "fffb02ee-8368-4561-8283-2acf428bec01", "value": "98304:IImRyhOn48SL6hhKdfxWDRGR8j+h84jKI8Z2Onf0VigyHVsL6k:7mR0G48SLChC5WNGRB64jKI8EqVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779085849, "uuid": "bf6dbc6f-8b5c-4bd1-a260-a3cdfdb352a0", "value": 12417024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779085849, "uuid": "99b08c8b-8cd5-4047-b211-6c425cfbe754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779085849, "uuid": "e20cc820-c345-4cf0-8f08-3138c35acd79", "value": "jli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638ada14-5252-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779064923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064923, "uuid": "8160ea12-fd88-4a1e-a1d5-51fccd12b0e2", "comment": "Malware payload (Mirai)", "value": "7cf0c025a750846a71832871ca77e54d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064923, "uuid": "83029db0-3f9f-4b1c-ae87-4eeebf98554a", "comment": "Malware payload (Mirai)", "value": "b05b5b535f82ac5278c8d97f4dffad2fae85520fca637fd338c77282eab04463", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064923, "uuid": "6c0691ee-f4c7-4e5a-90ac-b91e165b0bfc", "comment": "Malware payload (Mirai)", "value": "a682b9fb44eb9c61b136783a0a33eb480718c269", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064923, "uuid": "f48867bf-abc7-413f-983f-d0decf781c1a", "comment": "Malware payload (Mirai)", "value": "e13fddf134608f7d6a548bea45ebd7a7ee93b46e3bf81e5d64b3e5ae9819b6f354f38fb698bcf75661e856319b247206", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064923, "uuid": "64ffc50b-4f66-441f-9c5f-c9656fe9ccb6", "value": "T184B31B41BD418B13C5C21BB6BBDF47593B22B664D7DB3302AA197FB42F4369E0E2A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064923, "uuid": "78f1ef43-96f1-4858-8f37-229514a1e7a4", "value": "3072:sIgxmbKSJABKCyoQ8wUOnCU5nGBtwzNjMQNBxWUCx:FgYAyodwnnCU5n3zNjMQNBxWUCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064923, "uuid": "3940d292-4748-4085-896c-405f37ca0b59", "value": 110222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064923, "uuid": "4d5194b9-92ba-42b2-8c36-bd0ed74d18c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064923, "uuid": "ee64fe28-73db-4d1f-8987-a814c3091dcd", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a59463-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144187, "uuid": "e89b45a7-56c2-4519-9eab-fc13889b485b", "comment": "Malware payload (Mirai)", "value": "85296380c5f3928ad93be46cd43c9813", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144187, "uuid": "9208ac93-87b5-4b12-ae0b-ab2aa913ca37", "comment": "Malware payload (Mirai)", "value": "b0a1082dd3c2f248d24759937d6f87e2899200351243048e990dc37f5dc46a9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144187, "uuid": "fe68743d-de02-4366-a249-adbe22f79a17", "comment": "Malware payload (Mirai)", "value": "c89765310b24b8d1cfe8777edfd4dd6f025bfc8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144187, "uuid": "b800d559-bb57-40d6-8158-980d1d6d8de9", "comment": "Malware payload (Mirai)", "value": "67eb5d3bb21dc7ccd381fa0c1af65f732f93628c4a639ba741a0d1d03834d90435716a1db549ab921807ec12a18851c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144187, "uuid": "4a6ee3c0-7073-47ba-8a19-900b4bd3ea56", "value": "T10CB34D02731C0F47C5A75AB02E3F57E1A3FF999021F4BA89251E9B5692B1E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144187, "uuid": "02c5cf8f-f50d-464b-ac49-e61cc234fd3b", "value": "1536:bL8aGHx7rZazxJWsvNW/GHogtC4srA3+LzK9HqfYLObJqe4KwgmkyRwPIeg5:bKKNvjoUsDCOb9djy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144187, "uuid": "5bc6962e-c21e-4d55-aff4-6cbfc89968d1", "value": 108024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144187, "uuid": "739314f7-a11e-4908-95dc-25d4c5745382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144187, "uuid": "3ccd74c4-9122-4d3e-a99f-cfe2621bdc7b", "value": "heilong.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d74516d-528b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779089314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089314, "uuid": "68e0643b-babb-4da0-88ea-23ea27bfe258", "comment": "Malware payload", "value": "215ce89effe6954de0e46c4a6129e6b2", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089314, "uuid": "837c5596-9be9-4fa4-9532-96c14c71efd2", "comment": "Malware payload", "value": "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089314, "uuid": "2fdfc45d-1a9b-4713-b0c9-dee7ed2ac9be", "comment": "Malware payload", "value": "e54fcae53c44b877b493c836f4cef7e2b820a135", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089314, "uuid": "956c2dc3-61ae-4358-bb79-cae249eb23f3", "comment": "Malware payload", "value": "5978e087e63d8588e6c2f99d039212459aa07e4e0a2b12feb2137b561c622136847a3cf66ac7aabfe9a700bf92bdbe66", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089314, "uuid": "ab6ca134-d196-41a5-9edb-613199881a26", "value": "T13BE533D55E6B42A8E27710794DBC4B038D3AB9155CEAF3C92EAB54060D264CBDF7CC81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089314, "uuid": "1858c3d8-8c6e-49be-8892-999d4b3b36ec", "value": "a54f945f28df53b25b7a9cf01becbc39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089314, "uuid": "5bd8a024-8984-40ef-8971-be80cde1cbb8", "value": "49152:yFZ8f1Gxn5Mck3ou6PAHPnFv7OYWYaC4WBvrn27pBamjvhqnSD4MyM6BqAOI:NUx5/Mj6P4nMYW1CXj2LjvhzyMbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089314, "uuid": "0f640165-2c62-460d-84c1-145247639576", "value": 3027880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089314, "uuid": "33d56f7e-0bba-4fb2-9bd9-1b01db326afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089314, "uuid": "932a933d-d9d8-4bc9-a663-a68b476548af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3d1c0c-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144176, "uuid": "6c9ae111-0468-4e6d-946c-7b51fe9a67ed", "comment": "Malware payload (Mirai)", "value": "09fe49f2dfa5da27d804b27075f811e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144176, "uuid": "c6066e38-77d8-410c-9a27-bd65d715a7d9", "comment": "Malware payload (Mirai)", "value": "b22a57ab8981636ffe6475e998232d33a861957ea8568a2d97559413a1705865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144176, "uuid": "cb1c40fd-c2cd-4ae8-98b9-886088083013", "comment": "Malware payload (Mirai)", "value": "805ab40ed483002d1ea62ca337b57e8e2a003681", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144176, "uuid": "0f297895-9c4a-4a8b-95ab-0f80a9f55591", "comment": "Malware payload (Mirai)", "value": "9d3221a5b1c6422950c1f8fc1e4212fc526a0128256ac9ad6e736b68cd3694e953d8d74df4a87ef51ee85775edacafc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144176, "uuid": "d4ed542a-d3cd-47b0-9747-7c82d3532986", "value": "T130B34AD6F801DD7DFC0EDB7F4457050AB621A36216935F3A6397BE63BC310A46922E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144176, "uuid": "0bd427b4-9a32-4495-81f5-2b8dc11d728d", "value": "1536:e/Fd8W57sFSZrHZVjYMVsHzBso1K8FJBGxtjovb5c/nLa17AuQJCPEA:QFdti+1VjjsHlso1/BQolKRuQJuEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144176, "uuid": "393b56c5-700a-4993-9556-0948d588a77d", "value": 114956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144176, "uuid": "37ac170b-61ad-4577-85d2-59f08fcba911", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144176, "uuid": "b6e4e115-2d27-42cc-a168-adb8a093dca5", "value": "heilong.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ead9c78-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1779089906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089906, "uuid": "1d21258d-227c-4969-80aa-7343998fa751", "comment": "Malware payload (PureHVNC)", "value": "fdb6155265da39d020e013af1124e5c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089906, "uuid": "3c79870d-4537-44a1-950d-6c647f98ac94", "comment": "Malware payload (PureHVNC)", "value": "b376d51a69b661d9c360f22562b48fbe1733b93429155a3f9a06b07721051c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089906, "uuid": "4346cfed-bb7d-4008-af41-d84201f57e90", "comment": "Malware payload (PureHVNC)", "value": "d8e0d3bb9356f0e868bc6a2269a450c0eb8846cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089906, "uuid": "b366a9c1-4cb2-4de0-b082-e7fde74011ec", "comment": "Malware payload (PureHVNC)", "value": "9eac327987e951e6159ea6f2622ef620dbe84c52f7f7c5fe8320b41b975bc3114056a24aa6d012e440e7717d00619d11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089906, "uuid": "0cd430e9-8c46-49ee-88ee-0400e291e24a", "value": "T168452224725CCA03C86667FC09B5E3B613385D8DB924C6865FDEBEEBB438B250924357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089906, "uuid": "87286fa4-695b-4f32-b4f5-15e4b88672b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089906, "uuid": "93f85560-e52e-458c-9ae7-ad525109c19c", "value": "24576:IX6r9ARyjkfYEMY96VDkKq7Y89xeV3/xVxkMPZ1InwoZiKQFqTqsPivg:Iqr+akQc96Vglfvu3/xVOyqi9Jah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089906, "uuid": "b2fef753-b3a9-423e-b03a-0457d43ad75f", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089906, "uuid": "1cc88a2a-cc41-4f0a-9519-707dafc18f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089906, "uuid": "59a77c73-9532-4862-9fa7-d6a0590b2207", "value": "fdb6155265da39d020e013af1124e5c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181ad550-528d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779090137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090137, "uuid": "7bdcc9f0-42f8-4b3b-95d7-c26d7f08da37", "comment": "Malware payload", "value": "4a7b088ec76c2513432901bc9616d675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "steam", "colour": "#96A986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090137, "uuid": "b7a32231-d39f-422b-aafc-abf19c247151", "comment": "Malware payload", "value": "b37cea499efad35ff5af7e73f34f17840c2d14dd6cd21e3345d22a39140b4d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "steam", "colour": "#96A986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090137, "uuid": "653eded9-3fb0-486d-a15f-e5279adf98b5", "comment": "Malware payload", "value": "8c565b0f63b9b9cd4dea00fdc251ee1461e92564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "steam", "colour": "#96A986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090137, "uuid": "97fc2fa4-5f9b-4323-a1c5-7b0714d77bc1", "comment": "Malware payload", "value": "8479bb6ed725079e635cc8377f49ea53742024671ac3dd555c7ffe3b3efc3e5c527d2e1dbe3f7d305cf751f62f376e97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "steam", "colour": "#96A986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090137, "uuid": "8b8d2942-623b-45fc-ab7e-ab133ae98350", "value": "T14C76301023D95B47FD3EEFFD858C77914F7AB6A56741FA68AB4009DD0AD2B08C903892", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090137, "uuid": "44373607-e9ac-42fa-a3b7-cc3d997bdd14", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090137, "uuid": "dfc45f05-5592-4faa-9ba8-d77ec86936db", "value": "49152:QLze6/+W8eBQSDr/2YmogUAjeRUjenFbRUCiem9bh/76iIULoYljvO/Q:ue75sRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779090137, "uuid": "fa4a7d57-c993-4a28-99fe-2f6469b58277", "value": 7819776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779090137, "uuid": "f46cb38e-d0e6-44f5-833c-67e6c39e9244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090137, "uuid": "012a114e-b004-461b-bbe2-f9674e2ad7e0", "value": "UnityPlayer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6a9add-5277-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779080861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080861, "uuid": "f96b3823-dec3-4ce3-bc60-33313b6de03b", "comment": "Malware payload", "value": "414a786ae99347c7a309a27a91d6477f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080861, "uuid": "d63c43ed-8d5d-48ed-b7be-8e43482159ac", "comment": "Malware payload", "value": "b3873488f3d00cd6068868e990659491aa5f750e27fb2194dd8d1209a6d1c30d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080861, "uuid": "b628cf2f-d330-4b56-921f-b493f7208e9c", "comment": "Malware payload", "value": "1e3a8c98b530c3821999197eb89d0c79d897caa9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080861, "uuid": "046d3c0b-b7c9-42f0-8ea5-99757665332f", "comment": "Malware payload", "value": "e1aa20569b594e68abde0de00e758a22021bebafb40ed7e4342f0f51850e00dbf8a33ab9f490ff14b53670a6f29afcf4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080861, "uuid": "0412b194-d618-42a6-aa7a-7c306b93cd93", "value": "T16C35DA29C7E4400DB5B68E50BDB5142FA4777A232D1ED86F1281094F4E72A0DEB7A72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080861, "uuid": "eecefd8e-3b8c-42f4-b9e2-9bed5f5c8652", "value": "12288:9VryQ7vj8pK9y6Lm+tLQ3B3enofMWsz9BB1jtYgsqDoKMRqD8X7XtC:gK9NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779080861, "uuid": "1701f5d3-9d12-4cb6-91a2-3a2b63d0d4ec", "value": 1066840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779080861, "uuid": "8b918bdf-f8dd-41c4-a242-f6a3303297b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080861, "uuid": "ec9bb840-2f21-4bb0-9b91-c0f44ffe42c3", "value": "Overdue Balance Invoice...9709554310996067_pdf (~168 KB).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6c26fa-52a5-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779100828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779100828, "uuid": "15d57b5e-4258-467a-b863-67b7dd026bbf", "comment": "Malware payload (ValleyRAT)", "value": "586246a1b852db9a61c61aabb92e7dd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779100828, "uuid": "09e24794-e9dd-4f9a-8b8c-6c19a2b36c30", "comment": "Malware payload (ValleyRAT)", "value": "b3b3238a610a321434e4f3b21fcd98efca7a2569de4576ec15702f1ebf810f7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779100828, "uuid": "06e6b2aa-4274-4813-b1c0-97dec7b6e526", "comment": "Malware payload (ValleyRAT)", "value": "112b3640655d4b223b4fa616e367527509c18fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779100828, "uuid": "ef452b3e-e494-4e8d-9acc-1483e7840ec2", "comment": "Malware payload (ValleyRAT)", "value": "959f92c39375549531dc9fae6529a28bac7d81f9941f2d28631fc93a077125892dc4c9a20fa7ba4f3b275cc1359a413e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779100828, "uuid": "594a8e8f-7a09-4fc3-8e9a-9569b08752bd", "value": "T1CC168D43B2B55264D5B7C03C86E38616E5327C468B246ADF1298A7592FB3BF05E3F318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779100828, "uuid": "3e46a3c9-416f-46da-b412-d2d09449d5e3", "value": "f7f8c98719cb8e09bfd5fa0a42807105", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779100828, "uuid": "0d65c723-d053-4e9d-bbca-93b5212c5172", "value": "98304:AXxtKzBodKdWv0QJsv6tWKFdu9CpiO4/:yykwQJsv6tWKFdu9Cpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779100828, "uuid": "dddc9452-d5b5-470a-b35f-19d469b50a3a", "value": 4332544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779100828, "uuid": "fa4272da-0eda-4dde-88e2-a11df4f9440c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779100828, "uuid": "8bb18964-8aad-428f-ad60-12fb50a47004", "value": "2026\u5e74\u00b7\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u8fdd\u6cd5\u4eba\u5458\u901a\u62a5\u4fe1\u606fpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d360ce59-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120945, "uuid": "76344238-87d9-4cd0-a9d4-4b2d1ea008e7", "comment": "Malware payload (Efimer)", "value": "4a9d9757c904450285a13b76c862d2e1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120945, "uuid": "1a4ee631-c7e8-4ad0-84eb-fa4d32c3a056", "comment": "Malware payload (Efimer)", "value": "b41f556d59b4f2e35383af0f012bb263263fc7f0ad8a869d3ad7a51f09795b5d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120945, "uuid": "348d60a2-1e00-4af0-9347-4f4488228ac6", "comment": "Malware payload (Efimer)", "value": "0cd5cc262e474745e5f2bbad086856bb9c7dd1dc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120945, "uuid": "d5fee6fc-adaa-49bd-bbcc-05f691c1a6cd", "comment": "Malware payload (Efimer)", "value": "7e07f71d56f29a51854c489d1cbac4e90780d3231455011335f6a3be8caf807fd669234dab0d27e31fbaae3c3674b6f6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120945, "uuid": "efbfb86a-c435-47bf-9195-142449c73109", "value": "T1D8E6331980D171ACD7F6E630BAE1D3F4F0A4B4742B748D77A7A5C764AC1F2A0A81D81B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120945, "uuid": "a45a3564-df66-4df5-8e75-f55ea3a015ad", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120945, "uuid": "6f4c4290-96c9-47de-9c5e-752ea917d1ff", "value": "393216:MW4mm3NCoS5MFY84i1hPuCW3qZeXMCHWUjXScuI3/PGTAI:MWI3SSFF4whLSqeXMb8XvH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120945, "uuid": "bdea38f5-6a0f-4ce9-9455-f42efc4fc01d", "value": 13881486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120945, "uuid": "74b659d4-79ff-467f-b63a-e10429c5e359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120945, "uuid": "3b37708a-667f-4774-bd26-171364d82888", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4168a9-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144185, "uuid": "d76e78ba-5917-46e8-b4e2-83aa09513673", "comment": "Malware payload (Mirai)", "value": "5492b206e7dd627c03d4048785b121f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144185, "uuid": "53e962b2-9391-46a7-ab78-2d4b93ae5765", "comment": "Malware payload (Mirai)", "value": "b425b081489f914e4c236114f4be7f0f745f4861a87963005fcbb2ba0a11567e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144185, "uuid": "ab52e463-39d2-4ce3-9685-aad73409f3e1", "comment": "Malware payload (Mirai)", "value": "dac4ee04d7e795130f6756247442735c8e9ad3a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144185, "uuid": "1c563b84-901d-45ee-891a-dfe3f4f405ec", "comment": "Malware payload (Mirai)", "value": "db7615e199aa9653dc18a66bd7a7e229ae054f45629b19eadb6efe99c8543e8fa48e7a4b26fd88c4e125cf197bde8236", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144185, "uuid": "768d7685-46b8-463a-b3da-d2b051d828ab", "value": "T1EDD3E71E6E218FBDF769C33447B78E25A39873C622E1C641E17CD6115E6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144185, "uuid": "d8811b3f-efa5-4811-8036-495362ae7475", "value": "3072:z0SBJcnFwP9oYCz0i2+6dw9BaFZnugZQeAgC1:vJoFwP7Cz0iRicF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144185, "uuid": "11ad7d73-29ef-4abc-8680-bae18fca601c", "value": 138292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144185, "uuid": "b4f5d124-b12e-4608-be9c-9c8d5e7f5555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144185, "uuid": "93cf30d7-3cf4-433a-9392-fec930fa3da5", "value": "heilong.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ab1d0d-5251-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779064682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064682, "uuid": "97f3ef49-cbcc-436e-a0d6-b3540c5f4ed5", "comment": "Malware payload (Mirai)", "value": "515039a07a1e01b98117c264f825bfc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064682, "uuid": "b640341f-36bb-4e67-89b4-55cf6cd200eb", "comment": "Malware payload (Mirai)", "value": "b47494d1bf71d36cd689e11d4620e61748a91199431c5bd3ac8f3e50879e1b6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064682, "uuid": "8df881c0-eae9-4f01-9584-0cc296d55ae3", "comment": "Malware payload (Mirai)", "value": "25df05957e5c51034d5fb04bde22563af0281715", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064682, "uuid": "ee0f3f3f-5196-4194-b4bf-2d4f29a6b4d1", "comment": "Malware payload (Mirai)", "value": "2850cad3c84fdeadbe50d0d389b8dfbbada041d438cff9a318f499c25f2fa01cf888139947ebfec41ad010c037d932c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064682, "uuid": "bef1cbb7-5948-41ce-91ef-d01b089fb207", "value": "T1E7B3080AEF610FFBD82FDD3746A90B0535CC555622A97B3A7574C828F64B60B0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064682, "uuid": "27e01721-bec3-4c33-ad94-5f129d594a34", "value": "1536:+SJaHPmDQEznZeD+qw4/hZWgYuncyEZFe2EqvJMRDzocEtophS/:+SemDBADpVogYqEOJSopA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064682, "uuid": "29827539-9d7d-416e-82e2-8c7da991811e", "value": 110736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064682, "uuid": "2d23ac60-a34f-415b-9574-970f8aff66fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064682, "uuid": "e58a1575-274d-4a37-8ad1-2819934ec42d", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037a73a4-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120597, "uuid": "97846720-b662-4d54-b26c-f11c411f0278", "comment": "Malware payload (Efimer)", "value": "e0327e867476f006e6c95580714a714b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120597, "uuid": "27a4ec99-25ea-4091-8047-3ff400c5e454", "comment": "Malware payload (Efimer)", "value": "b6dfb0679407680e9cb74e56bce255a7b687269d46683127a3aba7b279e68f05", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120597, "uuid": "cf5fb732-9e7c-4b8c-930a-ecc6d10d9268", "comment": "Malware payload (Efimer)", "value": "7257629e9e9ce76760798e9d7c3d9bb6cd1725ee", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120597, "uuid": "808c31d6-26a7-4457-819c-6152421f65b3", "comment": "Malware payload (Efimer)", "value": "1df536db6a62637ce6f7c735c576972fbcaaa86e5b0d9d90312dd6fd5a97c273773552bc27fe99adac0229ecf9d045fd", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120597, "uuid": "6d3bf3ec-a56c-4ce8-8e59-719024579f35", "value": "T10AD6330599E362EFC77B80B87AD127F1B4BC70B415F6E92A7658C1339C23199E52C12B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120597, "uuid": "e4a04101-eda7-4adc-a8a8-1e569b74c413", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120597, "uuid": "1dc6e6c1-9f00-41f6-aec8-10a712b1ac4a", "value": "393216:owxBekut7XX4zaw26XMCHWUjX+cuI3/PGTAI:owfPut7XX4OAXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120597, "uuid": "3d74c279-0690-47f9-8c77-083e9909ee8a", "value": 13866851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120597, "uuid": "696b6df4-1477-4704-81af-dd31801e4fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120597, "uuid": "e6f118a6-7bb9-4808-b522-1f5060be5762", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8c9b8d-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144184, "uuid": "e470cfdb-5f26-4fca-a4fa-d53bdaf4787d", "comment": "Malware payload (Mirai)", "value": "872b5c7669100bf656a17ae8e3791b3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144184, "uuid": "a874da86-07cf-4f83-a81a-fac9aa918be3", "comment": "Malware payload (Mirai)", "value": "b8909a8202dd22cb99cb79afdb87285c63d3834e7041ddbdff80533e93922a70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144184, "uuid": "36ad9fed-4b79-429a-91a9-0007f7cd22d4", "comment": "Malware payload (Mirai)", "value": "cd9b003d94d6cd48d1ed5289499c6f0ebda1e3ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144184, "uuid": "02a0fd2f-8f32-4690-95c8-b084cfb780ae", "comment": "Malware payload (Mirai)", "value": "8671369a33c2259c1b9c38a55b357051ab9aa8c99e12dcb027989a5231196c30aa6ec91e342a52ad3490846e3fd716b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144184, "uuid": "ac4cbe58-29ec-4bb3-b9b7-a87911a4a74f", "value": "T192D30816FB210EFBDCABCD374AE91705258C651A22AE7F367934C928F44B15B16E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144184, "uuid": "a6acf706-e2f0-49ca-868b-88adf7d6b519", "value": "3072:NXj17Jo82I/GFSiPep063ec51hER2jPrtz:NXFLOPX8zxERWJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144184, "uuid": "0cfc5068-b9b1-4efa-a126-d7503bd48cb0", "value": 141604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144184, "uuid": "2e8587fa-4e4e-42b0-8fe0-824c8ccf2c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144184, "uuid": "291438a5-17c8-4b17-94fc-6c9c2c0ca092", "value": "heilong.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c316c60-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089875, "uuid": "fc2de14b-ac4d-460b-ad97-a1a19386d89f", "comment": "Malware payload (Mirai)", "value": "8a568b26fa94de0120063246a9136bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089875, "uuid": "efe70ed0-f4ac-45c5-9cd4-ccf5a5c355d9", "comment": "Malware payload (Mirai)", "value": "ba9e8b202083dedf8c3693a5cc7b51dd688f2fc45a93e8a95e5e5026b39c68ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089875, "uuid": "be8428f8-0d87-4aed-9ea6-a2b850690ca8", "comment": "Malware payload (Mirai)", "value": "0eb9ef4e2034509036c7f28b13bfacf5a07a82af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089875, "uuid": "9f4085ac-d896-46c0-8b06-5ef7795a6684", "comment": "Malware payload (Mirai)", "value": "f968b6a8d213f49003d2ba922983de1350c60ec86bd07be67b2d7e6d7fec6d3447a6b858e58ffebd6ae22ce12dafbd48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089875, "uuid": "6f069ff8-b4cc-4a7d-b09d-4654e62f243f", "value": "T136833A47B98190FEC499D03847BF7537C923B4BE1239B29B63D4AE262D09EE01F19746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089875, "uuid": "63d7c335-96a6-4ec1-98a3-848778568049", "value": "1536:MqbF7IdAcsgpY+HqqWEVkCkj6Rv3U8GbdGrAyvQ9ol:TF74AcsgphqaVkCdRvAbdGrXQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089875, "uuid": "c016357e-ada8-49bd-842b-72b66d3b70d1", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089875, "uuid": "a660dabc-8fb4-49a3-af2d-671f5a94f01c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089875, "uuid": "c5edda62-bc56-44a2-a580-901007db2710", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4db0dc7-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779120438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120438, "uuid": "21556717-31f1-471f-aee9-70005214780f", "comment": "Malware payload (Prometei)", "value": "aad218f631a2c028f951a58de4468129", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120438, "uuid": "63c8f1eb-25b7-45c8-88c8-bf543ce2148e", "comment": "Malware payload (Prometei)", "value": "bb1b5926be84d447551a974f553a169cf4e837d4d98591acbdcddeed8cc7bfe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120438, "uuid": "8520c244-8787-4164-9af7-9585e4f6d66e", "comment": "Malware payload (Prometei)", "value": "e39791b9e86b8f7074356bb224257d89f630e7f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120438, "uuid": "2a6ebd73-685c-43bc-84a4-0b3145d932fd", "comment": "Malware payload (Prometei)", "value": "0fad6dabff7f14efc9e624a9e4f27358d346b974206dca4bff9ab679f2c32d5f98dc09f7e6fd59775be8b23937ac92cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120438, "uuid": "efc280be-4bd7-4b55-85de-d3d377ece5dc", "value": "T141A423B4F9219E8F6DD769B91B24831DE181D172589D4C2313AE94E34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120438, "uuid": "aa3c03a5-df0d-4594-a6df-e10b013dbacf", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsde:Fs6pyCC/Ya2hpi6T6N4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120438, "uuid": "418b0535-2ba9-4c8f-9234-f6257eb622b0", "value": 449078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120438, "uuid": "8bbf0475-adc7-4502-8699-154e4457988f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120438, "uuid": "41464cc8-a522-4e93-af18-506e1e1c22b9", "value": "bb1b5926be84d447551a974f553a169cf4e837d4d98591acbdcddeed8cc7bfe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5825d732-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089815, "uuid": "62843365-24e6-4abc-a18c-5d91293cb524", "comment": "Malware payload (Mirai)", "value": "1ff54c946d772833aeef4a90490e339d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089815, "uuid": "a1822a5d-9bec-4a21-92ee-c04f0fae363d", "comment": "Malware payload (Mirai)", "value": "bbdce001a02f3b1f2dff13b5c4b35c524af0488e120b68d3a5e55ec83063f70d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089815, "uuid": "04d1ad7b-0f4d-4416-8a45-a47414b3ddba", "comment": "Malware payload (Mirai)", "value": "4e2e3be2a612195d781ec364711015ff9cee2f17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089815, "uuid": "a9354232-c7fb-482e-9c3b-8d1d46795f96", "comment": "Malware payload (Mirai)", "value": "4441148c6610fe174f993284bb79583fafed043bb2edbe39a957c1177752ce88090a6cbb4111b9b1e517b45fb9bd8c66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089815, "uuid": "25766353-c55c-4229-976c-40b2301ea042", "value": "T11DC3AE97F78B24A1C86146F007C76B8E3E6362119E6BE9E76C1E753B193A0DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089815, "uuid": "06b8d13f-5a31-42df-a139-84e07f60b1a0", "value": "1536:3C189r2mIHgqH8IdgTB45+LaLWqEICjCotZ0eVCUxZJmGg9j/LWA:y1ur2nj7iq5+LetUCokeVC9Gg9jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089815, "uuid": "29182977-f388-43cf-9939-a8e6b92f291a", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089815, "uuid": "a40a1d09-682f-48e3-9e8f-2fc2f8e538b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089815, "uuid": "4381551b-5e63-4b5f-ae2c-b7fb04cdb3bf", "value": "windy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a108740-52e3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779127184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127184, "uuid": "be41ea4f-e3d0-4516-996b-57c07194cb30", "comment": "Malware payload (RemusStealer)", "value": "434dc1413fca6eecf3f6af761b98390e", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127184, "uuid": "79c2cc20-f09b-4388-b7c9-fc699179f8fc", "comment": "Malware payload (RemusStealer)", "value": "bc7b6900d411f68e5ce70e6f60692f1f04dd70ac09d572ff5fec1b51dccc0e3b", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127184, "uuid": "5d61a97f-4424-458b-94a2-152c195068d4", "comment": "Malware payload (RemusStealer)", "value": "21e775d0339a3685d9a2f8e7484dd923a33646e3", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779127184, "uuid": "875757e5-2dec-4e48-9310-1a94043629d9", "comment": "Malware payload (RemusStealer)", "value": "c5c6d3269f20754fd0de54122c27ed14e412cbf98ca3526354ded0e350f029923abf1a278b182d8f11bd1e991b0b3a88", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127184, "uuid": "0705f767-051f-4d57-a71a-80bf562c7260", "value": "T1D495AB87CAC61D97DDD518386C6B4F745B70C8AAF802CA538B32A76A8FD7794CC1A04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127184, "uuid": "36336c61-ac49-4c9e-aa0a-761934017c3c", "value": "49152:Gwj+iZmlJuZsQlDFUk6yYmijXlU7dG4O+3kW:Hjb6CsQlX6Mij1SdNOKkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779127184, "uuid": "3a9ac107-6797-45a8-b6a5-6529e2d64685", "value": 2055433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779127184, "uuid": "5a560a73-f6ae-496a-b9d3-ca9794cc0474", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779127184, "uuid": "b2cbde17-f37a-430d-a5f9-57bc5c1793c2", "value": "Bootsexeeec64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29002696-5250-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779063966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779063966, "uuid": "9aa7b8da-d7dd-488a-891b-d8c8d79af60c", "comment": "Malware payload (Mirai)", "value": "bcec691b73166e2817122f9fc6760428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779063966, "uuid": "ccaebb0a-ea5f-4cc0-a744-cbf7ebeaa729", "comment": "Malware payload (Mirai)", "value": "bcbed7bfa4b6bd7c39edfb6890bc217c795210196d6d71abbc49a7357040e932", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779063966, "uuid": "28b01b7e-8ece-4bdd-a83c-1e063d1b20a9", "comment": "Malware payload (Mirai)", "value": "b5585a56c8fe64e6c940c246f8c8d4a6dc2de22c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779063966, "uuid": "56ddaeb7-f9d8-4c70-b14d-a4c9d985e751", "comment": "Malware payload (Mirai)", "value": "7d1cacb023bbf80b5ad27c89eb2a454854154ba29654f1a66d696364390b149989553fb079e4aeeb8ed46d81034ae3d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779063966, "uuid": "59d431c2-3a57-41a8-b603-2b96db30e2d8", "value": "T12B146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779063966, "uuid": "79fb6d82-4a92-4bd7-a2bc-df3f538df5a0", "value": "6144:zNROm5155gL6mTX7zRR1Lwt8Al7IKTty:XgLnLzt0ll7IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779063966, "uuid": "0a55d1b7-6776-4a93-ac49-b22f1a7dbe5c", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779063966, "uuid": "96cf6fa1-28b5-4b3c-b5db-64999ae969b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779063966, "uuid": "a67f03b8-a492-40dc-9adc-4e2e7d4a220b", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f713a8-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120896, "uuid": "a756218e-3d59-479b-b7cc-dfa42225be80", "comment": "Malware payload (Efimer)", "value": "d9dfed1e150523da94c7c78562bd9367", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120896, "uuid": "2ac0ea77-60e9-4250-8854-fe1fab3fb846", "comment": "Malware payload (Efimer)", "value": "bcd51c2b5e43888b05cd4cc3d238eb97ba9c6922330bcf8cf1848e512c9fe086", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120896, "uuid": "99d8d906-ed6a-4259-b815-1920aeb05470", "comment": "Malware payload (Efimer)", "value": "b7fe6eb700d5c4ce17294fd376bb5f8dc0aa6f29", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120896, "uuid": "7b85f064-a1fe-4acd-8d46-4332818d50ed", "comment": "Malware payload (Efimer)", "value": "8f8638bafd29742eceaf1b717520584310e91220c676a42c0e60253c909428a6ce18825ea5d54adcffd613f3766e3189", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120896, "uuid": "86d7005d-0552-4b04-a585-06ec55c1c939", "value": "T1E7D6330C6CC2547DDAB380B97FE15BF0B479B8B446B78C7A57A4C2B2AC17660963C41B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120896, "uuid": "9712c4d8-6f6b-4d50-aa50-23614d602bcd", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120896, "uuid": "398c0a3a-0dbf-4dbd-b4fc-0ffde1c839c7", "value": "393216:hbBL2AS2aDXPLBxCKVrS4v1xXMCHWUjX/cuI3/PGTAI:h1L4PBgcrS4v1xXMb8XUH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120896, "uuid": "9deaa7d4-5b01-486f-b6e0-5e3bbc7760e3", "value": 13854024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120896, "uuid": "3f5c6c10-4dd3-4d8a-8773-7866fd0657cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120896, "uuid": "fca96b2e-9b07-47e1-b29f-2588fe4cfd5b", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c135825b-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089991, "uuid": "f6b9241e-db7b-4228-93af-03c74f058e2f", "comment": "Malware payload (Mirai)", "value": "10e2c1c216a71d4f558a741882870707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089991, "uuid": "15c0ff80-3a95-49fb-b9db-d88f6b95906d", "comment": "Malware payload (Mirai)", "value": "beebbca34f024fe8f9ba618702b554dba77beee8c0bf37248039232d69da8d30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089991, "uuid": "16533192-6f92-4c29-89aa-f1b61e7c2059", "comment": "Malware payload (Mirai)", "value": "f9c51574874110327fa0a42e0f362baeb1934b1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089991, "uuid": "6bfb23d1-e10a-436b-99f5-64a8c3e763e6", "comment": "Malware payload (Mirai)", "value": "0c467ddb5256a85b1710d98ba7d81d772ab992e16e580671f2a921ef110b6f172ee0e582a4b44fec8854fec75782e506", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089991, "uuid": "9c248e5a-3325-4cd3-9c4b-afada8fbe918", "value": "T120431780F8D2996EC6D4137AA73E318E33A1B3E5D1CA3613CD945B25338A6CF5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089991, "uuid": "f65086a3-84e4-4854-8dc3-66ceb2607ae5", "value": "768:Ecys8ng4d08tmpydYQoyZEFM8fB958jdS8kIf4ubnJ2oN8RR43rMnBN3TWnlKmz:E7nZd04CW75EFMg8FfRbnJko7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089991, "uuid": "5d0ae23f-784a-4342-96e6-bbbc6dd63904", "value": 55892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089991, "uuid": "3a9e14dd-51fc-4efe-a84c-05bc644e3785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089991, "uuid": "458cb8fd-1034-4e18-9a35-bab3288d789d", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ffa862-52d7-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779122044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122044, "uuid": "5ec7272c-09b8-43a5-9f2c-78f5778f3d94", "comment": "Malware payload (LummaStealer)", "value": "1e60cef5e409e401d282768a099933b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122044, "uuid": "2e284084-572c-4fd1-b036-91b840f28727", "comment": "Malware payload (LummaStealer)", "value": "bef70628acbe9b3de7b4b19beff307c76d0f94341b9e3458da14056a56200386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122044, "uuid": "e859d898-13b8-4724-a789-09be772d24af", "comment": "Malware payload (LummaStealer)", "value": "98dbe4f525cd4a42140f5f1a330c18fea2e2ef5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122044, "uuid": "94d89557-07b6-434f-9e3c-7dd7f4281523", "comment": "Malware payload (LummaStealer)", "value": "08c79c5fa2253bddfdb2ed38fa79205d7979e7745828d55aafae6adaa610c5caac912b70371087922ad1384f42293ae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122044, "uuid": "ac3661ee-3690-4d23-badc-651540ebbff2", "value": "T14DD53BC09BC1E871D7C2B4317076B1BA93218801DB3CEEA3DEE17E58B57E3922863556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122044, "uuid": "57d311ed-ad01-4427-945b-a48f4a954ca8", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122044, "uuid": "7d4a2bab-6367-40ca-8dd8-3d84c5ef8a9e", "value": "49152:kIjw2lrRLcgZdgaOhLownrMANhQOmsPHQtkklY6efpwH0+aA:kKwMrhv8OUNna6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779122044, "uuid": "af90953b-c8c9-4044-befa-e1407217fa21", "value": 2976960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779122044, "uuid": "14dc77c0-94be-4f45-a1be-da11ba9617ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122044, "uuid": "9e43aa99-ac4a-4d12-a5d7-e323063af1a3", "value": "WW26A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8935314a-52b2-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1779106218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106218, "uuid": "4b34716b-7050-4061-bc18-18f3680a6d38", "comment": "Malware payload (a310Logger)", "value": "c01c5caa434c0b1bfa06a643105889d0", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106218, "uuid": "c0bbca05-eb3f-49c0-b8ee-678454462e8f", "comment": "Malware payload (a310Logger)", "value": "bf69f267d59823eddabbfe3ca489c9b6ffa2505db9e92affe9bb141306521079", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106218, "uuid": "6f35f6e2-d299-4249-941e-4204d4267095", "comment": "Malware payload (a310Logger)", "value": "fd1bc4d6642843170980393286ac6b920a949926", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106218, "uuid": "698fcc1e-7d60-4152-9d0d-2789e478917a", "comment": "Malware payload (a310Logger)", "value": "899404b418d97586c0e170b0e9adbecdf2dcec48020e6c965d9a81ebb3db1bf47cc53c0810fa396b35a0ee6f76e63cee", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106218, "uuid": "6ce499b5-7936-4317-9e9b-80581b48abba", "value": "T1E345226C5309D407CBE247742EA1F2B9267C1DEDB911C246EFECBEEBB653A645C14082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106218, "uuid": "c85cb139-cfcb-4b71-833e-bac5f46582f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106218, "uuid": "6899eeb4-59e7-4ac7-b8e0-ee5c06ce86ac", "value": "24576:HoezqCHB63DlcWJkW55II6wo4d9TH5XLWf1ffBYoo6tkUWGiMlgAn:IyqY63DlVuW55II6jY9TH5bWfZJL5tkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779106218, "uuid": "976cc3d0-7082-4b75-b37a-4e51f5e01af0", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779106218, "uuid": "eaf18efc-1863-4a1c-8a5e-52d833f359c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106218, "uuid": "35b8a6d6-821d-4215-9203-1e5e7fbbdf7d", "value": "Cotizaci\u00f3n_718011_19_CIA2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efeebc55-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144186, "uuid": "592b067c-672e-4bc9-be9c-8d2378c46fde", "comment": "Malware payload (Mirai)", "value": "33e0254490f24f5115d81baf1d7dc388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144186, "uuid": "5e88306f-1490-40b1-a4fd-24577e6768f0", "comment": "Malware payload (Mirai)", "value": "bfe37dd357e211ce61617ae95f081b56214ad6acc51873ccc925fa05dd37f49c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144186, "uuid": "63610297-b4fd-477b-a082-5eee6ecf8a21", "comment": "Malware payload (Mirai)", "value": "360f57577e584b181104342c5497a0173b58b531", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144186, "uuid": "0762cb00-c06f-4003-86bc-838846cedb57", "comment": "Malware payload (Mirai)", "value": "0305f3851de5c2e772b7895723fefb26a431374d83c3bc9696750e1b5426aa64c463258825628e2ccab818ad10c94d73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144186, "uuid": "5c26c1bd-5452-426f-b1df-3e37863f28c9", "value": "T15CB35C2279751E2BC4D4A8B661F34361F1F3579E21ACC61E3D710E8EEF246503257AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144186, "uuid": "2e76295e-dc28-478a-ba2d-4954c74ec721", "value": "1536:3t/ikUw0qX/ySCcYIUkKrN8v4AOaOHqkDfBAXoCJdhIyAiWr2IdtorNWq5F9AcUb:3pDwN8AA8h3CGdmrNlDEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144186, "uuid": "ff2dd57a-82a3-4d66-9b3d-230110c6f7a1", "value": 112644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144186, "uuid": "7eee18fb-dd16-4725-a96f-f42f3267cb32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144186, "uuid": "e83f892f-d039-45d5-8813-c21880dcdab3", "value": "heilong.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d8163a-5284-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779086397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086397, "uuid": "fd08c5fd-0e35-4974-8fd9-ce422954ae35", "comment": "Malware payload", "value": "a000c96b099ff3cb1f935458309d1f5d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086397, "uuid": "57362a38-7b41-421e-80f7-1c2d5a06c922", "comment": "Malware payload", "value": "c1a9c91f1964ba31d140afc5952b2c518ad0f00f492b639e6d6f6890fb7f34d4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086397, "uuid": "0b17a2b9-c921-41f3-8b5a-18accbd819da", "comment": "Malware payload", "value": "03c87cbc18daffb342aa7d1522f11783ffa3a7a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086397, "uuid": "fcf8aa64-84fe-4ee7-830c-58221f79ef96", "comment": "Malware payload", "value": "6138e12d424c48a0faae8a8544e9ada97eeaf0a92ab3e834c5149c7f994983e020e4f3b84b836d2becb46700e1a24cc6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086397, "uuid": "e074adaa-bb9d-41a3-9039-2a84949d6ce0", "value": "T114136C6526953C25AE99883B5C7E2F0CBDA983E2300491DDBFCA3CF18C15A9CE71871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086397, "uuid": "f49ae57a-dec6-4948-9982-828c8c43ca46", "value": "768:fr9NyXsZztCH9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:jHusZpco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779086397, "uuid": "af0f9754-b94e-451c-ac28-5cc227f40536", "value": 45497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779086397, "uuid": "ff18414d-5bd2-4a4d-b576-34c4f8cf27b1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086397, "uuid": "c494eb89-e658-416f-b971-719ed646aa15", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596f05aa-5254-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779065765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065765, "uuid": "1cff139d-dd0b-46f6-8d51-43d28dc94fbe", "comment": "Malware payload (Mirai)", "value": "abaf6f24e672531e23fbc87ddb70f735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065765, "uuid": "394e410a-27c9-4935-8c37-2dd7eb370b5c", "comment": "Malware payload (Mirai)", "value": "c2ea5668cccb34e61ccdb3110f31fe017f6281470f00c88c4ddee76721a25969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065765, "uuid": "501d1bf5-4b82-48db-b95b-e34383f1a4b2", "comment": "Malware payload (Mirai)", "value": "291e71c0ee5aa07d5df6c000e1a3a63d88682723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065765, "uuid": "8e8ba0ca-d6d3-46c9-a14d-110733a751f9", "comment": "Malware payload (Mirai)", "value": "481376d65c514efe67f5bae8d38bc53361609948e5f34e3135739c886c8f3fff9ff37268712adcd75439a90dcd4f5d03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065765, "uuid": "3661be28-fb98-42b9-b32a-a5595f099d56", "value": "T12BB3AF87B1907ABEF0A49E3FC4135E26A6259F705583173D71BDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065765, "uuid": "9f8e5e3b-21e1-4adb-a057-9e03280fc62f", "value": "1536:toOxCg+uUGWkCqYUqwaJ1XqfXg5AcS5blaZeCtjHXNLdCS2T15OvhSkzs8rSx:t1xKlGWnqTUcXgZS5gZ7CSXhS1USx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779065765, "uuid": "f01058a5-0a6b-4567-b6eb-61750bf36ae8", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779065765, "uuid": "88d13dcf-8898-48ce-91c1-fc8099484bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065765, "uuid": "9f3ad3f0-7ef0-42de-bb2c-be799a7b0c05", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe9ab5b-530f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779146246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779146246, "uuid": "c7c35021-cb82-43cf-b0e6-5115c4c27f8a", "comment": "Malware payload", "value": "e476416c9c31d268831520c07fb043ba", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779146246, "uuid": "63007772-f17d-4b84-ae5f-1cf0597f6c22", "comment": "Malware payload", "value": "c4320ad099bdcf6b338e3e60cb6c44bbbac8228daa39990c9287482f2af8e561", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779146246, "uuid": "3ef09d2c-b90b-4839-8978-da3caa1d409a", "comment": "Malware payload", "value": "452fef39b82ae48ecd8a936edaf95497e094a2d6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779146246, "uuid": "d18dd64f-9fb9-4c8d-880e-d6142cb30505", "comment": "Malware payload", "value": "70905b3044ef0767be6881af865d7731d1ed8975173d8f785e52e8251451630ec77bc0abd7a4390bcf25a029af4ceef8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779146246, "uuid": "a1e56a38-2cd0-4f9a-8d7b-de4e1ffa16c0", "value": "T16F342B17F35358FCC466D17865D766327A32BC184030ADAB1AD5ED313E22F206A6EE1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779146246, "uuid": "7264abcf-39ea-443c-a9aa-8cc9890c3ee9", "value": "fbab8648121feae7a06889506e5fdae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779146246, "uuid": "811d0676-12ef-49cd-9b05-303aa47248a7", "value": "3072:6vqfLrI7OSoYMK5saN7SEtYAdU3bdGHPLF+Uq0rkiYyad+tJwQQ5R81A0Zsh9lHF:YOrI7PozK3vYXbEdq0YzIt5Q5l3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779146246, "uuid": "9193e05a-b9f7-4626-a0b0-a059d1377bd4", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779146246, "uuid": "e4ca80c8-8095-42f8-8eac-ed04bfda7ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779146246, "uuid": "aa7fce5d-0f8d-4f6f-b2b4-470881aaf5a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dbed1d-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120473, "uuid": "f3257c4c-b960-46cf-90c1-498c53e5a64c", "comment": "Malware payload (Efimer)", "value": "3b90ad21b17919ba80a9168d9d81ee3f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120473, "uuid": "3799a4fa-7cf3-4cc8-96af-6818db8162c3", "comment": "Malware payload (Efimer)", "value": "c488f37dc1629daa72df9f42876bfe9c213bedfbe10dea5ef54bb4b410e5528e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120473, "uuid": "75e13f32-3da6-48fd-8e8b-cf6f9a40f948", "comment": "Malware payload (Efimer)", "value": "3f8e48d721c2cc4013097b51f3cf4ea91fe8cf4a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120473, "uuid": "a68e0138-517b-4243-95fe-a728bdacfe7a", "comment": "Malware payload (Efimer)", "value": "850197edbe0cc692c788adce9527abfc4e996fcb82503d1c01862704b3cdddc8aae160fd1262d1bdf1b5d996c3095ebe", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120473, "uuid": "36478478-8ffd-4d39-93c9-940e30dcee74", "value": "T138D6334D54E151FDC76780B4BBF16AF1A43A70B902B78C13122CC7B2B9239A66DE845F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120473, "uuid": "dbd3fbb0-41e2-46f1-918b-fc3ce6406775", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120473, "uuid": "f3b8adf1-ee2b-43a1-b0fd-5c373f9bcb6b", "value": "393216:Qxp/380m1TuI8rs6cF+i1r1aewXMCHWUjX3cuI3/PGTAI:Qxp/q91Bl15aewXMb8XMH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120473, "uuid": "f0c57250-cd59-43f5-9cbe-b3196720b900", "value": 13845425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120473, "uuid": "84fbce48-7dd3-4227-a23a-bcbc93ada431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120473, "uuid": "4c19c3ef-9fe3-414b-965f-df660fede01e", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b768e900-5256-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779066782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066782, "uuid": "6d263226-d98e-4ab3-aaf5-2dbf6619a855", "comment": "Malware payload (Mirai)", "value": "7aabc5924988df6c42ca53f824d6248a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066782, "uuid": "de271421-1e3b-42d0-a2b8-3512b52a3626", "comment": "Malware payload (Mirai)", "value": "c5b83964c342cca78446791fad6d693698e5a2b8f2c24b53c2c1d2221ada15b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066782, "uuid": "c0ac343d-5206-40b3-a543-bab6a6a029b9", "comment": "Malware payload (Mirai)", "value": "c732262ff7afb312c51e9ea6d771696117a75ed0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779066782, "uuid": "f272cc87-eb68-4fd4-9a99-eefda877461f", "comment": "Malware payload (Mirai)", "value": "9611aab8ece89fbef4decad13b6cf884c51590da4979aecbe34b73725f315ea7e2baa1249a43d453e469615facd887d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066782, "uuid": "c2280826-0679-4ecd-b623-6ae281ffa88f", "value": "T13C6312F6493ABD5FDECC5B785450127A7088D3D2F3B3A950709AC48E560E22FD11CBA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066782, "uuid": "2773adfb-7222-4054-86c9-c5cc19de15db", "value": "1536:XVUQ0TcrWCT3gcHB+cyepg1k/zJhw7nWAvnQGUgJViXZjbXmGt9DfNz:Fp0T2WCbgc8bm/gCAv3Jwpjb2m9DNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779066782, "uuid": "35677c5a-2228-4d1e-a683-5dca8fba48c3", "value": 70436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779066782, "uuid": "b0fe60d6-c699-44d5-85a2-5e15d26a2d16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779066782, "uuid": "45b65227-bb48-4c03-92fc-9081109baf93", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad17760-52b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779107643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107643, "uuid": "dcbb9063-0e46-40ce-9f96-8a8705264f49", "comment": "Malware payload", "value": "3b9990d274713eaa5c3c24856a501f78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107643, "uuid": "27fe6218-692d-4b8b-a39a-f6c48d7b133c", "comment": "Malware payload", "value": "c5dcf351caf19a059ba1c4134f0314827f6fb3bb95b81eb805b395bf571458d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107643, "uuid": "dc6b2240-d6b9-4aa9-9d5a-ddebc6b3ce5e", "comment": "Malware payload", "value": "475c64133191cd123e9326e82b1669df0485f3de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779107643, "uuid": "f4e2787f-dafb-4617-ab35-d7ce104305d5", "comment": "Malware payload", "value": "e1235ca3d43af6b2b39e385aeafc0d51b5845c21a7229861b5c7463081ead34b16874846b1b6df05407fc28f7fc3c4f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107643, "uuid": "271ab516-2b3a-42a8-83ab-0069d7cdb3e4", "value": "T1C0E4CF212D822B59C6BE4F7CC021085877F0D853D797E726AFFC81F5AAA3B84C927521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107643, "uuid": "a7b0633b-4d1c-45e4-9742-e30b548bc685", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107643, "uuid": "750b0199-cd51-49ba-af02-f4fc9934c866", "value": "12288:fXq/m0ie2QExIUBkGQs1/vIwQapKVBgZdQt8arzuBpYTfz2:f4ie2QG5fOBWGt8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779107643, "uuid": "a6cde2af-86c4-492b-8dc6-194d4c68ea5a", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779107643, "uuid": "9a2b6622-361d-4e97-8a98-9913290e6ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779107643, "uuid": "8493b2fe-0f21-47d0-98e4-6519c4e313a2", "value": "SOLICITUD DE COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736a6cd4-528d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779090290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090290, "uuid": "fbfb64a4-6c0a-4994-b876-894b5e9ff35c", "comment": "Malware payload", "value": "07a345477d9a37d03dfa006886ac7404", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090290, "uuid": "680e3e94-b5c0-4db1-9abb-f2e3fa40a203", "comment": "Malware payload", "value": "c5e95fa0a3c80d759bb59f614cb7d4ffc68f65649f181f00e5b1d799adc6d6dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090290, "uuid": "018772ee-e4d1-4239-ab5b-9e455c0ba23f", "comment": "Malware payload", "value": "de92307397ad9de7224a8974a6a736b600121eae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779090290, "uuid": "f4752330-e411-4c5e-832e-0f952daeede0", "comment": "Malware payload", "value": "21a79c4415eafa887f304ce7cd5dad66e166480f89852092deb240d0e1f14d9132514ff2aa820e3ea615b7d239605f95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090290, "uuid": "26d3fed6-32ea-4dd8-b2d4-a832d518db6c", "value": "T127F3233548558C19442D8EBD8386B042E7C8FFE2D2B1BF467228F7B9484505AD3A5BFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090290, "uuid": "56172a65-951a-4ab8-a4e9-2e52d6f9d041", "value": "3072:EBtr80fidEkicUJ/+/t7XZOGJ7hRDnmiALP9WS9etJtA9glei:urBRcNGGJ7hhmPP9WoetzAKl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779090290, "uuid": "a06408bf-85af-4343-bad4-83224d9bd165", "value": 163571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779090290, "uuid": "66314e98-70e9-4b11-8800-8e0ce7833d7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779090290, "uuid": "f0fb6448-a59b-48e6-aa5a-c70c4c367f01", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98bf2f6-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120580, "uuid": "0975b85e-ffe4-457b-a760-fe56e8c30f72", "comment": "Malware payload (Efimer)", "value": "f0dd0983978c10505a462529dd4c5a3c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120580, "uuid": "46217e0e-e437-429e-adbf-d5071f494256", "comment": "Malware payload (Efimer)", "value": "c5f14ee20ab06abcb1280c940976169ba6a1ae6984a5c6a7ba5372cd37861ead", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120580, "uuid": "8231a924-8730-4e22-b9b1-dd54b17c4c7b", "comment": "Malware payload (Efimer)", "value": "937600896e8fbe600bca1b1c220f749e092f7c7e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120580, "uuid": "acb0d2f7-bfee-494a-b4e5-a3c70c4cf3ca", "comment": "Malware payload (Efimer)", "value": "3a0c298d6135230594f1a4771b959980d5cf43e3c0c3ee7546d15a842cbf638e25e14344543998636900b0951638f394", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120580, "uuid": "3a8bb6c8-3f4d-4560-981f-ae13736a6270", "value": "T19DD6330C94C2709DCEB690B8B5D14BF0F0E4B47B27758A79B968D7BA7DB34908A0416F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120580, "uuid": "452ffbbc-e073-4055-8bc6-6cba5681880f", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120580, "uuid": "f128cb17-c087-4aa1-b167-f8b8f387ec4b", "value": "393216:P3i7BxukLJ8wW6hECOI9XMCHWUjXjcuI3/PGTAI:P3iFckLdnEg9XMb8XAH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120580, "uuid": "458aa632-b280-47e9-bddd-2c67c0fb39d5", "value": 13837402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120580, "uuid": "3f7757a8-2791-4196-87a6-79b7bc6e27fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120580, "uuid": "14d14d45-87dc-4606-b7db-dd8f2fcee758", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116a450a-52c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779113748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113748, "uuid": "343d6b3b-e433-40b3-a038-6709be6e7400", "comment": "Malware payload (Formbook)", "value": "ee10d0013cd5fa1f496ff20c3a3d293f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113748, "uuid": "6eb5c599-2ab2-465e-9814-5fed4a2b008d", "comment": "Malware payload (Formbook)", "value": "c61fd6a91353834b1b35bdef04242f89295b7f7ecffb2951ec3459b391d8ed97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113748, "uuid": "e3226635-c04e-4663-8dc7-cc08b2221990", "comment": "Malware payload (Formbook)", "value": "ec3e8908a69312fc8c518a60769faffb5fe2abec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113748, "uuid": "b5547f3a-d241-4505-a33e-a5679220e88a", "comment": "Malware payload (Formbook)", "value": "d9942e5b94d2a126d950070d09ea8b5ab9d877aa53cf18de94fed696fee5beadbbbe6297a101e397799917536166061d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113748, "uuid": "11a44fc4-9440-4372-acee-c2ad134c4040", "value": "T1EB25127A250AE517C9955B395E21F3B912AE1CDDF900E307AFE9EDEBF977A600C00181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113748, "uuid": "a0c70f40-0ee8-4b80-a03e-c9b856f6faba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113748, "uuid": "f18b02da-8789-4a75-acef-f21e0f694f1d", "value": "24576:Ryi4yCK8KdMOJ6ZNuJW1HIJzDALiIg92u0vAXfn:RX4fnKdNoZsnPALiB2u0vEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779113748, "uuid": "0209d1da-7d5e-4904-a103-1bcfb70932b3", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779113748, "uuid": "32ce029e-6896-4ca1-a89f-dd36de4e848d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113748, "uuid": "b5d94f2f-845c-4949-b902-dbd77344d061", "value": "MV_INO_HORIZON_SPARE_PARTS_ORDER0298342345.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7733484-52c4-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779114107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779114107, "uuid": "4e6b7a9b-e939-4eb7-bf4d-19e308beb92f", "comment": "Malware payload (AsyncRAT)", "value": "15609d182759b28e6c2970f777731bee", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779114107, "uuid": "38c85027-8cd6-4d80-a6de-6f4a562103db", "comment": "Malware payload (AsyncRAT)", "value": "c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779114107, "uuid": "7c7a2ead-41b7-436a-a149-e9b76d381380", "comment": "Malware payload (AsyncRAT)", "value": "5414ec8b6966b24956153cc6baac8dd93c30da92", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779114107, "uuid": "9f3224cb-4d00-4fac-8d5e-dc4d52eb390c", "comment": "Malware payload (AsyncRAT)", "value": "14e1531a1e085c64e34a3f80166131c9c5c4fea7d510be3634d30551dd0fbf5f9e7af086051b2aa499e637ec6a401642", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779114107, "uuid": "9060356e-522f-46a0-b912-54e7aab7a6fd", "value": "T1FCF4126C3B05E10BEA915B385671F379166DADEDB901C2029FD9AEEBFE37E405D00182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779114107, "uuid": "25a1fb10-4e3e-4b26-b3ec-dffa92d8f1fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779114107, "uuid": "c85276c7-c30a-4f91-ba77-c8d70ccbd542", "value": "12288:+EO3nCWRDz1pVPDuvPvahEwE4qjsGB9PJqmWMzmqTDeJ0LPRxjEL149z4:+RCwDJpwXauwpqDqmWIyJcnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779114107, "uuid": "a5223d57-9a54-4c4e-a20f-bce7109851f1", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779114107, "uuid": "b5598e13-c0dc-4e8e-9434-bbc2a20a920e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779114107, "uuid": "7032f33c-630f-450b-bc0f-cf77fe39e29c", "value": "doc_626656569_C301i26051110150262652652652656525656454267.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd8c955-52ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779131784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131784, "uuid": "96a945f0-2d9e-401c-b329-98996c330c1d", "comment": "Malware payload (Mirai)", "value": "22a58b49a02bdfd2961cf85a2b25bca6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131784, "uuid": "61d28c1d-e602-4b38-9ad2-179338288fd4", "comment": "Malware payload (Mirai)", "value": "c83297b1c07ea5cd974ae33e181cedfee09718e13963c49445a190ece7692a9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131784, "uuid": "c0dc7ce5-3d28-4427-96ca-341fade31636", "comment": "Malware payload (Mirai)", "value": "80cd94f6173181c01a1608a3c4d88e66b304bdd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131784, "uuid": "48b73347-d121-47cc-a22d-b08fcd0cf9bc", "comment": "Malware payload (Mirai)", "value": "660375127bb428a3cb231dd664afa18d11865c2a14aa8276aed2ee7f192a32019b5f2e034c6adf145f3aab0e418564f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131784, "uuid": "b1836dc1-21c5-4efc-b104-6ab4bc1321a4", "value": "T158030881B8828E6BC9E0137AA66F519D3310A7F4D2EF7323DC204B14778691F8DA7B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131784, "uuid": "fb623f8a-7468-4d67-b2df-51134d1414c8", "value": "768:5AV/e/uyQowljWFKApvI0grjEOPQAu5Fw+scHtQhxpDud:eV/GQowlaKEI0lOPFuPJdQhxxud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779131784, "uuid": "4b84fb4f-5bfd-4c63-8887-3c6eaab418cd", "value": 38572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779131784, "uuid": "ce599692-69b5-4529-9858-fe465cb1b67b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131784, "uuid": "e67864da-518f-4404-a564-db439e5fa61c", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149b9201-52a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1779101298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101298, "uuid": "6a586297-7740-4278-acb1-4dc3156d0d77", "comment": "Malware payload (Gh0stRAT)", "value": "7ec79854bd2fb14b8a5c92ae336bb014", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101298, "uuid": "f3f45a41-11b2-409f-9c52-fefe5f61b6ba", "comment": "Malware payload (Gh0stRAT)", "value": "c98ac997e2f9def83ee2dc5c7e84e004423aa35f74c96058141e41cffa9db1cd", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101298, "uuid": "6ab2b80b-ddad-42aa-849f-1b0b1ed784f6", "comment": "Malware payload (Gh0stRAT)", "value": "1d21abee50b1ee7fd01fcc21166f1f8455704082", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101298, "uuid": "2491c379-1d3e-45b3-ab1b-9ed602bf51ab", "comment": "Malware payload (Gh0stRAT)", "value": "2de415b96242b27f1575fa5dd6a74581d3f61c3cf8e67239cc86c51c10fc7fad3fd0ee98ab66e7f58f3d368f6867fa35", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101298, "uuid": "1a9259ff-7dba-4a72-b185-e6c1a554d300", "value": "T124F50127B2CB653FF0AA4A364977E212593B7A6169134C6797F4085CCF2A0D02E3F746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101298, "uuid": "cefe4219-70be-42ca-969a-4df126b57064", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101298, "uuid": "d6f19119-13d3-421b-95f5-19c175bb12d9", "value": "98304:35fgQnypnQcHttg+E2o3ItcCJ/P1eBCwpgZ:JbnypnFHttgID9QCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779101298, "uuid": "2b4ccddf-82ff-4332-b943-8dc4a9f839d1", "value": 3587778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779101298, "uuid": "fd8573bc-b10d-4fc9-9a14-37c38f32259b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101298, "uuid": "b643b2f9-92fc-409a-a0af-56f52cb94f15", "value": "Firefox Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d8baea-5259-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779067932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067932, "uuid": "d5a7ea43-e4c4-4498-8bad-b2edfd595c97", "comment": "Malware payload (Mirai)", "value": "8543a400e2d5808a3c8121fcbb818ef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067932, "uuid": "f76648bf-2fdd-4365-837d-a8d92ac038e7", "comment": "Malware payload (Mirai)", "value": "c9b0847f2f30bb47b7bdbe1ab66eb0c342f0ce31a0bda361088fe874de4a26f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067932, "uuid": "c0f9f2b4-9958-4dd6-ab64-8c08aea5db14", "comment": "Malware payload (Mirai)", "value": "aeb1a9dc0930ad39d28e7e7d7b883a4bfa8dec9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067932, "uuid": "7e5dce0f-ece3-4339-8bcf-f5b0bd5af0ce", "comment": "Malware payload (Mirai)", "value": "568c483b9c8eee799cee63140fa28ecfb87335e6154c15258ef9af1c30de2984bd6a3101eb52239ac3f26ebe78b38b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067932, "uuid": "931b410c-33ec-4c30-90c1-d4950255e4fc", "value": "T1C604392F258192F0F6411B746BCFD3976C390BBF51A9909F6B416329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067932, "uuid": "b5e736c1-79eb-46d9-905c-b7fdbd771f02", "value": "3072:7mflblbBDfvNUZem/LVA7bGQU66gOVNLddnNgRdgJi55wqUX9:7IJ5k1DVA2nDXNgEJi5a3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779067932, "uuid": "b1a767c0-de6d-42ba-9821-a81391ee628f", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779067932, "uuid": "66d878f4-39c2-4034-a779-ea235c1ad985", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067932, "uuid": "e7d1c23b-f540-4001-bc0f-5d9e1011bf30", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac7ded9-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089819, "uuid": "ef6ef827-9534-443c-ac86-ce1f0c83d230", "comment": "Malware payload (Mirai)", "value": "26d7c70b28e53386cb680e200cc5dfbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089819, "uuid": "724a3f71-f5f5-424f-86c8-ee7578aaa39f", "comment": "Malware payload (Mirai)", "value": "cb80a218e3a33466bacaa9b4f0ae2c1dc184d2557992d1491ba94d7a1ff2544c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089819, "uuid": "94dbca11-b2fb-4c22-ab4f-c881530bb2f5", "comment": "Malware payload (Mirai)", "value": "1fddd5a074a545b15167e89fd5d49914349d124d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089819, "uuid": "5d89ed1f-d6c4-4184-b77e-ea247a5af570", "comment": "Malware payload (Mirai)", "value": "d14c7829c4acfbf2afad571b1c2ed24b474f16ecddb169a585ed964ee5429d83f7986c80a5cd969a065688a81cafe233", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089819, "uuid": "16d2313c-c3fa-422c-8fb1-38971fbe90c4", "value": "T1429318C6B401DC7DF80FDABB4463290EB631E36156831B26675BBE53AD721E05923F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089819, "uuid": "639180fc-c3d9-4bc7-95eb-41742e0fa3ea", "value": "1536:6sdLEbXJld35is6pRA7O7X7LW0XM9FW2edNP/8b47e1ov5TaCkg0zjX9JK1Cm1km:6DiPpAO7X7ww2ed1nqeTadgqGCm1Hqcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089819, "uuid": "6a507199-1af0-40ec-8fa3-008b5b3ac036", "value": 96736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089819, "uuid": "7597615c-6836-4dcf-b4ef-d0e311b0e92f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089819, "uuid": "1a81dbb8-6ca6-49b2-aa18-305dd23438e4", "value": "windy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8bc842-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120612, "uuid": "22e43e8e-1007-4b42-8a9c-a58733e91a0a", "comment": "Malware payload (Efimer)", "value": "d0da83568120a75335265ca66cd57f7d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120612, "uuid": "5aa91028-fbf5-454d-a9dd-fded7185619f", "comment": "Malware payload (Efimer)", "value": "cbd5ba3aae1ddc94061a2cee1ec8b2911bf875fa125fbd3822fd7cf926459579", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120612, "uuid": "21b27bee-93cf-4488-bcbe-f65b5a0d09d3", "comment": "Malware payload (Efimer)", "value": "9af93123fa1482e3377463be4304b546c65573a4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120612, "uuid": "7b84bf0f-e649-4270-a194-a09931d26285", "comment": "Malware payload (Efimer)", "value": "1f5e039a824c3bcc2e3cbc8de1163c4106f7b5f6bcecb709712371abfa614fa9f6ebd3f62c5662673b52f3ffa2e7cb75", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120612, "uuid": "bbd4355b-e4c5-40e9-b304-2ee706e3c059", "value": "T13CD6330CA2E261DDC677827876E216F4BC39F43C4172DE2A9E60D7F05927A21CD6588F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120612, "uuid": "167cdba2-fb50-4bb8-8e15-1e8ecfd7527d", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120612, "uuid": "dc4fbea2-3eed-456a-9434-8eab0103fb4f", "value": "393216:+67PB5zWr36TdC9BgbNYXMCHWUjXJcuI3/PGTAI:+SPyr36s9CbqXMb8X+H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120612, "uuid": "d52c76c3-7ea0-47bf-932d-57d0c6d7874b", "value": 13861669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120612, "uuid": "71334d38-bd71-4cb2-949e-2f7e83619e3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120612, "uuid": "4da82de9-e907-458c-921c-ad2fe4d7d334", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d13f026-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089930, "uuid": "af89bf2b-a316-4f9a-add5-4400f299f76a", "comment": "Malware payload (Mirai)", "value": "43edc56dea275d6c1a3ee1641bf5a463", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089930, "uuid": "76f87426-a372-4d68-ac38-490491682fcd", "comment": "Malware payload (Mirai)", "value": "cc14cfebfcae7511ddaf3ca1f2d29eb3ea595ca2c97ad99df2de8f64493d36d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089930, "uuid": "cab2e8fa-aa17-47ec-b01e-32e202138f1f", "comment": "Malware payload (Mirai)", "value": "612c75c46f6048b849c3483631f3736753d23951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089930, "uuid": "0fcf6ed3-ccca-4a7a-804d-39e5a0e3d760", "comment": "Malware payload (Mirai)", "value": "b2af8cbe9d7d67fcfdb59684063312bfb68670594b778e2b8c89086fbc54b965b768d6017bad7eea147e8a4216ddf10a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089930, "uuid": "10f3cd0e-ce16-4a6f-a55d-cf56558852c4", "value": "T156739E23C876189CD26842B8B170FE3A53B3E51056572FFB069ACA7A9447EDCF5493B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089930, "uuid": "54f50ff7-f441-4af3-bcd6-583e3a1e5296", "value": "1536:0/Zd1XEc589PGmE++KrpgE7YgJMiCYKkN3skS:0hd10L9erIrbhJMiS68kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089930, "uuid": "8d0885fa-4cd9-48c1-98be-2634ac098c43", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089930, "uuid": "20be62fe-8f06-4d32-a77b-d262346a6463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089930, "uuid": "7edeb9bd-6760-4644-b261-0f35ae5ef9c4", "value": "windy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd74bfe5-525d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779069852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069852, "uuid": "1ab00a6a-ac6e-48e2-8f2f-b158efb2d6f9", "comment": "Malware payload (Mirai)", "value": "6423df9ebc310172f7a06b919dcc9892", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069852, "uuid": "52d35ed0-9b7c-499e-9523-d149d4670ad2", "comment": "Malware payload (Mirai)", "value": "cc1c4b2fc00f127206103fe391dd73bd7a8939b098d5c7eb20505d21b23e819c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069852, "uuid": "e0fc9123-7389-4389-8608-6b209a686043", "comment": "Malware payload (Mirai)", "value": "ddfacf6dd3a791b0ca88b1806fe5542a9162df53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069852, "uuid": "a2870ad7-b046-455e-9c62-f52ee2e44d3b", "comment": "Malware payload (Mirai)", "value": "de4cb9eb468f642d21e4c526b383123d60bc114dfbb69e906bc5813990acb2c8d3922011322d5a8aff1cdc82cf3c8b70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069852, "uuid": "7453c851-a188-4ef2-aee6-83d23e34389f", "value": "T11D5302D141E1F475CA2293B662048F062689C9927B09CCDC30DE025B6D9FB4F5FD9AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069852, "uuid": "4d1698a6-af57-4520-a5b9-546ff4322a3f", "value": "1536:LznwRRM10ac1B010ZtaS4SV/zQUjsPwttl6olleLkg4azHp:XrREB5taUVLQlwtt0a4LGazHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779069852, "uuid": "cf7f81f0-e3b1-4a2e-8d98-3fae6b8a166b", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779069852, "uuid": "58460ffa-6fb6-456b-86d2-d2881abbfe47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069852, "uuid": "50206114-bd86-4f45-9923-5535ccb8bdc4", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd5311a-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144183, "uuid": "5779eee3-5d40-4656-b3a8-758ee2cdbbb4", "comment": "Malware payload (Mirai)", "value": "b3ded6fbdf89e400fa81c71f314ad25e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144183, "uuid": "a1fcaea0-cdcf-43cf-a0f0-56435dc9deaf", "comment": "Malware payload (Mirai)", "value": "cd0e36da40f4583fdf0d7db3d5660981a2e9ae985e48b71824b6395570195279", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144183, "uuid": "2bd84c42-2dfc-4e59-8710-6e4a7ec23137", "comment": "Malware payload (Mirai)", "value": "d8d0e3731292b7a816a7c7c989290a181d67e501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144183, "uuid": "80771062-4c56-497d-93f7-5f0f1fb6cd3c", "comment": "Malware payload (Mirai)", "value": "f6c2c006435d2e2ad561f3ae9d46a4e7ee522ca9c11f913f1f51a9de4ce7d7359fabdb8687f46eea1aa38852f3b3007f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144183, "uuid": "2a9e191c-77ab-4cc4-9618-a740a24be8a2", "value": "T11FA329C1F68B84F9D54B48704066F33FCE32E5268071C96EDF99AF36DA37641921629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144183, "uuid": "9067ab53-1a03-4129-9dc9-618ac6dea413", "value": "3072:ZTdeqPbQ0yhOEckEUI6An128egcTz3E6SNCoUKcnsEW+Qu33K6V:ZTFPbQ0yhOEckEUI6A12ZHTz9Kmn0jCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144183, "uuid": "a214bced-f207-4e9d-bbbe-8737e6a337bd", "value": 99508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144183, "uuid": "ffb084f3-6687-4bdb-84e7-ca0f950da679", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144183, "uuid": "58f637aa-2d8e-434f-8513-22235165a908", "value": "heilong.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97dfa7b9-525a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779068447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068447, "uuid": "1522f557-bbdc-4943-b6fa-1f504443a0fc", "comment": "Malware payload (Mirai)", "value": "c1548b4c77bdb3e07484e6b1fac02f84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068447, "uuid": "fcf4b3e9-db10-4117-a212-19770e9207be", "comment": "Malware payload (Mirai)", "value": "ce4caa576aeebbf2698798c62addf2ac2474e973f06ad7e27e354c116cf01ec3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068447, "uuid": "be59e8ba-1ec3-450a-b2d1-4e7df805932b", "comment": "Malware payload (Mirai)", "value": "1896d5bc404c668d0b939d22f7046a2e4ab72e65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779068447, "uuid": "5130d384-3308-4d44-a1ea-2ec634944920", "comment": "Malware payload (Mirai)", "value": "1711cc30c4b21ee4ce31c8c918a40b5e26fe2619e36e5c3ddd9e15c9e43c0aad4fde227c229e2af1bccfc4a231cfad71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068447, "uuid": "3acb6436-9dd8-4d74-848e-854214ba2704", "value": "T15ED35C0A78D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068447, "uuid": "400769f0-aac4-4e2e-b95f-eabd4b93729c", "value": "3072:lAFWsh8fkY6i3iP+9gK8JYYvk9d5dAl8tFEU84YTO:yssqf/3iPcgrerAl8fEtHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779068447, "uuid": "503714a5-acd9-41fb-b9bf-c51b5ca461c0", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779068447, "uuid": "17924c6d-aba1-4be2-8bcf-9a96893147ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779068447, "uuid": "1a6ac97b-93a6-492a-bc43-68776caa54f9", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801f5c5b-52b0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779105344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105344, "uuid": "0adffdaf-9f7c-4ac6-9e06-d08f083f3718", "comment": "Malware payload (AgentTesla)", "value": "55a517613c2242a3d4d46020bd487d40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105344, "uuid": "269afa9d-b5f8-4638-8406-23ac52be3309", "comment": "Malware payload (AgentTesla)", "value": "cec492f7d828ff05e0c1bdbea31f36b0e66dd58d4ae2e909f3e6a9c15dbb904f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105344, "uuid": "8dda7949-4029-4269-b7be-f12ab93d3244", "comment": "Malware payload (AgentTesla)", "value": "72c82581b8c24c76a6abb513976b9fe2717b4b06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779105344, "uuid": "93ba29e2-91fd-4a55-a39a-4f710118ecea", "comment": "Malware payload (AgentTesla)", "value": "b3de671a9848e878b2bbe054b978213fa79647c64f4a3d304e8de2aeeda83e615e1b364c9d964ceea50e446661073567", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105344, "uuid": "a99b20b7-5861-4c55-bb90-4a6119ca2402", "value": "T16554122637A4D1ABD26742324E65C77B6EF6A51A00F9425F53F46B0E7832291CE0FB43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105344, "uuid": "4487c877-ddc0-4685-8ed6-526208774f72", "value": "6144:6gORay9pfRg5gL+ufM1LlIYRw2PE8SZrn:6g+9LgS/fM1uYC8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779105344, "uuid": "0cb98608-1e80-4e0d-aaa0-b6758eb1c4a4", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779105344, "uuid": "11ce87d8-323d-45ef-a032-6c4642dccb68", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779105344, "uuid": "fc24f06c-95ad-49c9-89ab-670ad17a5ada", "value": "0000999287273665341.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbe2516-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089932, "uuid": "ab7da7ad-e617-4c54-99b0-0edc7574f51e", "comment": "Malware payload (Mirai)", "value": "3314d2e1b4e08baf75f46522abbae7f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089932, "uuid": "9965eb80-4721-4f52-80dd-e629c7942d96", "comment": "Malware payload (Mirai)", "value": "cfb7568286285bb93c33d4604d8a12ec0f4d1505164b7c8569ac16b009853b0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089932, "uuid": "923eebfe-eb28-4696-bebd-e2bfa30525b2", "comment": "Malware payload (Mirai)", "value": "7e8942b89b790899ba2743789200d36f1cebfe0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089932, "uuid": "ceb9fd65-84f4-4829-9b89-659292c914a4", "comment": "Malware payload (Mirai)", "value": "419d01d895bd1d61bb6504cca5b24cac8bc3612a792598e2e37e945f55fbe6c6bb003d1f29fbef580275dfc65cbf5b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089932, "uuid": "371ff9aa-cbbe-4504-b04c-b1abbf1a0e8c", "value": "T17003F15A59AADA09ED3B767E00BFF14F4440AB3F0505CDA641C069BED9B923118392EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089932, "uuid": "b12152f5-4ff3-4e5a-ade0-0c8e3b353e7c", "value": "768:meAW+GkX7xgBSxKLgTcSw7S6YPDCxu4C7Se8xKPgnml9ND5j0/skA/vnbcuyD7UK:me9sGBSxKcTc3e6YPDCuS7sgn+9tIGnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089932, "uuid": "300a994c-bd15-45b2-995a-d93802341e23", "value": 39676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089932, "uuid": "a45be38a-c178-4f75-b9f4-2e6d36a5c4da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089932, "uuid": "e9f9aed3-ab78-4761-a9c7-d9a919bcac4c", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7909bc6-52a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1779101195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101195, "uuid": "f763e8fd-ed06-40fe-a333-07cbe0c8bb27", "comment": "Malware payload (RustyStealer)", "value": "af64a60ce7409a82976bceb2c22b0c11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101195, "uuid": "96e76579-25b2-4519-b91e-56b01ba74c71", "comment": "Malware payload (RustyStealer)", "value": "d0423b722c2a51b86ba338ba91de2c693c8681b82d1b0c1d4c8b3951971e4bfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101195, "uuid": "8a7279e2-0012-4e1e-8fdf-b2ff74fe6bc4", "comment": "Malware payload (RustyStealer)", "value": "a79a2032744434f29ca9564f8c5610aa81cca0c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101195, "uuid": "a30da82b-93c2-4e27-937a-8ef584385bdf", "comment": "Malware payload (RustyStealer)", "value": "b135434871fec40c1aef221f9b1e497e548e773e74541d40dc26582ea9b7d134fd78cc9283ec09f7182e43a61df641f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101195, "uuid": "e369d099-c376-4633-b6f6-e5165387a94d", "value": "T182068D83B2B55265E9B7C13486A7952BD6727C038F2499DF125CB3186EB36F01E3B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101195, "uuid": "c391c871-a44a-4b33-820a-975add57addd", "value": "f4ebb49bc19acbf0441a4e7b4b3620fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101195, "uuid": "c5703360-cb51-4d85-b306-eb48c8ba9795", "value": "49152:VmkDXrtkeSKReJYXRAUY2mwhWXs/g2lciKGJsv6tWKFdu9CaPTvG7FDpHFhh6Dhg:w+h/k8IZJGJsv6tWKFdu9CaiT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779101195, "uuid": "85287eca-3664-463c-b11b-5dc5b236f14c", "value": 3680768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779101195, "uuid": "611c747b-cb37-4844-a457-aa1c5afb02a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101195, "uuid": "15bfee8f-4097-4e4b-bb39-480027220f5b", "value": "2026\u5e74\u7b2c2\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64b9c07-52bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779111958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111958, "uuid": "96efcbc7-0982-4ac8-b542-8039a5637e9c", "comment": "Malware payload (Mirai)", "value": "264818ce53c1278c6add6e9a45b305ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111958, "uuid": "d3a5e57e-b2b3-43d2-81cf-8e9269512669", "comment": "Malware payload (Mirai)", "value": "d0e4760213da482b7919595e19e82c0639aa81b0202788c8e347661a8e1b9e9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111958, "uuid": "c26ef442-c9f3-4679-bae3-1d2c2b495c0d", "comment": "Malware payload (Mirai)", "value": "2894af65a7e1e4b85491aeee8c80f0d18d1b0165", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111958, "uuid": "bf9dfe5a-a3df-4e0e-8406-59a9f13c6fb2", "comment": "Malware payload (Mirai)", "value": "fa73058014c02bcefd449f91c52939555e7f67dd5b2609e1ee1c453e81371744c45f619e76db33da0abbe21efe515bbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111958, "uuid": "5df00766-f529-481b-a64c-a6feaf2874b5", "value": "T1AEF33A46FB808E17C0D61779B69F42153323DB6493EB73069928ABB43F8376E4E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111958, "uuid": "700d9e73-6fa3-4783-9996-ee28d1264d82", "value": "3072:9bbGUzZcD7Dla94IrNNB84rkS2WiX0mU+GL/Kr//Aym:DzZqvla94IrNNe4BiX0mAL/KrAym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779111958, "uuid": "07e54a1f-3eff-4532-bdc2-99ec5f9ac8a3", "value": 164200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779111958, "uuid": "7dc247b9-76cd-4183-96e8-cf542cc40be4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111958, "uuid": "69ef49f5-38c2-4493-bbdf-1790fdf40726", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a22e3d0-5254-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779065766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065766, "uuid": "b245e662-3d11-4f74-a4b2-760c2ad1b4d1", "comment": "Malware payload (Mirai)", "value": "2c82ea38f9fa237a7125bcf6a9cf7e70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065766, "uuid": "a2074ffc-096e-43d3-9e29-e05602222d73", "comment": "Malware payload (Mirai)", "value": "d14c74090ba2b183fe952c7ad87b71b40eef829c13504194fa59963acecdfd3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065766, "uuid": "71b17cb8-73b0-4b09-80f6-8561490b4562", "comment": "Malware payload (Mirai)", "value": "7117cd5ef4f2e5ba49ffa42bbfca7f8ff4a76686", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779065766, "uuid": "e4cf4233-28c2-461e-af1c-b6bbaad76f66", "comment": "Malware payload (Mirai)", "value": "89d4ad15c806dfdf22cf77df39342311c9b79e8bc294fd0ab3761b46621d4a56c1299bf9b0144402c57dac384e6d1435", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065766, "uuid": "a68f770b-96e9-4e79-965c-50b48a53c845", "value": "T1D9D38DA4AA1F6C82D3C3E7BDAC650FA3712B38F48255C1B66B00554DDDEAEC48C92177", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065766, "uuid": "4dcbb32c-483c-4c1b-9e88-88b864ba5203", "value": "3072:t+iypClZ9/tkdogqr3NC+w28mtrKca/RLKhRW:t+iypClh4+7NCQJtRa/9KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779065766, "uuid": "df43fccc-7b7c-4c4e-9a24-74baf2d3e974", "value": 141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779065766, "uuid": "0ad931e9-e22f-489b-9f49-b0112a5bf4df", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779065766, "uuid": "255b1596-e6e2-4f74-b60f-8a77dbb6e1b1", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fe4850-52a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779102501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102501, "uuid": "e09f2341-c2ae-4271-9328-d68f9685768a", "comment": "Malware payload", "value": "bb851ca4d9f938fadf70391dd42954da", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102501, "uuid": "4c39a362-1086-4881-8eb9-6058f675b6d6", "comment": "Malware payload", "value": "d218c6a408aac1ed96d166aa142c4535726af2767bbf473859df0e1091b9be81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102501, "uuid": "72df5356-49c0-4a6c-a3fd-f31b105f9cb0", "comment": "Malware payload", "value": "fa1704b25bed1e141af70ce8f5f2893dac58884b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102501, "uuid": "d63f1d94-f191-4305-8543-3fce7fe689bb", "comment": "Malware payload", "value": "90ee2d05577f031e75a0031b9484af7fffe075f67a4be8f37dfa200061af33fde324c1d392f1b6a63d5bf711bf10296c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102501, "uuid": "152a353c-eb4f-4781-8413-1c699c4b72ef", "value": "T1AAF4595197EACE4DF2B31F159EB0F0626827BEB1183DCA6CC549178D06F39488861F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102501, "uuid": "8b4742f3-569a-4883-a38e-3f6e4809117d", "value": "3072:k9EuC50OE1Zr/1VfWo50YtLtz0d1pOkEhyi0cCOVaLWPwmhf3Zq7ySwGGbpK:ufWo50YtGBOk7mK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779102501, "uuid": "42251350-6d21-4a12-b711-c073ea7e612e", "value": 786100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779102501, "uuid": "a30fb7cc-9dd0-452f-968f-4cfd91fba557", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102501, "uuid": "56f6dafa-d43d-4c7a-bed3-0b805fd450e2", "value": "TT_COPY_MAY2026.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be67bafd-52b7-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779108455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779108455, "uuid": "60f17f29-b63b-40fe-bf8b-7a83e32d6eca", "comment": "Malware payload (AgentTesla)", "value": "2442f533eab5c014938acccdfc7805c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779108455, "uuid": "571e81c4-4faf-45eb-8480-8e2f518a88a7", "comment": "Malware payload (AgentTesla)", "value": "d2fc36eedc354152ab7bcb96436c54c45cdd8fda7212cdc1ddbe826f61acc457", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779108455, "uuid": "d4cc65a7-30e3-4bd0-954a-6f9a9728a203", "comment": "Malware payload (AgentTesla)", "value": "73cc4e8a3513430e8ea91f7bcfa6d32592cf79e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779108455, "uuid": "1ffb805c-af63-46a8-b231-176cbb5e5abe", "comment": "Malware payload (AgentTesla)", "value": "d2a363808527a018a5c6bf4b86439634a16a3fc8309aaa1dde7550c831af846ef14b7679080f41f44f2e63d162b1a04c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779108455, "uuid": "cf608587-ebdf-44e2-b155-9cc6801777d5", "value": "T145F51A9226E6D223B360EFE9473EED30D40E8453194A8F10759ED73C391DE49A23A767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779108455, "uuid": "ab72913b-1c70-4cde-b0cd-d91574dd33db", "value": "98304:ipUSSs7qZ2nVhJ4OIYy6CC8CHJhJWVYE70LtPN7bJxym5Nu9H2Bl/05dC4v4ceZS:cnGYy6CC8CHJhJWVYE70LtPN7bJxym5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779108455, "uuid": "5f01a76c-f810-475b-86e5-81cf74f5dc40", "value": 3470082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779108455, "uuid": "00408233-385e-4267-8e68-2fd9ad13ce32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779108455, "uuid": "383d4107-6c23-4d6c-9883-76cd96b74e34", "value": "SDR-DSP265012.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc186325-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120960, "uuid": "1a6bdbd9-8c8f-46ad-a1ef-ac76dcecd310", "comment": "Malware payload (Efimer)", "value": "15cbd528ba28d39e0dea4b9bf58d68e5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120960, "uuid": "d017fd80-15d8-4da1-a4cb-cdcf8fca901b", "comment": "Malware payload (Efimer)", "value": "d3cda7d5cb54fdc38b7415c69705e7dc1491b6a8d2c8685ba12a55d3e0fd48a1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120960, "uuid": "6f225310-7fb7-47e4-b942-e979e9e042fd", "comment": "Malware payload (Efimer)", "value": "637bfe45616adb94c315d6a7e2dff74581951cbe", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120960, "uuid": "a6f46320-606e-4f1b-99fb-5e51985d7ee5", "comment": "Malware payload (Efimer)", "value": "57416969246ab4b4fc663b6eaaa28e40f497a88f316851cfd029a070be3f3e548f1a9478563eacc17a0377292b630edb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120960, "uuid": "51c7eba7-8ee2-4e91-81e1-19900b276370", "value": "T11BD6334CA8F1B1EDCB77C8B4BBE2B9F4B059B8B50175CC2D0B20D7712C67591AA2D096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120960, "uuid": "b74694ae-391b-4c9b-b446-b4d42c96ccab", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120960, "uuid": "29ff5d66-bf66-446b-8724-b7a2d63980c5", "value": "393216:qsOtZQI2jnOsG/tkGGmOXMCHWUjXScuI3/PGTAI:9OtiI27JktEXMb8XvH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120960, "uuid": "a8bd66a2-73b2-4266-919b-d2dbb0b8272e", "value": 13803547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120960, "uuid": "92d28639-6d5f-44a9-a799-8e26c777b127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120960, "uuid": "5fb5ab52-e4e5-42b7-9279-83b5cf747642", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311f22c7-5284-11f1-a769-42010a9c0008", "comment": "Malware payload (Xtrat)", "timestamp": 1779086313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086313, "uuid": "ae719efc-9e14-4c4f-a67f-e7aa1db7eb1b", "comment": "Malware payload (Xtrat)", "value": "c5040b4056bc829591e744f0067af76e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086313, "uuid": "31465419-03b8-4f03-94c8-712f58a26f1a", "comment": "Malware payload (Xtrat)", "value": "d40e990952381a185b49189ddc8cf7e7363439be73a85ffa438310a6ecf6a64d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086313, "uuid": "f0ace671-328e-4ec5-bed9-719da8b5eba8", "comment": "Malware payload (Xtrat)", "value": "38a40da3f7eb0d7d1946bf4f4456c4159b71a3e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086313, "uuid": "375e3269-4209-4969-8934-c9b7c52d4e3b", "comment": "Malware payload (Xtrat)", "value": "b2730c69e4fe2b72d5f07ad6bd3ef7a481faaeec91aa7df4a06dd0be278cbbae95c25866dbc7457a75ea9893c00048de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086313, "uuid": "052f6081-084f-4ed4-b243-edf328eb4eb2", "value": "T15DC2E0FF7B7DBAA3E0A1C67919C5E55A0FB682B981FE0330238121B97DE40420D72151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086313, "uuid": "0c933904-abf0-41b5-90c7-83b9c949b475", "value": "84274b3201a70dd3d5e1916ec9dae2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086313, "uuid": "2d336217-78b6-479f-904e-18536aaf7a49", "value": "384:Upj7eNmfp+UrM8j3Mk8mw2Qwz9cEVWNuOuuOYPq8P9iYwbzuwF+AegoT+d8r3:JmfpbM8j8wQwz9caAuxYyuiF+pgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779086313, "uuid": "e9dfeae1-4d68-4278-9bc6-49871434977e", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779086313, "uuid": "3d417b1a-fa22-46f4-8317-1f16c11b3afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086313, "uuid": "a20561a5-5e89-4892-903d-41f44baf2ba7", "value": "Leons", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bb87ff-52b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779106392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106392, "uuid": "f72cc1ab-49db-4403-a138-4bb090a76458", "comment": "Malware payload", "value": "da99eed41e7d6bb4a382c862a84edaee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106392, "uuid": "186300dd-4d2b-4a0a-a50d-5a344e1c57b8", "comment": "Malware payload", "value": "d4480f03c89f211d955f631fa3d586c893503e26b771d97cb23f77d51178614f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106392, "uuid": "f8acddb3-df75-4552-8713-34f1278e2b44", "comment": "Malware payload", "value": "e655e90705fc06dfaa8ce955a9da0ddf81de528d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106392, "uuid": "b4974cbe-197b-4e37-87c4-b32ee9cef8d3", "comment": "Malware payload", "value": "392389f33b73780c794e1a6d46856e5f95577b3a713beaa13cf914c950bd66acbe6b79ad531f37f0bcda6f2c4291c459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106392, "uuid": "c4d3129c-25a3-4539-998d-49abc248b2f9", "value": "T15EB67B42FE8742F5E903193154A7737F67394D064B2ACBC7EB407A6AFCB7292093A245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106392, "uuid": "8cc9805b-b3c2-4475-aa83-c6a3aa1dd476", "value": "c6fb30ad4dce883317a7260ffcbc1a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106392, "uuid": "32c1329a-c6f1-40fb-8cc0-6073ee61d3bd", "value": "98304:7gEtxDYA9dLyaU7vZpTdcyOJWT18+PPREW3U9LGYUfnSJLUVg78QaiZIsGukWQOf:7tDZtOcyOJAPy8yLKSJQg4Qca7QOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779106392, "uuid": "228e0744-d517-41c2-b612-56c2b3b6c1ab", "value": 10552832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779106392, "uuid": "d68639ae-0acd-4edb-b84b-58628140f4c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106392, "uuid": "8370f22f-732b-45d3-a8e1-e93574f4c7aa", "value": "bot_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28544d4c-52c8-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779115504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115504, "uuid": "258156ef-1666-48bd-a6f7-d9a67a7b1734", "comment": "Malware payload (NanoCore)", "value": "2e4bd92998242a2574aeaae3797950e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115504, "uuid": "ec443dce-5895-4f6f-918b-3287f73f925f", "comment": "Malware payload (NanoCore)", "value": "d6b9db7ddb8860457f3eda9151308d87e72b51deae13e16c0436bd87a76689f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115504, "uuid": "ebc49cac-4a03-45c5-8fe2-365851e14a46", "comment": "Malware payload (NanoCore)", "value": "9ed3455f8ce594404ac0635dea8d919263bc84a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779115504, "uuid": "5666e183-5a01-40fa-aac5-a20a81a194d4", "comment": "Malware payload (NanoCore)", "value": "70ab431c0297721cfecccc1d2efea767afc32f6b7e02afebd040a13c65abeeffd727097963327bce9966a28a12f87df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115504, "uuid": "7946e94c-ec2a-404f-b342-0291d4d83d58", "value": "T1C614CF2637A88A3FE2DE8979611201129739C2E3D9C3F7DE28D455B79F263E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115504, "uuid": "50004a83-598e-4d86-8575-a7ab4556d6d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115504, "uuid": "b70b401e-74dd-49b7-89c8-9e2858093936", "value": "6144:MLV6Bta6dtJmakIM5g8GL+1WUQ52F+/8Ej4eX:MLV6Btpmk0GLUcQsEEj4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779115504, "uuid": "79f689c5-56f3-4a4c-bc89-0a5b88654175", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779115504, "uuid": "7a340010-63d7-411f-b963-482b374d587e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779115504, "uuid": "3e0ab991-953d-4680-b72e-39e3b353c2a0", "value": "supernature-x-site.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eea8e88-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120696, "uuid": "291702ce-51a6-4881-ae6e-f5f3e39b9e95", "comment": "Malware payload (Efimer)", "value": "8c52bcfa9ac254de06be5e8682d7335c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120696, "uuid": "4e7d4149-75cf-4ddd-a1ee-d446c6d6b6c9", "comment": "Malware payload (Efimer)", "value": "d6cae266ccce7cba92ff2312df8a51c3b2f4fc06db58e7f87cc3a93d6cd39fc3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120696, "uuid": "9e8e7d7c-de16-48b0-b6a4-e5cfcd12083e", "comment": "Malware payload (Efimer)", "value": "d7d69256ced5ed2a152b9f3b2ee970ec1abebc37", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120696, "uuid": "bab60eed-8894-4d0d-8f96-4afb93de0031", "comment": "Malware payload (Efimer)", "value": "b7c5d3bbbf5de55346535647f13746aaa06a26d15c0e4313e88dc8dab88544c9ce6857387478aa4e32dd3fff32080f21", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120696, "uuid": "807714c5-4197-425d-9b73-e5e865fb9c5e", "value": "T164D63319A4D720EFC2A6C07CFBD15FF6B47878B866386C69A634DB70DC6B450C96C40A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120696, "uuid": "1dd3d5e8-75ed-4c72-8ac6-89ba4893259d", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120696, "uuid": "114ffd5c-3b33-43c3-99cd-7eb7c9ef8b5a", "value": "393216:G1wXolvs8+ZfTlCn5IXdXMCHWUjX5cuI3/PGTAI:Ga/VfTlK5IXdXMb8XOH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120696, "uuid": "bf178614-e1bc-4b2a-a540-10a8296a12c1", "value": 13848088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120696, "uuid": "1e09b9f5-74ea-4120-9b0e-b1d82ba94dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120696, "uuid": "9ff802f0-5b2f-4fac-949d-4c3171d2d755", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e550e94f-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120975, "uuid": "eb863b47-a89a-4bbd-9ca4-786a8101b1b7", "comment": "Malware payload (Efimer)", "value": "f1baaab81a7264fce4c219b0f765b047", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120975, "uuid": "58a280ef-afcc-4f0f-98a5-533a937e495e", "comment": "Malware payload (Efimer)", "value": "d6ec23d41883bcc8ee26b6a2c38282f2d05eea765b9a6912d08766e3be1d851b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120975, "uuid": "a5f42f98-138b-4f17-a426-4136d7363dc2", "comment": "Malware payload (Efimer)", "value": "8c1e298fed7011f8996a2490f5d3335b35ebb38d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120975, "uuid": "a2dfda27-0f1b-49bd-90e5-dd45b61b37b2", "comment": "Malware payload (Efimer)", "value": "1d41d3441b64b1e4f3d7b7720b6f7d2964303b498aa42b69fa21f8cf3e93e0a70a8db3bb4e45491478bbd76272b262a5", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120975, "uuid": "2d807012-a029-4baa-9422-ceb51002f58e", "value": "T13CD633183BE370EEC7A39078AEE41BF0E1247138E7764A665F68C771D86B2C0995D853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120975, "uuid": "f7ce9ca1-1403-418a-a23c-a1c0675be25e", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120975, "uuid": "2fd08dd5-d59c-45ef-8a98-11c4d3ae29da", "value": "393216:YolbshNB0d+bMTDO3XMCHWUjXncuI3/PGTAI:Ysbcjf/3XMb8XcH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120975, "uuid": "2c6f4b91-ce06-4577-8451-bea8b41fbd02", "value": 13872437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120975, "uuid": "37efb329-02ac-402c-a28b-5ac973cd2097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120975, "uuid": "1984b349-9ceb-410a-97f4-b44f5c22b08e", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82b128b-52bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779111961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111961, "uuid": "1a3fe119-ea80-4c40-9ec6-f417aebfb139", "comment": "Malware payload (Mirai)", "value": "0231a6d43135bdea90b7cf82f3940da1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111961, "uuid": "63eb7e69-f5d4-4aba-9324-f8c9addb8620", "comment": "Malware payload (Mirai)", "value": "d747a34752793ad79fcc13b1799f06783b7d09ee7930f9cdd3180c99005a4019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111961, "uuid": "b8c6ebd2-411d-4fac-92c9-2be01c569e9c", "comment": "Malware payload (Mirai)", "value": "36628778774ada83ed9759fd32c2b0383e1d9008", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111961, "uuid": "70f5f664-8aa4-4dce-bfe2-200fbfb6cfcc", "comment": "Malware payload (Mirai)", "value": "bbacfd620d0a6492a0529efc63784a00339bf25e132324ac60bdf15c7aa63061de6376137ac4106861e7cdb4f1ef1cba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111961, "uuid": "70e49cee-4e4a-404d-943c-fd45e2bef122", "value": "T17004871E6E228F6DF668C73447B74D249B6D23D626E1D684D2ACC2105F2039E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111961, "uuid": "531a2aca-5a94-4f17-9087-039bac6443e0", "value": "3072:dD1sW+x54ZWJpgNWScamL1wo+UL5CuHU226IE:dDr+x54ZW/OG2o/C92hIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779111961, "uuid": "d3828892-006c-4a3e-974a-2a123873a1c7", "value": 177544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779111961, "uuid": "d52f3d63-1053-4f4c-8bb2-5b293187b2ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111961, "uuid": "1dc5231d-53fd-4ff8-a516-3f14dfc654e3", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efd9fd3-52aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779102819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102819, "uuid": "309ff082-705a-4d4a-b808-d0f9a6296982", "comment": "Malware payload", "value": "0917b15b770c0ed6c285ff1f74ad75fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102819, "uuid": "a8ae8d7f-1cc8-497f-b8cd-52d26c317fb6", "comment": "Malware payload", "value": "d785392a4352a2b167e8e0b49bff0aeb911c45da5c1709be2cded70de88fb5df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102819, "uuid": "52c570b7-afd4-42c6-b3ea-13c7a6044836", "comment": "Malware payload", "value": "b8eaa0018467308fed43e78dfda811d7a6ca8bc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102819, "uuid": "dafdd612-b258-41da-ae7b-7eab5054fd93", "comment": "Malware payload", "value": "d86e8a96a3ce909d7b7ce3907230699c65d60924e0b4e0365b6e695fda8f44a55236c4dd92782c5b376c31a713a60868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102819, "uuid": "da0edf8f-f676-4697-aaec-3d760cb345d1", "value": "T163C40206BA842640C5A46975C1E3883852F7E8DB3BB3E3463E4417CA8D963E4DD5BFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102819, "uuid": "ed4daf40-e306-45fa-8191-4e475861b8aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102819, "uuid": "ece99c24-a189-418a-a820-6dfd07a635d1", "value": "12288:JS7Qto5U2XGKJ34zRBqlO3PjZQIUgfdM9YN:sQimM3IzV3PjbFCmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779102819, "uuid": "73b27fa0-14d8-4b46-a74d-4127ede965db", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779102819, "uuid": "68f73bcd-5daf-495b-88e4-0ceadb6faf6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102819, "uuid": "13592864-0a5d-4ead-8d36-0935eb660305", "value": "0917b15b770c0ed6c285ff1f74ad75fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3a53ae-52d8-11f1-a769-42010a9c0008", "comment": "Malware payload (ZigClipper)", "timestamp": 1779122413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122413, "uuid": "b4f02595-e3f5-42cf-b9c0-b95a2691fda4", "comment": "Malware payload (ZigClipper)", "value": "648e9e223e8e8a7e67fbefb43f9f07b9", "object_relation": "md5", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122413, "uuid": "d47d679a-fd57-46e4-b6c7-1815fecbb239", "comment": "Malware payload (ZigClipper)", "value": "d7bfba6f3028a1a63e298711aa89b8829d2404e5707657e01389683284bf42ec", "object_relation": "sha256", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122413, "uuid": "49a73788-6da5-45bf-871c-08c994af5970", "comment": "Malware payload (ZigClipper)", "value": "8dc11e83efe86623d64bcb42144a2f7191a152f9", "object_relation": "sha1", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122413, "uuid": "09bb5874-13bd-4dc4-ae11-112d1310520e", "comment": "Malware payload (ZigClipper)", "value": "ee89e44f13b170cfffb4fcf28480d4bade43195cefcdbf6b4fde2a1f8f19401edae1b5e8272196643bbba0d496a9d0dd", "object_relation": "sha3-384", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122413, "uuid": "5ce695af-9a39-4d98-8e1b-8017626dbc51", "value": "T1CDB512D3DA8401E5F4379B75A0F70C67073A3C3AE295269E1A88721506F3491AA7BF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122413, "uuid": "eb033346-f366-4bb0-a374-17047d9d37ee", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122413, "uuid": "fce60845-85e4-4882-a624-b3faacc9f5ea", "value": "49152:VjwmzzjTPpNQ2srldigpwSgCMyOXp4AD7acAnffdTzLONznDfOUxqWM/C3N:mmzzPl+pSCMyGWAvWVHONPfVxf6C3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779122413, "uuid": "69d09d38-372b-447c-90a3-045187e4408e", "value": 2367488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779122413, "uuid": "bcf86c64-3ab5-422b-9530-676c92e6137a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122413, "uuid": "b9bb9a44-2bb2-453c-894b-f0df51a84bd3", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef036072-525d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779069882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069882, "uuid": "faea83f6-9d3e-4a3f-b68e-ad556df6238b", "comment": "Malware payload (Mirai)", "value": "ea7baf9ae4f371e4d0a6917ce214a4be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069882, "uuid": "061167af-af94-4126-b1d1-8550664f46fd", "comment": "Malware payload (Mirai)", "value": "d80eaf02bb44b9c33821443ded56dcbbcaac6cf184dd3a6726b0eed6823581b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069882, "uuid": "80bcf097-eee6-4451-9a26-e0bee857dc3e", "comment": "Malware payload (Mirai)", "value": "3eca7facbf785604763d156ab856957afdabb93c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069882, "uuid": "c6501760-5cd9-4061-b1d8-bf01743bb670", "comment": "Malware payload (Mirai)", "value": "15984d523053e977b3fa82c205b87c187c1047a9d3393843de161d2255826daf231c7c9867a137da645437b4cb5a100e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069882, "uuid": "99742af8-0e81-4119-bc48-e25b84393e91", "value": "T1CCC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069882, "uuid": "543a16d5-3634-486f-b198-5f99de5c9f79", "value": "3072:36tJsoRNjmj1VGCLUZMIV9Sr+QVrxZNiotw:VoRNjmj1VGc3rRioS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779069882, "uuid": "cd35db67-916b-46ef-92bd-0a621047b736", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779069882, "uuid": "58e51d14-6082-4b18-9c1e-5df2c9461b2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069882, "uuid": "7a8c76a9-4709-47f0-929c-cd117c899dd9", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08933c42-52d9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779122753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122753, "uuid": "0d373990-e88f-4f1d-bf15-f2e7e1c23da8", "comment": "Malware payload (ACRStealer)", "value": "e297bc82f19e8af894b080a6787cc5ad", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hs-imitationfinancialfootwork-icu", "colour": "#1ADBF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122753, "uuid": "d32c8bc2-8d8e-43e1-9de9-f98f47c5f37f", "comment": "Malware payload (ACRStealer)", "value": "d885da763c358d1c8244e7a14218fe233272f7d28156c031526d60da781670ca", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hs-imitationfinancialfootwork-icu", "colour": "#1ADBF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122753, "uuid": "25fb542c-d08e-4968-a50c-83c137f9ed0b", "comment": "Malware payload (ACRStealer)", "value": "ae7a6b89cba873c155970e10ad60df70587c2df1", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hs-imitationfinancialfootwork-icu", "colour": "#1ADBF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779122753, "uuid": "aa637119-250f-4607-9c0e-12578503c63b", "comment": "Malware payload (ACRStealer)", "value": "103d28d60375e491ccd317f17e13931e925951af11c70374bdef33693e3a123b0a0966f55cb86b786eee4f6be86a7be7", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hs-imitationfinancialfootwork-icu", "colour": "#1ADBF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122753, "uuid": "63163558-e435-41b1-b7df-d770e749c38c", "value": "T1BE65129187E85577E9F2877C54F343568AB2BCA70FE49BAF10D8707559A21C02A3E30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122753, "uuid": "6c22d42c-4aee-4a70-a53b-ccf2f597508c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122753, "uuid": "14895849-be89-48ee-9baf-aaf2884b0a2d", "value": "24576:Rjxeij42vQd4VkkQru8YwO3AsdNJW5Sbx4sYS3djKAHBSBqwpD:Rjoijfv04qbHfO3Rdxnx3djKAHBSBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779122753, "uuid": "4e282dde-4ee1-4989-be49-428863182dcd", "value": 1511424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779122753, "uuid": "e3208eb2-431a-4da0-804f-5b4ddcaaf11a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779122753, "uuid": "fe1e9330-9232-4ccb-ac00-36cfea6b9af3", "value": "KUUYIHJKLE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4615f8b3-52aa-11f1-a769-42010a9c0008", "comment": "Malware payload (ResolverRAT)", "timestamp": 1779102669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102669, "uuid": "13debb0e-3359-4be9-8150-228216e16e0c", "comment": "Malware payload (ResolverRAT)", "value": "7252bd7fed708066ad69b2754a465f41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102669, "uuid": "d5cae3dc-f4ef-477f-96dd-342511e7441c", "comment": "Malware payload (ResolverRAT)", "value": "da3fb304c21e2f7727b84a6b6a4627442225da41cb45bf939876172e048aa96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102669, "uuid": "dba3a67b-279a-4113-87ca-2abb54ea0e8a", "comment": "Malware payload (ResolverRAT)", "value": "cbbd5bd1bc61bfc9cfb9c080812cad587b6551ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102669, "uuid": "0d9947c1-fca7-4a8e-85d4-f0f84e3393c9", "comment": "Malware payload (ResolverRAT)", "value": "4787f53d8a2c263e592408778fa8c739409b1a8f6c833f26900c2a6dc213efd5110cb3032d8fb2d647e71d2bdc4f7cf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102669, "uuid": "8749c1f4-6475-43fe-994f-686ccdcdb6d9", "value": "T13DC402067EC41392DA94A5BDD0E7542403F2A9C73AF3DB8E3A4853D99E823E4CD17B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102669, "uuid": "31eb1786-4313-46f5-84e6-0f0c151f5f51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102669, "uuid": "eb9fedde-5b5b-4b92-9e7c-387384ba1bcf", "value": "12288:4KdCJiY+qLYc6M7cJq1MfauKvp4L/J4RLEERcllCiOxt:42CJ6qkVMcyMfan4L/OSE6llClxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779102669, "uuid": "d5f8edf2-3c33-480b-ac8b-8e1b417bf0f0", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779102669, "uuid": "512f4c2a-18bb-4a77-9c6e-0c5ad3e1e945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102669, "uuid": "e52ad255-70c9-40a6-9de3-eee3e5c35459", "value": "7252bd7fed708066ad69b2754a465f41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d447b3a3-52bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779111927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111927, "uuid": "29ab7ace-a82e-44f3-85d9-83e731f73e20", "comment": "Malware payload (Mirai)", "value": "4224c4e01ad92357d0042d9954e14ca6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111927, "uuid": "e08a62bf-68ee-45f4-b72f-9318d0fd7641", "comment": "Malware payload (Mirai)", "value": "da5fd0ebaf020f6c45a8bc60bee5181267ae3287562480e85e69b869dc2905bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111927, "uuid": "522ed29a-4e75-441c-a85c-1e8a02d13bb0", "comment": "Malware payload (Mirai)", "value": "71f08d55a5a44779cdb10643a4dbc85922e1c16c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779111927, "uuid": "79e63525-7b2c-4731-82ec-4f0bda19a475", "comment": "Malware payload (Mirai)", "value": "f1b2719eab2300dbe090d2e26af9d65159b50f7c52a30a4a2f011b56948e5139c9a2514745b17f8766661612c7e684ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111927, "uuid": "070de11c-a70a-4b00-b8ab-1d2435728fc4", "value": "T16943F257E1924122EE920A7A7E1BC1014F5D7AECB1C5C633224C41F96AF664728FFCDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111927, "uuid": "6172c188-fe40-4f99-bed0-d1dc194e2de8", "value": "1536:C5M9aI1iEvF9lODqGhHtLeIURmtutkGSd6+:Ce1H2Le7mct5S3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779111927, "uuid": "88c5f2be-5a81-475b-98ca-2edc3ce55cc3", "value": 60432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779111927, "uuid": "b64693e6-e46e-4001-a160-4b0d7da1f2da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779111927, "uuid": "49dec108-3fe3-4bbd-aab1-656efded5ce0", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88775e80-52e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779128980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779128980, "uuid": "c8384987-8de6-4f76-bdd5-b5a80c406f43", "comment": "Malware payload (Mirai)", "value": "ebf57e4149d1cf1c68ab6a78b921d10c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779128980, "uuid": "de08ed00-f6fd-464b-a7ea-6b82b0969477", "comment": "Malware payload (Mirai)", "value": "da70480e43082a144022b474c9140fbcd08629d663348d6ab0f485a4f43de2c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779128980, "uuid": "65bad0ef-ad58-4332-b55e-1d10c5c90593", "comment": "Malware payload (Mirai)", "value": "9e0e173013886af9c9eab2f03fd29f97a72ca423", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779128980, "uuid": "7079c478-7f41-4cf5-beec-327876325435", "comment": "Malware payload (Mirai)", "value": "4d74f6b5a1b4284a92c6962f4d47f4e8a19f87ca5eea0dd41d871e39150c49bfaee5ee172db54c4aa11892d5c57fdd23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779128980, "uuid": "f627e98d-448d-49de-8eb1-7c4be53a79b6", "value": "T151E32ACBFC00DEBDF81AE77748130809B230B7A145924A377257796FEC3A1991567E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779128980, "uuid": "ef54679d-388e-41f0-8b85-adfe5822647e", "value": "3072:iAQIe5RdLeJ3AFDYW32nRXwDVOjbi8LaqA9vgfynI3b:Vw+3AF8WGRA6Laqxyn+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779128980, "uuid": "132f7913-4b62-4937-a2e1-a6be6ceaff19", "value": 148044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779128980, "uuid": "72bd9891-cc3c-4c08-b2b7-37ee8efc95da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779128980, "uuid": "62c8d5f6-8ca1-4b99-959f-12f72c3527fc", "value": "micro.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8dafc4-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091027, "uuid": "b5e03c0d-d0ff-4784-b75c-de460f421f4e", "comment": "Malware payload (Gafgyt)", "value": "27e55bf1dcbfb4c36a34d2c56ef8f8a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091027, "uuid": "097d5fda-013b-4ee3-ad76-2ed37b2f718d", "comment": "Malware payload (Gafgyt)", "value": "da9387058dfdaeda6517959334ec6e8e11ff1d77401d447ec78a7397834aa21e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091027, "uuid": "83ae59a2-8280-4746-9d3f-85ac41a76669", "comment": "Malware payload (Gafgyt)", "value": "a0b4b83be19738b48a811853f1158aacaa842e68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091027, "uuid": "0ca11008-23ab-4ac9-ac3b-aa8bb0950b72", "comment": "Malware payload (Gafgyt)", "value": "b1f16cebdb49f6eeac770dac0c8979e7cb398e7c4ea995ba6eac9d70822baafc2e2fca104f1cc3eec8d41c7a494ce548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091027, "uuid": "8e14bff5-a929-48f4-b555-1005e28108c0", "value": "T1E644C60A6BA18EF7C85FCE3702EA461110CDE84A12996B2B7374E61CFB5E94F44D3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091027, "uuid": "bcf6c21a-8951-41b2-b9cd-aedfb4e2edd6", "value": "6144:ZqbXCA/qboJQwZdcvR76dqmB65LrZYdQT8zPxlop:gCA/Uakv5mB65LrZYdQT8zPxlop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091027, "uuid": "f45f6021-25f0-48b8-a313-31fc0d50a936", "value": 269535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091027, "uuid": "c40ae94b-f7f8-4ec2-a128-1f439f0b6034", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091027, "uuid": "fe52b094-5907-4d25-91dc-541d8339250d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3055d3a8-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091036, "uuid": "d3415224-6758-41e1-9b8d-9316132db2c9", "comment": "Malware payload (Gafgyt)", "value": "003721faf979b6cb83aba4a0498d086c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091036, "uuid": "07f3c623-5053-408f-8f55-bc5c454bbb9e", "comment": "Malware payload (Gafgyt)", "value": "db175e6e4de27d93bd2c49a61b41e92c9ec3e41e2c652d5fe5ebaf3031a9b839", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091036, "uuid": "48dc39ae-d238-4dd3-8580-6598793c8b50", "comment": "Malware payload (Gafgyt)", "value": "a4a5ab777915cec1c3e0b9f25cc2364da0623683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091036, "uuid": "530d28e1-ac94-499e-b048-3d3a6ab4ce9f", "comment": "Malware payload (Gafgyt)", "value": "23c1b5c791b4079e8fce0430f94eafe5a15ec76f28259a72e3511b60de9575f16fd2ca4a042c43dc9f9554b709a4494e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091036, "uuid": "6a398618-a807-4276-a09d-d84c7a282bdf", "value": "T1B924390775D08DFBC4C64AB41BDBA2628823FC390B366106B395FDA91F3DAD8AD19351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091036, "uuid": "2ad63b61-a0ee-4bec-8773-9e581a3e2778", "value": "6144:sW973uoO4TquAPF8yJdPgSumFuLm5a7E8ykt2tACW:sW973uoxT2smFuLm5a7E8ykt2tACW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091036, "uuid": "1bd7a09b-1ae1-4ba2-bfe5-60574fcd7de3", "value": 210703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091036, "uuid": "85a47c08-3afa-4cb1-9935-45468bcd952d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091036, "uuid": "10114c94-ad0a-47eb-a6b6-0ece8cb4be42", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2afbed-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779091115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091115, "uuid": "b7fe679b-6190-42a3-b087-47b9be45ad7d", "comment": "Malware payload (AgentTesla)", "value": "a24c8ed23e719e62de0cf78f5720fa12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091115, "uuid": "3869534d-a3f0-444c-80ba-68217867cd40", "comment": "Malware payload (AgentTesla)", "value": "dc08b2bac85e8745b5aaeab134df5b15ca0b796295d33a66da4f32f6409edc71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091115, "uuid": "9f140aab-f183-4bed-a909-bf1ed4da89b1", "comment": "Malware payload (AgentTesla)", "value": "942e79d6b28d38e9439e95358ae7f235b723f751", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091115, "uuid": "3f2cbc01-8204-424b-9263-ee1e81f8317c", "comment": "Malware payload (AgentTesla)", "value": "bfd3641145c08d304f30e1915e6f82dfac8474db821fbc1e0bc5d7d031399b12256685f617e1c0e427ecac2a22824fd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091115, "uuid": "f04dedc2-7c23-44ec-a874-bf0eabe3fa51", "value": "T1F8F5089226E69223B360EF99863DED30D80F94431949CF10759ED73C391DE46A33A7A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091115, "uuid": "9b0a2f59-0c82-4869-a65c-0254852a1db1", "value": "98304:fupVTGGPS6WPFojlyvOPjiuAGv05+/PFYQLaV6/kox5NTZHYcXENtupnU0xznk3g:WTGD6WPFoZyvOPjiuAGv05+/9YQLQ6/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091115, "uuid": "73cae750-fb31-473c-be04-4ae3d155ddd1", "value": 3470082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091115, "uuid": "8de28779-ff83-4d58-9ca3-7860907a445b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091115, "uuid": "693825c0-df90-4bbf-b2a3-83f66c3dce06", "value": "shipping doc ,#5261649396.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3297179-527a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779082210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779082210, "uuid": "7b65ca09-158f-4083-807f-2aaf3e5f5d9b", "comment": "Malware payload", "value": "1cc5fde0eb0ee65520eab9a0271b723e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779082210, "uuid": "1952e643-9911-4419-b99f-046725337d34", "comment": "Malware payload", "value": "dc69d2fd14aa2a93ef272b194ae31153138245bb56bb1bbab2783bf7e59eca51", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779082210, "uuid": "2abf5061-d4a0-4b70-9d8c-bf950f32d65f", "comment": "Malware payload", "value": "a3b14421e280b8357250a8a8327210617fb5e0df", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779082210, "uuid": "a1db8d29-db00-467b-88a3-cbd2771def0b", "comment": "Malware payload", "value": "96e651933ab88b7de12ec848f57cacb75cee5214b99975a72cd849215fa83d1520d3ae5c5763f690610c1f22dac8d464", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779082210, "uuid": "9f9e98a9-9ab7-4d17-8b6c-fec10d6799c5", "value": "T183352328890927C68662E4FD76077619B0EE73475F872793439E893436D40F8ABB3D71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779082210, "uuid": "c9125e0d-53bb-4101-a2e2-0794a9d4f646", "value": "24576:49RYdYB9zkGhXQnJ5r94qWmDOJjzBTkAS9lJVJ1Qu7N+Ot7HfI+EG:mrOEDRBKX3D+Ot7/I+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779082210, "uuid": "48642203-808a-4dbc-a7c2-d7dc805721c2", "value": 1098353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779082210, "uuid": "b752b72d-2352-4300-aad9-0a2d5348fbfb", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779082210, "uuid": "429941a6-7046-42e0-88cf-d5a48e9b4d2b", "value": "rPO18052026001.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a352b65-52db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779123829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123829, "uuid": "69d2af8a-bb3a-478c-851d-dcc26f81aeea", "comment": "Malware payload", "value": "5dd892b6ee1e4713a7a5e2be179603b2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123829, "uuid": "e9be2b77-9bd7-47fa-b125-c84517c5af6e", "comment": "Malware payload", "value": "dcabbe1a034a7126865c0184d0c5c201be2553d7e05f0e08d5f4a1cc5d418b0d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123829, "uuid": "7b3acf98-2e75-4df2-bd52-a55c08a335a1", "comment": "Malware payload", "value": "d37cde5de6ccc24d6f1879a5249f8a7c168c992e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123829, "uuid": "81cb0716-a810-4800-90d4-7801879d1df7", "comment": "Malware payload", "value": "08d1a434730845ba959eef2921f4b2186e2401fb1ee2ac2435f7120fda9d08ef204056ef00a7fe34e8f73508ea978742", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779123829, "uuid": "315ede34-0034-409a-8712-b3968a76cbce", "value": "T19BB30829BDC6C578E163E03210618327F41B9C88A505E67F5CF98A598CF0AD74B77ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779123829, "uuid": "0f5ddbbd-97cd-436f-91a1-8e3f9de5fcab", "value": "1536:qwRgeeYqQuFwC551FSRIzRj0DMJHj2gxNquBdu:qSn1qdwCLQIFjCMJ7Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779123829, "uuid": "75318a91-61a1-4d3d-881e-cb551c4c4a80", "value": 117313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779123829, "uuid": "a37fe2ec-f210-4881-b5fe-00fa9d48a59b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779123829, "uuid": "1a4e22cd-f72e-4970-b196-3f1764f2196f", "value": "Ultimate_FPS-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2129ee-52b2-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779106226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106226, "uuid": "e0c4e45d-f5a1-489a-b5c2-1bf1f08a6fdc", "comment": "Malware payload (RemcosRAT)", "value": "312d383ff8ee526f5ae9a2a2609df792", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106226, "uuid": "4e873b74-bb18-4014-b0a2-129c2d81d569", "comment": "Malware payload (RemcosRAT)", "value": "dce2215fa2cb24ff3e7d99536ddcb9d0fa28329f976d5355b699d5fa56bdec00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106226, "uuid": "a690e99e-aad2-4110-af67-ff984492c2a0", "comment": "Malware payload (RemcosRAT)", "value": "1aa9505467311e6634475acc658cbbb62d3e5c58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106226, "uuid": "ec83dbfe-7d54-4b1a-885e-8dbaf9f00ea1", "comment": "Malware payload (RemcosRAT)", "value": "8c01943a08671c9e115e6b002fd7ea4c8eaac2349eca6188709b04b03241fdb3c7c5ceb6b3b53940dcc4f1b8cd45932c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106226, "uuid": "8473744c-9f3a-42be-bbe9-6b4ea7c61cfa", "value": "T1196329B0DE9406A65D4B23FEEC507A60C278C665052300E5FEDE974DE00E5ACB7BFA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106226, "uuid": "7f926636-1f55-4162-81ce-48b6f44bf98e", "value": "1536:2xu5iwl27LGSomUDw1W/7yv2nC5N/WV38WGfT:2A5VlIG62YWW2C5NYOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779106226, "uuid": "d64acd9a-0173-4d96-9650-8a87a076b950", "value": 70580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779106226, "uuid": "fe3da48c-98c3-4fc8-985d-be390ca40d1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106226, "uuid": "6549f4e0-9ba2-431a-9b9b-11f1bebe22a8", "value": "ADVANCE_TT_SLIP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64353756-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120759, "uuid": "37a53cfc-fab6-49cd-a69b-9068deb623b4", "comment": "Malware payload (Efimer)", "value": "32d014e3457e70773ed896919efbcc45", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120759, "uuid": "e37af2d4-e89c-4a44-9853-a66a12da867f", "comment": "Malware payload (Efimer)", "value": "dd31ab9e3b6d4d1ba9372cbeaee6c737b979a1f3fe822f205476c283bad17719", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120759, "uuid": "13a825f9-bfd0-4bcc-9f6d-5ce37d235105", "comment": "Malware payload (Efimer)", "value": "b153d1bb5b4a8ed1213c0ff566309d67b97e2c65", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120759, "uuid": "23393dcb-56a0-40ad-8290-d4716af7998f", "comment": "Malware payload (Efimer)", "value": "ac2e01dd18738d88734e1717d487131511ac723ee931582e93a6a20db59a2f1af644032e2da5051e39659dd7a1c96f93", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120759, "uuid": "d0a81f75-f0e5-4363-8c1f-c07bb2e32540", "value": "T13DD63349D281B1ECCB72C474BBC253F6E078B8754775AE3A9B04D332BC9B465852988F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120759, "uuid": "5641e07b-1857-4af6-bff0-6a8febef5d94", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120759, "uuid": "10f848b1-24ca-4ace-9d1f-dca357156956", "value": "393216:RUiFDzTt/wmS44awV17XMCHWUjXIcuI3/PGTAI:RVB/FGRP7XMb8X9H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120759, "uuid": "54686f00-a2d4-485c-b686-7b32b8116d45", "value": 13850886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120759, "uuid": "833c3a63-5baa-43b2-bc1e-0732322c8344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120759, "uuid": "b26515ea-e4ef-429f-a9b1-cc6eb21cc16c", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0315f1-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120534, "uuid": "95320abb-fe53-4236-ab58-aab77a2b3569", "comment": "Malware payload (Efimer)", "value": "b0a6a790b4c8584a24d92a7543f7f2d7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120534, "uuid": "3efbaf47-7f2d-4910-b9d8-04079978107d", "comment": "Malware payload (Efimer)", "value": "dd815768f21b69da542c1a51a520b42b6d868fe10a0289e334d920a16152c25d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120534, "uuid": "d0af2214-602c-4fe4-882d-2946f287ce3c", "comment": "Malware payload (Efimer)", "value": "5186c18ec8fecd4b8ad4ceb8deeb2333cd556b32", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120534, "uuid": "cade83ce-9d61-4832-ad0a-59ea20ec8a7c", "comment": "Malware payload (Efimer)", "value": "edbadea4a9f4ae844ce884c2e5d1811ad88e741a2bf8244f87b8b863c5415104f7ac1843cfd8389218b720c65f4607a1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120534, "uuid": "604f9ae6-4442-47c5-822f-c9d799842b76", "value": "T12FD6330A45E570DDCB73A078BBE35BF1A46DF83646394C390398EA71BC5753089688AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120534, "uuid": "2bcb2bd0-6042-43b5-b4db-d10130b041c5", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120534, "uuid": "728e98e5-3806-4aea-bda0-4c25882d6392", "value": "393216:zKXPunRKE0Zy2ezuXMCHWUjXKcuI3/PGTAI:zKfuAnZy4XMb8XnH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120534, "uuid": "2f8bcbef-c9c8-489c-8bd5-8d2bbed21f60", "value": 13851989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120534, "uuid": "8085488a-f666-4e19-b998-a0f3f67864f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120534, "uuid": "9d79b96d-c196-4830-a03a-ef264919ac99", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafe24ec-530a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779144178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144178, "uuid": "b9e85a6d-5ba7-4166-b527-e5566de0b5e2", "comment": "Malware payload (Mirai)", "value": "1d32bad821483b1f0425a41fd6cff953", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144178, "uuid": "f4f708c5-8e64-4f5e-a73a-992dcb48ce2e", "comment": "Malware payload (Mirai)", "value": "dde17ff87454a5e70dae1e9c5ca80aba4facaad67730548eec4dc0683d360d70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144178, "uuid": "c20be222-f583-42a7-84d2-3f06651a7854", "comment": "Malware payload (Mirai)", "value": "dfbcde71c5acfaf268c33886e722dd3dc8908ae0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779144178, "uuid": "cb765a55-cffd-43ee-99f1-b5ddce17c16e", "comment": "Malware payload (Mirai)", "value": "5c5b7a3f95cc30a4578709f449f0b1c106936c5a161f416ba8eb799552128a4f894f686aaab9ee638a1cf6937bcf0f28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144178, "uuid": "0bf3882a-9b23-4e42-88a1-7f6ba1aa5d84", "value": "T1B7A33903B4C088FDC18AC17817AF763AD972F56E0139F1FB2BD0EA166D4DE215A1EA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144178, "uuid": "1a6ad86f-85d7-46d8-abb4-59c1895310d8", "value": "3072:EpSf3dIub3tZGahSksTYjSSoYQ2V1E1oRi6LbDMfsss+/Uu:MSmub3tZrhSYjSSyiax6HDAs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779144178, "uuid": "ba87edae-156c-41ed-8ea3-4c0ffc601de3", "value": 101232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779144178, "uuid": "e0c265dd-8b1d-4d54-9dfa-e35b49031feb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779144178, "uuid": "bbc1e90b-9010-4f87-b203-353263d5b8a4", "value": "heilong.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce069f1-5250-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779064107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064107, "uuid": "8833736a-a4dc-47c0-a8d3-7734e95e96c4", "comment": "Malware payload (Mirai)", "value": "73bdc21cc415e99c33489443f8191ede", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064107, "uuid": "d8dd007c-ff67-4a98-902c-7e88f94c2b16", "comment": "Malware payload (Mirai)", "value": "de37302ebf0cf92b80491192ad10c6636c857c4fd0a4309d3fddae13a36c6f73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064107, "uuid": "cda52bd7-8359-4176-a25a-34afd180eb3f", "comment": "Malware payload (Mirai)", "value": "2d105855559a3521603a078c998d2a6baf420594", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064107, "uuid": "5e4a9d42-4b9c-41fc-9c41-1eaf84315a9c", "comment": "Malware payload (Mirai)", "value": "125c0d7cdc80c58951539d1060998094467e4b2f741485ec3e31f3d6c9586bdbfa1d2fdb2bd87107f2713d4ce3c14a46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064107, "uuid": "d63f0832-04e5-427f-919c-9f2ec4ede04a", "value": "T113144911FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064107, "uuid": "67c515b2-1725-4ab6-a2da-a11db83eaf44", "value": "3072:ty5+GoCEggi4NerYqltSwJpH6+cYstkbUat:o5H5BT48rYq1wjY2bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064107, "uuid": "3db21676-a053-4bbf-9aef-bcc62e2e4161", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064107, "uuid": "1faeefbe-191c-4ab1-91cb-8ec724d96cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064107, "uuid": "50ca7f52-1919-48f7-999b-0f584ff1e36a", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4d8a8a-528f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779091028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091028, "uuid": "7c996c4f-22ff-44e1-97e3-9d1d1ac40aca", "comment": "Malware payload (Gafgyt)", "value": "f33c445f76a8c05e5991407bcd9f98b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091028, "uuid": "8e0bfe85-ba0d-47bc-966c-d308c6793bd1", "comment": "Malware payload (Gafgyt)", "value": "de4c7a518bc5659071baf32c5ad00ba4d2579f9254ffbc36c3d5e1c279e6c16b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091028, "uuid": "e78a6895-18cc-401f-a7be-3d63d0312e4a", "comment": "Malware payload (Gafgyt)", "value": "57fc4a2be5db584df76350c3f29ef232f4249e20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091028, "uuid": "0985f855-2b4c-4602-89cc-0abbf0daafe8", "comment": "Malware payload (Gafgyt)", "value": "3994b5a316268ff6a8f2bfaf9d2b4719f8ebcb9a7e09b44a7c3a290816e776727e65d2095b3c249bdb7c389222b70660", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091028, "uuid": "cc214228-827f-4454-a214-0d751d4193f5", "value": "T12E14E701E8545B67C6C22BBBF79A82CD37365F5857D73302AA287EB02F9679C1E39110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091028, "uuid": "ed325a1b-8059-4634-9114-464d42a27b72", "value": "6144:gWci405SqCsvpwd5cyV+bjQdQmTQLaDoZwTdLh7fDr/W:Xci4vXA0umTQLaDouTdLh7fDr/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091028, "uuid": "eafd16e4-09d8-4731-ab7a-2a0825662e4e", "value": 204975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091028, "uuid": "d4aeea59-19b1-40b7-9dbb-37ce6ddb2a1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091028, "uuid": "36da18ec-cc1e-4d7b-ab37-3e13506327ee", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00900cf9-52c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779113290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113290, "uuid": "84006a21-1af6-47d4-be4d-9fae0ee2bc4a", "comment": "Malware payload", "value": "f71a23018f6881b2e81209b533c8178a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113290, "uuid": "0e972036-4303-4458-b083-379803894919", "comment": "Malware payload", "value": "ded1df1405c5abf0066f8332e56cafa49fffde73a28ba6d4eec9fd23afd5a91c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113290, "uuid": "ce87535c-9817-4016-909a-ee682acc6aa9", "comment": "Malware payload", "value": "ce4d9d7fee3f10708dbab3d0e081118a589fc6aa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779113290, "uuid": "9b9e3eb0-0f46-4f56-83e8-a2f457fa9d5f", "comment": "Malware payload", "value": "0d2e3ef57c501d8836ec6d27cc324267cda0f5cb1306fe7275af6415bbb83e8b84355823eea5903a7c703d6333ff92e3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113290, "uuid": "615debd4-3a1a-4636-b6bf-0e7ca43493c0", "value": "T16006232F7DDDC279E00B0535C940EACB6C16C88EE051B5174DEE74AA0AE4CA92F65DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113290, "uuid": "fd784ee2-62a7-4901-a479-cf7067e93666", "value": "98304:1PM0V1r1d5ypm1JoyNkXs1usZU6qxpq4zj9sBaofvd:RbQ9s7q7fiaof1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779113290, "uuid": "9664094e-7df9-4dc5-a3bb-77b9fcaa6f38", "value": 3983968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779113290, "uuid": "b2a7f06b-e0d0-44d9-88d5-0279130cbc3d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779113290, "uuid": "5d2d9cda-c521-4fc5-9fbd-ce8464b7aee0", "value": "nova-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd0cd97-525d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779069692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069692, "uuid": "c4876fff-3ee9-4f08-8ccd-43bfc23828a4", "comment": "Malware payload (Mirai)", "value": "700f132763dac8a918e71c311b74de6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069692, "uuid": "bccfb77b-fa65-4023-bc90-6e286bebd9e0", "comment": "Malware payload (Mirai)", "value": "dee911cd0b2987cedfbad85a750a8e56ce10815569212dfa548bc61e83fadb7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069692, "uuid": "7388debc-e2b3-44eb-89c7-8d8c108acd96", "comment": "Malware payload (Mirai)", "value": "1b008f087cd464601e478c6d742974efc94b862d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779069692, "uuid": "dd67adce-fcaa-48a9-a1f3-6d71ad91dbe9", "comment": "Malware payload (Mirai)", "value": "2a7f7188f54d671c5be3fa4d16d713f3d767d1c60cac8a6fc4847900a6de08ebfef8400056cce0099f316a5dce39a123", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069692, "uuid": "6a920d2b-d4f0-4c8c-b4c0-f8f9e49479a6", "value": "T109B3C75E7E219FADF36C823547B34B21939923D627E0D685E2ACD5001F6038E585FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069692, "uuid": "415f5b72-a063-4495-8585-32567818d12c", "value": "1536:DTeEMX1nga0ceLT70i41qDAOwZhL/3OTUMEFIeI0kxnlOk:GbXWoS70q5wPL/3OYMEFongk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779069692, "uuid": "a5717bb8-0a47-4a5b-a68e-b069ee78c416", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779069692, "uuid": "829a62c9-1193-4455-a1ea-48be356bc719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779069692, "uuid": "587f03cb-e173-4954-9f19-aa00430caeec", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da858db-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120775, "uuid": "2f9d5fa5-516a-402a-abcb-c84e23946445", "comment": "Malware payload (Efimer)", "value": "4198f4fb29cf7e0e6ba6ecbe835e8d74", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120775, "uuid": "f67d5959-2e68-43df-931e-4ae0cacbcfb2", "comment": "Malware payload (Efimer)", "value": "df22609b56c50609cd9b4363afb49423fad7584dd2cb0dcacaa516d6be4f9fef", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120775, "uuid": "5fdd35fd-e87e-4a78-828c-ae2e1562cf59", "comment": "Malware payload (Efimer)", "value": "3ef1db20cfafb82bdabcb2f556942602226e7755", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120775, "uuid": "fda7ea38-1767-4a5f-a4bc-32d6bc4d96b8", "comment": "Malware payload (Efimer)", "value": "5e01a5c8205d3d42483f2f7b058fe9779dee8f8491ed61c2545e0ad21e4a5980102527cc321aba6087b9836ace047042", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120775, "uuid": "5c213839-230f-460b-81bd-36423e1fb286", "value": "T146D6330E26C3A2AFC7F39070FEE266B5B4BC746506B4CD5FAA18C3715D979A0492841F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120775, "uuid": "820013c5-25b3-4bd1-9e68-88a596361dd5", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120775, "uuid": "decf80a4-311e-4505-9fd7-66eb099c1104", "value": "393216:p6ArVtRDAyqAu1LVF3qadEXMCHWUjX0RcuI3/PGTAI:p6iDAyduka+XMb8XxH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120775, "uuid": "89f46dc7-da97-4738-a74c-7debaac99de0", "value": 13865613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120775, "uuid": "f326a45d-9946-4e0a-8538-f706992ea1dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120775, "uuid": "5499a7cc-509c-4250-a53a-dba62dc8ad1f", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc015ada-52b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779108478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779108478, "uuid": "3624506b-2452-41cf-a58a-352be425404a", "comment": "Malware payload", "value": "f85d5506051fd44452f4d76c59b6ad27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779108478, "uuid": "53627efc-702a-4ac0-8233-beb0fae315ba", "comment": "Malware payload", "value": "df3e34f28b72adb7c30f9e102b2d8981bfdaf6bc22230bdc93a3708e6a11d330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779108478, "uuid": "b7af02f9-201f-4528-8206-a7bf08419052", "comment": "Malware payload", "value": "750014854ce27407ce8fc8690957faefc33789b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779108478, "uuid": "50df1e90-3534-442d-b6e1-623ae3897b5f", "comment": "Malware payload", "value": "2079071fa7ad585e47082169377e1dd3d7f6e0f35b96072f87354833773a5bdbb6e890e1be094c439e0967b9b9998c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779108478, "uuid": "1475be68-612c-4feb-8a56-f140119b7a54", "value": "T1EF25312DDBE84319B1B2DAD4BDB40412E42FFB576A2DCD9C11C1028D0572A4DB5AEB2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779108478, "uuid": "e577002d-1f82-48f9-80d4-6696ff25ceea", "value": "6144:ZohHhVuiw0b9soOQXwpI6HNNAmIlZkOS9humejWVKWkhWNdZGKtVq:whsieoOQXZH1j0YIVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779108478, "uuid": "3f305c37-f551-4d10-b167-e569da11b524", "value": 1036666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779108478, "uuid": "e0c61c0f-4acc-42f5-aa17-44ad860b797e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779108478, "uuid": "39ae9a6c-72e1-4f97-af2c-2e26a2b653d9", "value": "SKM 83107529600.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d8c082-52ab-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779103184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103184, "uuid": "cbf3911d-1a2f-414d-8377-7dc81d3d0729", "comment": "Malware payload (ValleyRAT)", "value": "5829fdb0c92ca2fa0e50fc4d96920ce0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103184, "uuid": "ce737f26-0e09-4399-bc9a-bd87abe97983", "comment": "Malware payload (ValleyRAT)", "value": "e18e9309db33273762be1d78f5bdd78fa6ea41dadf5f6eef8ece4c841ea76110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103184, "uuid": "587bc3e0-6f98-44f4-8d53-b0d3dc92de15", "comment": "Malware payload (ValleyRAT)", "value": "7924a63ec0c39ecaaec18697f7d7e9e0f446bb6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779103184, "uuid": "5b8fc91a-6053-4aae-8c5d-d9aa7031ac6a", "comment": "Malware payload (ValleyRAT)", "value": "9b634a1fdafa68d74bafd4b3f54739b5c2652658d37b2c133461662b5f5f4b6bb912bdea2b8a6f98bddad66a2393996a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779103184, "uuid": "cf0cc537-f484-4c2b-80aa-9a523a50f002", "value": "T1C6D5F13FB28B653EE06E5A367AB2E210543B766165134C1697E4C88CCF164B01E3FB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779103184, "uuid": "336fe4d8-bd95-4447-8f1f-ca9fd33b17dc", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779103184, "uuid": "74eca4a3-9d2a-43ef-8b9f-f7882746e41e", "value": "49152:IuI2hdO0jVxd6xUPE7PzuPoIvktOSEcw4tRD++0ggNBmjhUidTWHEEl7rUe:I5OdOC0NP8o9Og/gNB4B5De", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779103184, "uuid": "90a64904-19f8-4ffc-b7c1-6ac145b4ddba", "value": 2929538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779103184, "uuid": "43976d79-700d-4c0e-bcb4-20783995bde0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779103184, "uuid": "146a5ad7-0154-40eb-aca6-8859b47c23d1", "value": "5829fdb0c92ca2fa0e50fc4d96920ce0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2555303-5251-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779064679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064679, "uuid": "4df3789e-b5cb-41cd-8cde-ddb985153d3e", "comment": "Malware payload", "value": "d4e703b7aefd778703c1c4c0c5ed1dc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064679, "uuid": "b93dd1ff-8aa6-439f-b363-52d5a7a7cb82", "comment": "Malware payload", "value": "e1fc47af5838b49563b8605395970d9a34c6075fb68643d8f36fe7a3fb8f693e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064679, "uuid": "b150c6db-b530-402d-9165-61ceb5824ed3", "comment": "Malware payload", "value": "4425d97770118792f5831df832a9d4e2407a2665", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064679, "uuid": "c1670bb8-e3dc-4d66-b86b-d9cd8735cb9d", "comment": "Malware payload", "value": "16b6dd83412fe5c09da79d6f035e541a4b8d2dcc2033d369e655e823a1df8e8e7d31678ec71fae6471d654a46d816ecc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064679, "uuid": "fd67b0d5-6250-4d83-b6b3-ec38fbc9dd9c", "value": "T1BAB345397F11AFAEE67C823007F76E70975A369636E18284E16CD7085FB025C189F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064679, "uuid": "bb733c30-fb7a-494e-a6b3-d0a338cd1094", "value": "1536:REG4L3GSoV/15kIFQNNVWLBNZZgOI7R4uB9p1EGkAi1MEVrzczOK2MLoy87eKpNF:RAGSoRfkIFQNEG1ALeT1lAPWjm6JuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064679, "uuid": "dec1b8f7-9ee7-4038-84bd-7197e006ba45", "value": 112932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064679, "uuid": "27212ca2-5335-4eeb-af4f-be40911e8053", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064679, "uuid": "e2887dcf-5bac-46d8-ae0c-f9f1e4b78c34", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e9dd9b-52f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779134447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134447, "uuid": "f6879e62-eb0f-47e4-b103-4edd4e79009a", "comment": "Malware payload (Mirai)", "value": "55851e8f13ac75c3ec204fbb7f42b65d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134447, "uuid": "e19b7940-3be7-4d92-8ebd-52fa69b672e8", "comment": "Malware payload (Mirai)", "value": "e23267c45ae5751750f0b31c5bc47be0514ebfa2d6d60b6db99b90435620b695", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134447, "uuid": "e1dd6f45-56c2-4760-bba5-e03a99625ccd", "comment": "Malware payload (Mirai)", "value": "9677839d2e6832ef344732313d49c5d9a437afcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134447, "uuid": "64cf6b6f-877f-41a7-829c-6fff4cfd6339", "comment": "Malware payload (Mirai)", "value": "4def58e633925099b5a3b48d4f134103f20efff1bbe17a60f47af1b63708c0d2d83c996e6fbc5baec9d1592dda3a039d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134447, "uuid": "c3c27941-a6d1-491c-a16e-3ba3ea9ac3c7", "value": "T13043F1FDF155E0CECEC72D7704C60B72AD105EE1628D0B9C4322ACC28A2AC5B39AD664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134447, "uuid": "13f30e1a-9e02-40d7-a74b-6492a931c609", "value": "1536:sjMdV6wIg4uoe0ScSf9RxGiAncw5nZjpUnoO:kMdopg50Cf9RRA7dUoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779134447, "uuid": "0f3cde57-713e-44be-9b3b-863950089d72", "value": 55364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779134447, "uuid": "bc4234f8-941d-456d-ab0f-0b87bb82bfad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134447, "uuid": "fa484dbe-9a26-4a0d-a313-7885490ab414", "value": "micro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131f006c-52cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779118475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118475, "uuid": "54add372-57f4-4492-ab4c-5141913aa60a", "comment": "Malware payload (Mirai)", "value": "a8b0530bf5de19a1db1763a046ba86b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118475, "uuid": "ada99b22-89cb-429f-a231-ada5ac3b3ecc", "comment": "Malware payload (Mirai)", "value": "e2a0970dce7da567a5720c71f2327d2ce02ae017299715358e6d39532c9860b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118475, "uuid": "52a4b655-c166-4c1b-8c11-b198b4530d02", "comment": "Malware payload (Mirai)", "value": "a76a676267f19ee2b922159bbd0a3f725c22a4e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118475, "uuid": "d93337d6-56ad-416e-a68b-26fa371694fe", "comment": "Malware payload (Mirai)", "value": "fb80e0be16cbd2b1de7b1b7607974ae5107d9ffbe39262c2fc72805e026c0d51499955b980ab78aa87b026f7cc143acf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779118475, "uuid": "5fab194d-bb5c-4301-ae58-8fb642765a86", "value": "T173D31945F8509F17C6D512BBFB5E428D372A57A8D2EE72039C255F20378B86B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779118475, "uuid": "763a1c23-b8b9-4515-82ba-aca704f04308", "value": "1536:KgcMoJOIsenf7HDIJHXdUYRde27ggLk4V4Vkas7VYIVexzNAtbYltXlg6wywGQzr:KgcFVSXrdedgwC4TsuI3REfY3F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779118475, "uuid": "42240983-eae7-4ac7-9e0d-bf0dff03da49", "value": 133484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779118475, "uuid": "cdeb5164-b6f5-4872-a7d8-4a6d04791c51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779118475, "uuid": "9b687114-7105-4c0e-a911-e860e5bddc99", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec602cd-5257-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779067277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067277, "uuid": "fed5cd04-3639-42fe-b54d-1df2eb5e7eb8", "comment": "Malware payload (Mirai)", "value": "27ba5bd221997604e2d779434e0061f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067277, "uuid": "adf1ee36-f460-419a-ab5d-364a2511cd5b", "comment": "Malware payload (Mirai)", "value": "e380b52753b42120f4856e14beeb1da0d100564aca2ac709758fdb4dc29215bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067277, "uuid": "811357d7-1e80-4d85-9925-329b328e5417", "comment": "Malware payload (Mirai)", "value": "4db6858c6db90a279fde8066562610b9cae09042", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067277, "uuid": "f2158a7f-a2b7-4076-a030-caf7698000cd", "comment": "Malware payload (Mirai)", "value": "394ca5bd899a7c4c610b2ab60aaf596299400c1565b8db58821a6ca5812f4ed9a18f638d7eb73221680f78a21a2434fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067277, "uuid": "822eadd5-49db-4fe7-904d-9671d5deceda", "value": "T1F3145B01FB1D4553C6835EF04A7F07AAD3698DD204BAE00E6509BF292677DFA5283BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067277, "uuid": "e23ed02d-8f38-459c-859b-a68ed0ce9784", "value": "3072:YUyhRxC1JyHfywyWAgQ606LVcV0UdJRzlBI/07PDBtXAoV5:BsRxC1oHf/dc60yVe0sJRze07PDjlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779067277, "uuid": "fc45b2f9-2a56-44fb-8b76-52677369cc24", "value": 198592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779067277, "uuid": "91024425-e550-44cd-951f-e3ed4e720ab9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067277, "uuid": "b2da3c50-a68c-46e0-a183-07d52fcbdf4f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f1e12f-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089809, "uuid": "591ec890-3e53-46d8-91ee-306afab0f5c8", "comment": "Malware payload (Mirai)", "value": "03b0d1dc58114919db718baaf4358c60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089809, "uuid": "a7746727-cbaa-453a-bdee-e68817e58037", "comment": "Malware payload (Mirai)", "value": "e4210042ce107521edc2c8ab92d0f09893b44f11ecb56406b801b3baed442b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089809, "uuid": "e4263162-8059-4304-8f9f-e9d4464c6520", "comment": "Malware payload (Mirai)", "value": "ef45349e62e465e2e12a32c2729ba66907ad034f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089809, "uuid": "0ab54aff-ae2c-448a-b1c0-8f76e8275c67", "comment": "Malware payload (Mirai)", "value": "c4d4d3286a998014ce4c08814deae3e407dd8000f8884551bc50135da6d3f02c3f366d3b0f48ffd7130e6e8647d0c684", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089809, "uuid": "f4ad7ee3-eb41-4f0b-ab59-fbdd4f098419", "value": "T17813F1625736AC50E5F29AB8FDFCC181E926D775C85EADDB4620C16C7BCB48822C06C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089809, "uuid": "f125a546-c983-4c85-aa0e-852033929f5c", "value": "768:Y4GEt/uZTK+QsAAVfnXQwkVjs6ucZywynO0fH9Jhv9q3UEL83:YLExM59Ks6D0nO0//heL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089809, "uuid": "ba9f0086-3ae9-425b-9eb4-eef50516e856", "value": 44788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089809, "uuid": "5c09d4c9-0fba-408a-972b-5c9d50f8f40c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089809, "uuid": "615aa128-593f-46f4-99ab-7e4af052fc87", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20be7aec-52bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779110767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779110767, "uuid": "d14806e6-88ac-45ef-9db8-4706ea4eba52", "comment": "Malware payload (Mirai)", "value": "8643fe22f6de7080326e7658c060fb62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779110767, "uuid": "69a345a2-f9b3-4695-bd95-5f8edb62a450", "comment": "Malware payload (Mirai)", "value": "e704d43edc58edd2758caf9df29979d3801650850a8ff94d19af9fb4150f9458", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779110767, "uuid": "2a878b47-31ea-4954-9d6b-6d3884383c03", "comment": "Malware payload (Mirai)", "value": "cedc5120087563dda7ee0a2b077956be254549d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779110767, "uuid": "eb79b2f6-5677-4e65-9940-a471edc21d5b", "comment": "Malware payload (Mirai)", "value": "7c05d392a9e7ff49c6c0aae4c9f93d064f5a8ff926e4f0d776cf3eef8ff5517baf24be94086077102d44e10dd23199e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779110767, "uuid": "06dbc02d-da2c-4eb7-ad3d-a37b53c0e970", "value": "T12133F25B391DFA9099760CF9F4AA4AC5DF712F6858F53083138129D9A6E7E48ECB0C43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779110767, "uuid": "ad4d261f-34d5-4d33-8686-3fa37e326988", "value": "768:R4ChjqIja3Ae3p1ZI9h3qw5PQ2LHZ5VAlufUQfXsBkXDFBDtzK13KF7bC8OOLrDU:W2HReZjqh/HZlU8ZBDRKJKF3vhLnyXLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779110767, "uuid": "54ffe94a-14de-4b7c-b6e8-3019aa819ab5", "value": 54592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779110767, "uuid": "5f0977de-92e7-40c1-a407-80a63d80a5ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779110767, "uuid": "e804016d-2d94-483c-9271-52e82183f8e5", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fad89e9-52cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779118469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118469, "uuid": "0f062c6c-b225-450a-9bcb-1adf4d22b622", "comment": "Malware payload (Mirai)", "value": "044ae905bbf4ef18c0d7514baedfcd33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118469, "uuid": "d37a778e-83f3-4a48-8e7b-b7852e92cc02", "comment": "Malware payload (Mirai)", "value": "e7adccb11b312f5725800543326f21aa3205998d6634d2e9344e3ff2efed5a42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118469, "uuid": "3418e506-4d99-40b3-ba18-3701dde10e7f", "comment": "Malware payload (Mirai)", "value": "219b857c3535067a47a0fbdb3010895022f63f5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779118469, "uuid": "d5543aae-6efb-45c3-be14-2b61cae08c92", "comment": "Malware payload (Mirai)", "value": "5812fa3a1b82a86f4b3611f6d52bee5c698cbdf8dabe40fbd3f9dc6bbaabc734e574b62b37754af3b948e1414fb25faf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779118469, "uuid": "291c528e-5487-44c1-b2ea-fc17580b4a70", "value": "T1BB23F1A22A47E672E81184B5FFFBD0CE62571426D0EBB4FC76618730D38BD074DA2185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779118469, "uuid": "25a7fc78-6e5e-489b-8dca-66e218e00b4d", "value": "768:CQUtTNIwn5ehp5WsumY3VHrLQKjMa3UGM+xWzBLS1wC3sUAWLzwPCvSs3Uozy:CQUpn5obrY31l4swBfCczWfwPAzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779118469, "uuid": "f8feb654-895e-40cf-a11c-fa7b6890ddb4", "value": 49736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779118469, "uuid": "799749ff-dc7d-46fd-ad8e-28aecad5ca2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779118469, "uuid": "18149e09-35d5-48ea-87bc-0e4a84865d37", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430c59b0-5251-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779064439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064439, "uuid": "0eb14b74-6d79-4831-9ef6-ce3a3ccb2f72", "comment": "Malware payload", "value": "bf8013c326503592c774f667471f2460", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064439, "uuid": "13c41b47-9e8b-4f12-8e29-37e49bc48373", "comment": "Malware payload", "value": "e8abcba517798dd3bf851d87a6b8a7313b685f4df0a803499ecc8652124bbb7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064439, "uuid": "f3c787f4-8142-428d-91a8-9160b40f1f0d", "comment": "Malware payload", "value": "cab278a4f07750484b76734af853895ca6746541", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779064439, "uuid": "8a30ea4d-f21f-4fe9-8221-7c06fda8f782", "comment": "Malware payload", "value": "1b86e36766997c8a04bd0c794d1f0ea0ede79b79351426a7ec71d8f91078551d76fdf5166834491f36730c040988da94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064439, "uuid": "5ee384b9-e195-4df5-ba8a-13b11b3f0241", "value": "T19B730747AB2C0B87C4AB5AF53E3B27F4875DBE6001E941C81116EEC503769B17112FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064439, "uuid": "e9054528-c483-4ec1-ac4c-226ccf3786ef", "value": "1536:S+H13eRfIPCs3jHhm/qYCTah1QZX93KBH:/eMCsTiqY8ahqtQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779064439, "uuid": "a2390a5d-b9b5-4d90-af43-31f2ab743900", "value": 78168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779064439, "uuid": "452fe33e-ac68-431f-a78d-49db8c2a8606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779064439, "uuid": "b1ec0b44-4928-44b0-b4b5-4729e5a0f2e8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5058fc16-52ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779130174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130174, "uuid": "e291efb4-26bf-4aa4-8b5a-afc47fb63f45", "comment": "Malware payload", "value": "783816d8a7638d107191eaa3fb90c67b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130174, "uuid": "c4b9def4-6be6-4cfa-9df2-88669c167119", "comment": "Malware payload", "value": "e8c2f5264a094f9964077b4c0561494de8953f5e137c2c3a00205340f6353293", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130174, "uuid": "732e97e3-d00e-4245-a2b7-5658835715ae", "comment": "Malware payload", "value": "e4e5a845cc3c73aab99e0e94f978911545841fa8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779130174, "uuid": "1c2df068-4288-46bd-8568-12ea33bfa59a", "comment": "Malware payload", "value": "366501a88bd90b3b23afed768615c55e34dd204bf94bbbfdd52fb936b295680c6242ac805657c4c6fce41d5de0e8843a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130174, "uuid": "9ceaa382-963e-47b4-b7be-c836823d709e", "value": "T18364F909FDC5E428F013B13C02005567672A96CAA729F3F716DBAD4C69B5F760E0AAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130174, "uuid": "9b21de8e-bbc8-4e0e-bfc1-d392f1835f27", "value": "6144:r62DFZnKy6VyNW/juMM8qhnuqrid9pBOKjqmSs8HA:22DFZJwiMM8Anp8bBJjpQHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779130174, "uuid": "a22d93d4-e0da-4453-a748-2c18e4bb5e22", "value": 322250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779130174, "uuid": "f937cf9a-d01b-4d7c-8ef9-218c2f942d5b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779130174, "uuid": "d0749810-8b9b-4489-bf7b-6c3910c90b38", "value": "yzvvrb5k_GlazedAddon-1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068a303e-52d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779119743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779119743, "uuid": "db376939-aa67-4b83-97b8-969020440b2e", "comment": "Malware payload", "value": "d63c4e78b19afe2576cc75ee54d9719d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779119743, "uuid": "29e2d674-0313-4b04-8c62-e5f0cd3ed05f", "comment": "Malware payload", "value": "eab19eae212e21881ca50c0d27396b84a08815626683feb24e3fac68e8e45395", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779119743, "uuid": "ad904ad4-ec96-430a-b7f0-664f63e33972", "comment": "Malware payload", "value": "7d3f4c5b5b1c1ab4be50ac78919eb833ed1c6fff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779119743, "uuid": "7a6c178e-0e9d-4cdb-b1fb-2374a84d7e57", "comment": "Malware payload", "value": "9502144dff5ee69321ba7ba13c4ca56963bddd78585a8f3113a3077f7e4a2b7b68e1ca4670ac1a195b50507674d25b18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779119743, "uuid": "bac52100-6e61-4f1b-91ae-34127993b042", "value": "T1FF57CF7792467CEDE9B98CB4D01025816DA878874778E3C7BAC870E666EB6D08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779119743, "uuid": "e63bb3e9-458d-4ec4-84b5-17871e143c3b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQd:cqYUQuVDt0TZEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779119743, "uuid": "4dd87427-b8e0-429e-92c8-8176f9a085cc", "value": 28508160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779119743, "uuid": "ddbeccac-610a-43da-b504-f9867b700e7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779119743, "uuid": "7e0d7ef3-fc80-44e1-b464-73dedbe2e78b", "value": "eab19eae212e21881ca50c0d27396b84a08815626683feb24e3fac68e8e45395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6653bdc-52d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120440, "uuid": "82790977-0a3b-4f15-bfae-351f22fb6928", "comment": "Malware payload (Efimer)", "value": "4c40ac108297edbe1dc29f88e5b6a5c5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120440, "uuid": "6eb74756-ab56-4fbe-9e49-2b7211846a08", "comment": "Malware payload (Efimer)", "value": "ec13e5ea477fd2ba15c75f1c850204ddaf1614c3b1057a2700392540d720bedc", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120440, "uuid": "d00e2a94-d94d-4ede-ab07-f1e3000a149e", "comment": "Malware payload (Efimer)", "value": "02a8704c8208997651fe38510f956b3cfaf2deb0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120440, "uuid": "de351a3d-4435-48d7-b875-02e5013b7b69", "comment": "Malware payload (Efimer)", "value": "ba26069576dd0ec5784f792b9aadccf6844c54c341acbc640196f03fa53f8930198a9423838cfeb60609eff251eb6a36", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120440, "uuid": "9a1dcf14-4b90-4930-a99a-ce8ca5c5fa39", "value": "T1BED6334DAAE291FCC36B90B03FE116F050A878FA4B748C3E4A14C7B2AC571715D2D96E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120440, "uuid": "c6ae704d-0eee-454d-b535-94e4d90abff6", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120440, "uuid": "013ddf2e-f1bc-46a2-b849-f0f49525ce2d", "value": "393216:5mIdKxC14JMiorEXMCHWUjXGcuI3/PGTAI:5nx14uiorEXMb8X7H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120440, "uuid": "16d0dc1c-ed1f-4b09-b07a-69691886d81d", "value": 13857211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120440, "uuid": "d543bd64-507c-45ee-a682-25d992ca7c83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120440, "uuid": "e46a59c4-10cd-49c3-8464-c9bbcd6c50c6", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef83d815-52a6-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779101236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101236, "uuid": "87beea68-8830-4234-8a2f-48e11eaf856b", "comment": "Malware payload (ValleyRAT)", "value": "e8136e4cd6f256c21c0b4b557ec5d070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.u", "colour": "#E878FA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101236, "uuid": "0ee72eee-d507-4abd-86f9-051688cd547d", "comment": "Malware payload (ValleyRAT)", "value": "ec3c3d02432cae2a19cd369f08125ea070b7646f7c193e62292879e8b94d5135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.u", "colour": "#E878FA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101236, "uuid": "54187317-b895-441a-9eae-585c7b2d58af", "comment": "Malware payload (ValleyRAT)", "value": "3853674f702f3865054acd0cd84591e5c4a36124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.u", "colour": "#E878FA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779101236, "uuid": "79a861a3-d8b3-4d5e-ae1e-00d205f4fda3", "comment": "Malware payload (ValleyRAT)", "value": "609b777a210ad0538e4d059b622a8193347c2b1f4bb489c5f60ffd3c67c668cdb47eb6c2c8c54983330090e90332541b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.u", "colour": "#E878FA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101236, "uuid": "3c72e4a3-f37d-4719-bf63-0d48216a8f2c", "value": "T135761223F2CBD03EE05D0B3A46B2725894FB6A11A422AE5796ECB4ECCF751501D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101236, "uuid": "6a4a6886-0ed0-40e5-af9a-4051c561561c", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101236, "uuid": "e328b708-f7ee-4192-95e2-2224b1d97101", "value": "196608:l2posez8AFojRnpCZ9Z8iSx+O4u0xm1Pst:l6ez86oRnQ8nrlum1kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779101236, "uuid": "0e9ee15d-68f1-4fc4-8ae2-20da223ee84d", "value": 7228969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779101236, "uuid": "c77ad42f-b241-4a35-b899-df169bf9c5c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779101236, "uuid": "2becc39f-acc6-41f3-a666-f201a88eae63", "value": "danma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe14f7f-52ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779131865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131865, "uuid": "a26cb56b-a546-4c97-85e1-dcaa78b9fc72", "comment": "Malware payload (Mirai)", "value": "cd65d92aa9296174b720fcc868984c92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131865, "uuid": "45df84f7-c502-4329-a7b8-50b0159c8ac2", "comment": "Malware payload (Mirai)", "value": "eed1260905447d48a8643e34a57ddf9ea5b850742864e64967c36c9036717ce6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131865, "uuid": "dfad48db-967a-40ce-b95c-266cbc709320", "comment": "Malware payload (Mirai)", "value": "7d2b765222ca45fdaf1a1c7e49f63a184653c5c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779131865, "uuid": "511e6304-b237-410c-9463-2790aff191b6", "comment": "Malware payload (Mirai)", "value": "390c777aa2c0d0aac5d1d8b9e70604a5d8a940456def72e6d5dc3df993591b8e73053c0d9c6088a2c18e6a5beebb4eff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131865, "uuid": "a1b7b077-0193-4954-943a-6bf62b27c166", "value": "T1F5842A4B6B218FB1F375823006F787936FBE129616E29981E36DDA143A5035C682FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131865, "uuid": "4719e782-ce63-4f83-8b56-5d7a689c7528", "value": "6144:yWMlp5Z3bhJIsaYNmUCF7CKDsAgJ0rO8mL3Sj8pFg87:fMzbcfF71QUApF77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779131865, "uuid": "ee1a2966-65ea-4613-93f2-d91477e265ad", "value": 400784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779131865, "uuid": "440b1cde-7db9-4f28-a704-8e73dc332e6c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779131865, "uuid": "eacccab3-848c-46ed-8230-b6670f7c8f63", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59298d94-52f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779132766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132766, "uuid": "793c7383-e439-4be3-b6cc-a60474e1aac3", "comment": "Malware payload (Mirai)", "value": "385e8622a9656788c4cff450e5aa50a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132766, "uuid": "eecf8ed0-f1cb-4a01-a3bd-3d3b701dad3c", "comment": "Malware payload (Mirai)", "value": "efce7a91f4451a3582be6a40eb2637c4bea2bebf9e8390a102f810f058608924", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132766, "uuid": "19ca57e0-3483-4707-b599-d235a7c3e82e", "comment": "Malware payload (Mirai)", "value": "f121a39f7e830aa5ceb939621c0f59d49ad543e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132766, "uuid": "15d36cbb-5773-4ef5-843c-b88a07b4310b", "comment": "Malware payload (Mirai)", "value": "3b9b46fb444079ff2d7987fdb854f4c70814ca818c5f0d863565f0e5222bc736921fe16afb8aa4d48c36e8d48a262404", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132766, "uuid": "0c22ebc7-405d-46c3-b410-b62a4351366d", "value": "T147F2E13552AE0D1DDA3B8132476A1CF1B6E9F2127F2ECA43BD0C952C6E8C030E4D4B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132766, "uuid": "b3511119-d8b3-481f-b7bf-805a5b03892e", "value": "768:5wh9HDgJZLnRIJbVz3SVM1c67lZfwL4l47IIoy:mDjgvN+7qqXfwL0el", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779132766, "uuid": "094ca329-1abd-4ea4-8d0e-75b1aae13de6", "value": 36060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779132766, "uuid": "40f655c0-f7d8-4c75-afc5-1925bc3c22a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132766, "uuid": "00c3a4fa-d984-4c6b-94ad-0253cdf13f4b", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033be6f8-52b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779106423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106423, "uuid": "9f2b4a1c-1696-4b74-95b2-f5cfd4bb0fa1", "comment": "Malware payload", "value": "648083e021d69e5fd46ec042e505b77d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106423, "uuid": "4c8285a6-1554-44b9-8024-d4c1424b871a", "comment": "Malware payload", "value": "f0126c3c13c7ac51621a69651c7d55d205023e8a0b556c8b05e525157fb0d3d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106423, "uuid": "81f6a242-2fda-47d7-ad7c-2b2e1be98174", "comment": "Malware payload", "value": "d3c31dadd95f7753b600a0878ba9f13bd7191c65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779106423, "uuid": "b42d3fe0-d73c-4f19-a7df-eb835f3cf456", "comment": "Malware payload", "value": "9bdc3a2a9eaf443051ed8db8beb75d53fd9397555a5baffbf6bd331195d360560811b2c6413408baeee0a24b76830455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106423, "uuid": "44411b5a-8404-4c48-82a2-ff8a20590499", "value": "T171768E53EC9545A9C0EAE231C9B29253BA717C445B3263D76F50F7382F72BD0AA7A304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106423, "uuid": "a581ea34-89f8-4220-aced-94dbdfa98111", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106423, "uuid": "ed2841c3-12f1-4629-90f8-b7d969d5ed52", "value": "98304:oKnHvmfTiIFeaEXEqtGApLmcRLi/LBiNmolaHXRq+hst:1ubiIKXCApLmcklBq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779106423, "uuid": "a455fb48-4b10-4729-852c-fb82c7cf9a07", "value": 7466496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779106423, "uuid": "3c87a8fc-ea43-4d49-b1e6-589288273098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779106423, "uuid": "b6fb74ac-01ea-4a01-ab40-59719c809a63", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a773c415-52b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779109275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109275, "uuid": "aaa00013-6091-4841-bb61-83693d2f8925", "comment": "Malware payload", "value": "dd6b6f87e612155ccf3d626242574ff3", "object_relation": "md5", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109275, "uuid": "2c8edbf4-30a1-488b-9d6a-5d3db2deb7f7", "comment": "Malware payload", "value": "f1c55cbe1c6f840091aa44c4ecf58003915890a9ac834407fa3c4c77c4267709", "object_relation": "sha256", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109275, "uuid": "67f42582-0c44-4707-a505-f133cba2743f", "comment": "Malware payload", "value": "a77964a85da43cee05f247c678dbfa329c0f11fd", "object_relation": "sha1", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779109275, "uuid": "6ae49b01-01d2-441d-8988-7d02837ae348", "comment": "Malware payload", "value": "5e2239be6f6ade7819508a8dbea9f1a5a244f4bc5f7759dde60b9dada1f9f96ea6d1c0620355b572b1fb5326b5310156", "object_relation": "sha3-384", "Tag": [ { "name": "212-193-3-220", "colour": "#6394E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109275, "uuid": "ddf17b7f-dcd5-47cc-a1de-9d5a6bd5081a", "value": "T1A0A53317A3ED76FAF176C3BCC5A00890D736787526541BEF06A482161E336D2AC2EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109275, "uuid": "670d27b4-e65f-47da-b0a5-4b13963d927c", "value": "07b45d66923dbb3fb7da394a564ef418", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109275, "uuid": "9fe78d68-592a-4ae7-87c3-db5aae4328c7", "value": "24576:LIbttEgXIluCNzHZseu0rEAtuJ+S477wGFH5EbaZBxkVXbpltfDz1RPXIAeepfvw:UttE+vC3seTAAt7HWEfOtLZRPZeiUmSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779109275, "uuid": "044842ca-bea4-44a8-94fc-ace748cafc63", "value": 2081113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779109275, "uuid": "63f002fd-4f9c-42ea-8e07-7ffbe1882c33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779109275, "uuid": "38cd4948-b513-4fc3-b0cc-342cba6e9db8", "value": "f1c55cbe1c6f840091aa44c4ecf58003915890a9ac834407fa3c4c77c4267709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2374179e-5290-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779091444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091444, "uuid": "343b630d-f5a9-4f94-8ab4-b9307b98b2af", "comment": "Malware payload (CoinMiner)", "value": "56ee1df2418fa9baae02ed1edb17d19f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091444, "uuid": "66c4d4ab-e898-4a0d-9442-c3244c541b16", "comment": "Malware payload (CoinMiner)", "value": "f2f9d016751c7f8520f74e41e6be0e6c1216aed41d06e802aa52bafd7a39501f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091444, "uuid": "2c599af8-cae5-44b7-b921-687862fd684b", "comment": "Malware payload (CoinMiner)", "value": "2f949d6b33997c15aaf02507f3cae1379864561d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779091444, "uuid": "7305d02b-e41e-41d5-8512-e5ecda75de22", "comment": "Malware payload (CoinMiner)", "value": "5998ebdf8e0d64da28c3846bfb709dd81f6545d3f70bb4d4bf18f50fb78a690e1fb48016fd76fe23d3d2586fd5d415cd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091444, "uuid": "44abc88b-2506-4c73-adbe-00720993a2db", "value": "T10D32457360300E317FD80A7BA857580016A5986B0A1B7E58B5DC6479FF4B38CD3B6EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091444, "uuid": "d1fd8191-d0f9-4eb5-9a81-2117412680cc", "value": "192:gOfkknVNJQnJPM/Y4KpXEgOpWOBokIE2b5fAS90:g3OY4KNEgxOkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779091444, "uuid": "6eea8743-fd2e-4b68-b47f-bfd5d3eff695", "value": 11125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779091444, "uuid": "b303c47e-e315-49a4-ab5b-b253f168aa0c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779091444, "uuid": "4021918a-feea-4d5b-9ea1-7c098e333684", "value": "sugipepulesrl.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c571a41-528c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779089822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089822, "uuid": "3feb6ef1-80a8-474c-9db5-89e41ea025d2", "comment": "Malware payload (Mirai)", "value": "3d4404e751e76dbdd5f8309c646ea1c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089822, "uuid": "c8588d63-4643-4b33-a782-09ee11d9a0f5", "comment": "Malware payload (Mirai)", "value": "f3de747e3c6d08984232d02f8c8b92be826ff5551e06e0af0bf19a7385e58eac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089822, "uuid": "142152a2-89c8-4b94-9fda-f6a8e092096e", "comment": "Malware payload (Mirai)", "value": "7af5995c437bdfec8a49bf028847585c1141547a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779089822, "uuid": "71e922c2-7fe6-48e1-9f98-b19409dd1e24", "comment": "Malware payload (Mirai)", "value": "6a98bc431c28c67b78d2413c63139cca310d53013cc73eff97e45972a70f15afceec680b154189e17e6dae00d08ed33b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089822, "uuid": "97cb5c86-a1d9-46a3-bc81-fded4cc8decf", "value": "T1BF935B22B539193BC4E4947722F35326F2F6438A14B88B2E7E710E8EBF156D026477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089822, "uuid": "ec8275fa-f459-4e53-8acd-e61cee7fcf45", "value": "1536:08RsLd2/48pr4LaYqPoQatmjKtHw8Ym5owAtQItt6B:0USjsxOR9YOlW6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779089822, "uuid": "06a2ff79-2622-489a-bfcc-1c9192c7be86", "value": 91968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779089822, "uuid": "eccea40a-4cef-488a-8ff8-21e0a8a739b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779089822, "uuid": "f5dc7b0b-86b3-49fd-a9bf-08eab5808b2e", "value": "windy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82541703-5283-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779086020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086020, "uuid": "db20f7e7-1b4c-4407-9d3d-c467e233b986", "comment": "Malware payload (Formbook)", "value": "627340e4e0db364a64f38f8232cc8cb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086020, "uuid": "8b9fcfab-b59c-4f92-bbe8-89d747e8fee7", "comment": "Malware payload (Formbook)", "value": "f4783cc1f0aa8fa431bd0b0f54d961e8337d18bde0cce4a956c3a5c9f97d5961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086020, "uuid": "586dfa5c-c6e4-4543-9e4d-62d175d759b2", "comment": "Malware payload (Formbook)", "value": "1be38b4332b0f4eaf37d3cdf7786cd39fc648671", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779086020, "uuid": "9ccc2676-c429-4028-8696-4f8a1533a0e1", "comment": "Malware payload (Formbook)", "value": "9b1de0e49a4b8bf0563ffa8e8413cf7ba7a9692ccc5f0c0973b2c9feeb7be506ee0b65def80841f02a981765ac2da847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086020, "uuid": "427efb64-3e57-4206-87e5-24b60abd19e9", "value": "T143542319CB16E5ECC6C18BB807F9317F2F99D6942C052247B2D4AFC916E98C09EDB603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086020, "uuid": "a8d02e53-b392-4a1c-9810-bcf8157c0198", "value": "6144:BwUWdJqkFvBFZcwLi+HHFBXX87uqboF0aFEib4lz+:aUiPFvBzTeGs7uqEFoib4lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779086020, "uuid": "c39886a5-a1f4-4f8f-8bb9-83e213b86301", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779086020, "uuid": "37e56c4a-7e46-40b5-b7be-e2e08c274d96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779086020, "uuid": "747e82cb-4028-4d9f-b3a4-295cc77736c6", "value": "f4783cc1f0aa8fa431bd0b0f54d961e8337d18bde0cce4a956c3a5c9f97d5961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d511ddd6-52d9-11f1-a769-42010a9c0008", "comment": "Malware payload (MimiKatz)", "timestamp": 1779123096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123096, "uuid": "d565eab5-7db7-454c-b21c-ee1034f57ec4", "comment": "Malware payload (MimiKatz)", "value": "ff4acd55956277e6131a6cd67a737a0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123096, "uuid": "7f1d7d9c-7acc-41da-807a-f23caf440723", "comment": "Malware payload (MimiKatz)", "value": "f56b6877b0bb45a7ac23e785142fec6b7b24e5ccead9f26fb5aa294223fdd8aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123096, "uuid": "f667a78f-815f-414e-8c06-451b47253654", "comment": "Malware payload (MimiKatz)", "value": "3d3b73023a3613a098cf279c34f2d7a9469dfe89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779123096, "uuid": "273e277d-e055-45e7-9152-8cfef4412baf", "comment": "Malware payload (MimiKatz)", "value": "79762947a413ccce7694bc4744a8b7dbe5e502c55a6e05fa9411239d940ae2e12847465548ec5d148486c98d32931a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779123096, "uuid": "19337d55-7066-4b5a-9209-1ed889b4049c", "value": "T1EB220B186BE90626D6BB0B790CB38390CB35F9629D2ADF5F2A90107D2C72F54C953763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779123096, "uuid": "6b9f75a8-f30d-40b8-8ae0-9b17c557872a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779123096, "uuid": "0925ae86-8488-416e-9c60-1d54adfbbd17", "value": "192:GXJ44xNyZoAtl2F7Hjzxtl9JodlNq9nGECM2S:GXJLNyZoATa99Jo/EncM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779123096, "uuid": "a0346ed9-d33a-4110-a051-b444cfdec5e7", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779123096, "uuid": "e817c962-20ae-4a2d-a76b-015569030c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779123096, "uuid": "1b33ccd1-217f-4894-b003-0a4434a03702", "value": "fsta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947f1806-52ef-11f1-a769-42010a9c0008", "comment": "Malware payload (EpsilonStealer)", "timestamp": 1779132436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132436, "uuid": "42369439-7cde-4fc5-8ad5-b537fcd9c532", "comment": "Malware payload (EpsilonStealer)", "value": "183f3596aa57ad5a5e0336df7ff2c81a", "object_relation": "md5", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132436, "uuid": "99edc40c-04d4-40f3-8d4f-0d44e333b8e2", "comment": "Malware payload (EpsilonStealer)", "value": "f5f8b089e7fff60198f9be1b8292dc556eecc3bce94db1c71ed647c7f98ad6fc", "object_relation": "sha256", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132436, "uuid": "4a88cf8d-54bc-4b98-b6fe-49bf7bc42488", "comment": "Malware payload (EpsilonStealer)", "value": "24fc0db8088eb2a838f964fe1b9d5703d74aaa06", "object_relation": "sha1", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132436, "uuid": "384904ae-ed8b-482b-8126-9b853d947357", "comment": "Malware payload (EpsilonStealer)", "value": "c956e39de9e04aef6c7cc678705f720aed9bfdee25553c618d28f72c8452c6b270f27f9de711c4c5657da64e106c4bc7", "object_relation": "sha3-384", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132436, "uuid": "e969acbe-f81c-4852-8654-34f535ea172c", "value": "T1D61833353237D462D0F5E5BF2E52C8199324AF67E3B73AFF270A0A847679492047D12A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132436, "uuid": "47a60f95-bf0f-4c42-a054-434e76f613ce", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132436, "uuid": "efe971e5-9c39-4005-aeaf-33acd1a86e42", "value": "1572864:Pt9IKP6N9rJG3Ou7PRWY4txsO1gRkbSoP9vHaGHNcXDMB1/pw5FjLw0yu7:PUKP3OoPRWzvgGdP9SiNcQr/kLw0p7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779132436, "uuid": "67b36ddd-9034-4ffd-adb1-0ad6d7fe5d59", "value": 86425917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779132436, "uuid": "6faa0a53-b468-41c5-90a0-fd6866aa42a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132436, "uuid": "4bb5a521-f627-4b7d-8e05-4bf38bf2453e", "value": "winhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f66f35-52f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779134631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134631, "uuid": "2a75a24d-6c83-47d2-8e33-3df2b3227c7f", "comment": "Malware payload", "value": "f2b154b2d62598704d66d8eb49504e3a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134631, "uuid": "d0aa560b-c6e2-4f70-9ec9-fd709dbff3db", "comment": "Malware payload", "value": "f7c8a872c7d456c761ab679fd30a05f32d0c5991e0eceb9418a6d03a23af853c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134631, "uuid": "aa32aef5-86f5-4662-9095-252ed54e975f", "comment": "Malware payload", "value": "0e5f76d1953d283f80bdf5e50c8e2e3b69de227c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779134631, "uuid": "ddf67901-fa51-4431-845c-5c621b453e3f", "comment": "Malware payload", "value": "cc2c753a537c56447f6cdb8088d107ed826132fbc7b44f0101ae48b325f5a3c948e6020611b3e4ed55898acf44cd7109", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134631, "uuid": "363592cc-c255-4c0f-a6a9-31a15a9ce9e9", "value": "T1E57633AF87E664080D57A1FEA483576DD2AA2507EF2CD9D12AD02263F7C1753288F71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134631, "uuid": "11e75c13-7a91-416e-81bb-dc2b1e60741b", "value": "196608:iRbq2D+FJAG4gz0vQ3KBlRbq27Rbq2fRbq2teHmDF1B/GMRbq2i:iRPD+w6KvvRP7RPfRPteGDHdvRPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779134631, "uuid": "a9c4ecb5-b84e-461d-8ed3-31f63f4e6b41", "value": 7455852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779134631, "uuid": "3867c07f-3245-4358-a768-f0e091130516", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779134631, "uuid": "50154d5f-aec0-4363-9144-5f2ded59f64c", "value": "XIANGMUDAQUAN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49d9635-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779120867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120867, "uuid": "6f62decb-47c1-45fa-9f1d-8641bbc5b750", "comment": "Malware payload (Efimer)", "value": "83bda4a8e63e83f2d3059d7d8cb665ad", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120867, "uuid": "b67e9ae5-d24c-4393-8e46-680f109cac0b", "comment": "Malware payload (Efimer)", "value": "f9ebd87556fe40b915a8694ba2c700955567bc487ffc9df2426eb3f9842ceb03", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120867, "uuid": "5d0387c1-ae1c-44d0-b6d5-6db2082e0e94", "comment": "Malware payload (Efimer)", "value": "e0773f05ff483f0f05994d27b6ad0770d4a334e8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779120867, "uuid": "7f4a17a0-d65d-4a90-a029-59e387954699", "comment": "Malware payload (Efimer)", "value": "87fcaeb7b4cf4d540a27efd95e1cba1d490c9d42f7eaf03bb8f2bf48a08f7b72302795dafda3f88c63d9a52e23ad6b49", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120867, "uuid": "a747fe91-f446-4849-b616-d028f5dc6574", "value": "T16FE63308A5E5E1FECAF394B87BE626F0A0B13C3523759D321B15D7B1ACA3494D62D063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120867, "uuid": "125d6cc8-9b36-410d-9abf-61836f3451ef", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120867, "uuid": "9a9735b6-b1df-419f-a10a-431f8dad2d02", "value": "393216:jjMPN5q5bOWuYd0a3k3CW7URF9XMCHWUjXKcuI3/PGTAI:jjo/3Wul4k30XXMb8XnH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779120867, "uuid": "30538fcf-cfb4-4cc7-9abb-b7a33cbdb094", "value": 13875146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779120867, "uuid": "1d67b20a-423a-4855-8e10-49eb6f8a26cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779120867, "uuid": "591e3172-af35-4fa8-9d90-d3c301d7f6fb", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b50ecd-52aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779102553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102553, "uuid": "72ce5282-96d6-4372-b21a-738df8f51031", "comment": "Malware payload", "value": "e93596b7a6e80f80cf087c8635020390", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102553, "uuid": "d09b3e4c-80f1-41a5-9be7-fe5e8b7e75ce", "comment": "Malware payload", "value": "fa8a49f9aa07b8fc860ef69fc5cfa134d81cd85a6aa6bd6c729936bf6b2342b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102553, "uuid": "6996ec16-3928-48bf-9fb1-2c43e92ed007", "comment": "Malware payload", "value": "88e7a69f950708a5a066bf6054b73eb3b4b98fff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779102553, "uuid": "b72e33e6-d2d4-409b-bd33-e88ca35c19c1", "comment": "Malware payload", "value": "c6839ed90db0f321445bf4b32fdb06cf96b0e578442f93f0a6741c7ae6a9fc18d1bd267eb7c4605f7bc3d15e87c6787e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102553, "uuid": "e419d354-1ffd-488f-a5d4-ee099f3c96e4", "value": "T1DD35FF25E7E91309F1F39FC0BDB55452A83EFE5A2E2DD85C1290014E0972A09E979B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102553, "uuid": "5ffe0ee8-592f-4ed7-aa18-d18567687061", "value": "12288:CvLuT3OQAGuxcNRJMparUGVrj9JdcgSPx4u:CvLuT3OQAGuapc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779102553, "uuid": "49e2adbb-4cfd-484f-a73f-6dea5a80e591", "value": 1125048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779102553, "uuid": "a6ae94bf-ce0e-453f-a817-f92fd4b17d5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779102553, "uuid": "2cea84c9-484b-4f87-9169-cc0cf552265f", "value": "output_zkmmz8fv.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059e19f0-5259-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779067772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067772, "uuid": "302b366b-ecf9-4a2f-bcf8-0c022afb1b21", "comment": "Malware payload (Mirai)", "value": "ea23d739dc12f08a178546bfee2fff25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067772, "uuid": "16eb4e91-b8d0-454a-be03-94720fff2054", "comment": "Malware payload (Mirai)", "value": "fa9ecfcbe373ae474a71d23cff556077a0d601f0c54ae609562f3cc8e549dbd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067772, "uuid": "5871e7fd-012b-4c70-87e8-00b227305083", "comment": "Malware payload (Mirai)", "value": "3e416b4723de808a183dd420c42c020a9553deeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779067772, "uuid": "562b2f4d-422a-495b-80db-75dd14a59efa", "comment": "Malware payload (Mirai)", "value": "c3ec099f344d6c091942185c69cd4c4c4f335fc3d90e5fa0bbfa97a1a730731d705c4f1d75635979b8aa3f3953541828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067772, "uuid": "431ffdaa-7c18-4c65-9f87-cd0a6e3963e1", "value": "T172D3C021E4006DD1EC2129F578BA96BC0350EE700BDE1582EFFDE95E747BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067772, "uuid": "5c03004f-3713-47ce-9aec-8801d16ca856", "value": "3072:PHiBTNkAgcly+hoVpE6AKUjq+8biA7JBd/xi:PCdny+hovsmzbisJfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779067772, "uuid": "b4c5eb73-7bbc-4cd9-a602-24515c80439b", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779067772, "uuid": "9bb0bf40-9f2e-4d9a-8266-4012a3914c4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779067772, "uuid": "84609e6a-7ca2-4701-aa22-fac914a82dff", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a2acef-52d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779121008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121008, "uuid": "ec7b08f5-72a2-48cb-9c26-a2daa5e998da", "comment": "Malware payload (Efimer)", "value": "63b4826f9213cfd9d28e56f1b8a40b03", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121008, "uuid": "01594592-3fa4-47c5-8d81-57a7c460e929", "comment": "Malware payload (Efimer)", "value": "fb252a31752df2354d49e31ca3d92e056f4563488df7cb29fd682c1528c1af74", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121008, "uuid": "d991e71f-341e-4464-bad3-dc408824044e", "comment": "Malware payload (Efimer)", "value": "3efc51ce1353901e559602d7c2def5b1c8711740", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779121008, "uuid": "380f06fb-9b8c-43a1-bb31-2b27215b1f4e", "comment": "Malware payload (Efimer)", "value": "54de4f610a5e020fce5aeeacac2150e0338ed9648052b1ca7df7a3c5cd12b9c513ef50fb66c27734abdbfe9d950aafe9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121008, "uuid": "0ee1bed2-8823-4b67-8f7b-83cc47196a1f", "value": "T1B7D6333960E2A2FDC3B79174BFA257B4A83074E89775DC221E50E774BC6B570682C0A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121008, "uuid": "411455b5-7d4e-476c-b397-03993b6a3625", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121008, "uuid": "24eb8f4c-537c-4ac0-8558-7ac060a60bd1", "value": "393216:a8DXAAB6E574A9AfEV52cXMCHWUjX/cuI3/PGTAI:a87AzE57f9UEf2cXMb8XUH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779121008, "uuid": "de0f3f30-fee7-49e5-b102-4135db5a29f2", "value": 13836558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779121008, "uuid": "aca771e7-70d1-47f7-a2ee-e986ba7b0d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779121008, "uuid": "2818ae77-e967-461a-84fd-470994dd0cc4", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30858ec0-530a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779143865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143865, "uuid": "dc91e10a-a7b7-4558-a927-d7abbf11be5a", "comment": "Malware payload", "value": "9c97f05d12e3987883ddd10a7e255c12", "object_relation": "md5", "Tag": [ { "name": "178-16-55-25", "colour": "#5C685D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143865, "uuid": "14c0b35c-0f6a-46a8-8c75-af4276b978d3", "comment": "Malware payload", "value": "fbcbaae611a389ae94edca32603848ab269393d3bb42361cba1ce0c86c8c6fa1", "object_relation": "sha256", "Tag": [ { "name": "178-16-55-25", "colour": "#5C685D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143865, "uuid": "4d2a087f-9b2f-4dd4-8dbe-5c11d254220a", "comment": "Malware payload", "value": "e58b9fe0732b7f7296a365432586aeb53fe20dad", "object_relation": "sha1", "Tag": [ { "name": "178-16-55-25", "colour": "#5C685D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779143865, "uuid": "2f058f6e-e788-4dd9-b36d-3b3752237c98", "comment": "Malware payload", "value": "b6dbaf32c1a508de9bd1fcc12fd9c046a8f44e83a7ab1347b1a2bf4ee5d480e8920b5fcbf0ab042c4a7113eb546f0b34", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-55-25", "colour": "#5C685D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143865, "uuid": "428eb7a5-bdd2-4c9a-b1e2-8257629fdd5a", "value": "T17797330FB00435A1D406C597945118E41EB68B1CB3666ACE3BEDC7F9EA776AD0EFB840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143865, "uuid": "c50b4e6d-b197-4818-9a71-000fba5d3a1e", "value": "786432:XOZezyxz2c3uMnJ+Jp3fQ9cEuWmaN6p1EDT8AXwhgSb3udNvJT4:X/zyxz13uMnJQpmcEfmagOIAXwWSLudM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779143865, "uuid": "1066c119-d8ad-4f5c-a3f4-ad5b263f6b4f", "value": 40653139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779143865, "uuid": "db468d6d-cf4a-4e99-a5ec-3a0964d7ed83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779143865, "uuid": "38989149-aa4f-4d84-a2b4-ebec0d5d2b23", "value": "Setup_File_30.161.1260.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6b7fd9-5276-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1779080559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080559, "uuid": "08040875-7728-4427-a03f-0b776651f11f", "comment": "Malware payload (GuLoader)", "value": "bd3f9e29ec9ecafc9b8b2475afb3a9a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080559, "uuid": "1a37d6ae-0783-4ade-98ec-ab76afb48a67", "comment": "Malware payload (GuLoader)", "value": "fc72839f0b784c29f9e6ed22944f622ba6498c1f9b9aaf59aa125ace2db6e802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080559, "uuid": "17ddbf8d-f3b2-496c-906f-8527f5992b43", "comment": "Malware payload (GuLoader)", "value": "9825911de647070dc072b5ebd84b00e2af11a26c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779080559, "uuid": "77a19194-b6c1-408f-92cf-75f61d0d0066", "comment": "Malware payload (GuLoader)", "value": "5d32a011739b3e0f3fc89c062dc1a1c21ca6e7d67a3f62aaff8612fbf8dfab91f33b7ccdaa9a8c339eaef031464e8628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080559, "uuid": "a07ed970-12bc-4b99-acd0-ed067307b4f3", "value": "T1C34402253551E8F3CB7896320D7BABAF8FF58CA004C8A3476F457D2A7C73266491E186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080559, "uuid": "81729422-c752-4ab1-85a6-048cfe9c2cc1", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080559, "uuid": "36ed8a09-d41f-4f4f-903a-5cf6633a239d", "value": "6144:88dWR8tcsWqDAt+tPAJZ0gQABtc6NnSb94ULpOtCRnavOBzKI:VMR8tJlaUPSP1CUSb+ULpkC1avOd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779080559, "uuid": "4cae7e76-d0ac-46ec-a30f-1534df65b61a", "value": 266144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779080559, "uuid": "4b6c32a9-b45f-480e-9ed5-624459994c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779080559, "uuid": "a928fa7b-fc92-4f05-a645-d8aef5bba0aa", "value": "Po-49499900000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf2b880-52f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779132826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132826, "uuid": "e4190cc7-1ce8-47d4-b3b3-393a35fc5801", "comment": "Malware payload (Mirai)", "value": "fd3b0d4ba0231331e8c4799ca85803c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132826, "uuid": "85e8313c-59f3-4a9d-9002-9191243cfdfc", "comment": "Malware payload (Mirai)", "value": "ff18154d33bac3d5c29008bd0eb4a51f7dacf90f8f0af27f1a6f764b747b22c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132826, "uuid": "f47afaad-f022-4c59-8a08-24a317535800", "comment": "Malware payload (Mirai)", "value": "0f61cdd9d8217fda425acca85bd9baa0a82c3570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779132826, "uuid": "ad73dbd6-10b2-438f-a2d6-6aad0a1a7b06", "comment": "Malware payload (Mirai)", "value": "e1e64fa58b0388822f4f7495ee35743fe9eccb35b5d0f5c71fba3143f8d71bf8b5e5f8f751044a197e8c1661c7caa2f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132826, "uuid": "7650b2b4-b2eb-4e2d-b4ef-d4f3a6a179cf", "value": "T117836BD8F643D8F6EC8301711076EB768B73E53D5129DA83C7A99932EC72900D62A79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132826, "uuid": "e7e72e83-6949-433a-8f30-6e6a1ca4d595", "value": "1536:YoOCUm7lO3u2fZQZQ81tgJZ3pxNKybjpwmMZjSqz:OCUm7lO3lQZQw4/xNJbtwmcuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779132826, "uuid": "c8d3eb07-abc6-4f7c-81db-ec9f01030d4d", "value": 87976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779132826, "uuid": "5d1040f0-1c55-4dab-af3c-54e346bc4bb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779132826, "uuid": "124dc5a4-f767-4a77-8cc1-2af80beb30ff", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }