{ "Event": { "published": true, "date": "2026-04-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-03", "timestamp": 1775260982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "cb93730f-8416-4a6a-92fe-40dc836253ae", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1333df2d-2f88-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775239690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239690, "uuid": "2c175380-536f-433c-b55a-ca3e82f3ecad", "comment": "Malware payload (NetSupport)", "value": "f1955ca2476c0e812a0bd2b6af5dd8a4", "object_relation": "md5", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239690, "uuid": "d63eb543-5805-42a4-be12-bc87ea3e3230", "comment": "Malware payload (NetSupport)", "value": "00e8f28233776a2ebe59cd547694b83012d5d9697a5f021a7b6e7e9aa9553922", "object_relation": "sha256", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239690, "uuid": "94cce455-2a58-4c11-b8db-04e108ef1c42", "comment": "Malware payload (NetSupport)", "value": "34e81928e919ccd51a2d83a8c6d744ac477b711d", "object_relation": "sha1", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239690, "uuid": "27a37443-ce5b-4e20-81a6-f2be51c97ef1", "comment": "Malware payload (NetSupport)", "value": "464208d9a1774aaa1de515cc4144b62287b2643ba8593a46beea65ef10d793e3cf41dbe6c304332293f4ae78f0829112", "object_relation": "sha3-384", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239690, "uuid": "cf617079-6494-45c4-a612-93b6647b9f44", "value": "T15B967CB88B84975EAE6E1A07E078571E67F37F26D09271FC5B62370B216FC086639C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239690, "uuid": "d58ff83d-0cf3-43f4-b16e-275d0e997e6f", "value": "49152:a3a7k1IvGaA1UzZfjTlGDRISMvSQpV9xwSjEZV7Vu2zAxN9yDt:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775239690, "uuid": "3c907fb5-2c4c-4b61-8a7c-2ee2dabf854d", "value": 9410827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775239690, "uuid": "fbe57db5-d319-41f8-9ec4-3dfcba7a1410", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239690, "uuid": "ecefbce0-a413-4341-b500-edd4b4116a42", "value": "032.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f73908-2fb6-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775259610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259610, "uuid": "cfa70355-62a2-46ee-85a7-40d2a7126733", "comment": "Malware payload (AsyncRAT)", "value": "cb369d8917f97ef9f109b5d99530e43e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259610, "uuid": "cbae69ab-542a-46fb-9128-d207ca507ee2", "comment": "Malware payload (AsyncRAT)", "value": "017ba68aa41ff6416707ea9fe1482dc231a6c6e2740961f5107c88695e9c4362", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259610, "uuid": "a61ca7eb-6dff-4bdd-92cd-da4e19e6b06a", "comment": "Malware payload (AsyncRAT)", "value": "c4a52c63908a1df3235c81fe1cd40f52214221bb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259610, "uuid": "dbaf24d7-b68b-4aaa-85f4-5c5b4aa8654b", "comment": "Malware payload (AsyncRAT)", "value": "9d5fb4ecd96f327a420b510238d4071976d3bc2bb8b2c5fb48ac519f29a24675f06cf78bb94e25c2c2a02c674c12c713", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259610, "uuid": "3d925a5f-9597-4b32-a002-612b757d6c77", "value": "T18F233C003BE9812BF27E4F74A9F32145867AF2673602D64E5CC441971A13FC6DA92AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259610, "uuid": "37d85efd-6a40-4aac-aa1a-7f3af6430746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259610, "uuid": "a993f595-8bdd-49dd-9bab-3c8bf27ea9bb", "value": "768:+uQKNTREhzxrWUXrm5mo2q7L5SynRxPIMMewb8F0bZOQGS3trUS+xfMBDZRr:+uQKNTR+W2InIM7wb8ybZeaZYfKdRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775259610, "uuid": "75900545-bd35-46f3-9b50-5945b96c65f0", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775259610, "uuid": "03aeb39b-a322-4de3-ae95-8a86501372b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259610, "uuid": "ead89b17-0830-427f-a489-a4a793effb5f", "value": "AsyncaaClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aed7ea5-2fb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775259970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259970, "uuid": "92346a07-938f-41f5-b07b-224e6cb69ace", "comment": "Malware payload", "value": "3d4028c7e642056956b562b6f516c151", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259970, "uuid": "2d064c77-84a9-444b-912b-43ee03c46634", "comment": "Malware payload", "value": "03629a1aadcaa89a630ec5acc0995310a8f15167692a2be690d1f58aab976a76", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259970, "uuid": "102c8284-9912-4d57-bfcd-106770642c1d", "comment": "Malware payload", "value": "0b6b771b686aa28bff147a2ebd59be5e075ae3f9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259970, "uuid": "66acb1e9-ad1e-4750-9a98-a91e3eef0ff3", "comment": "Malware payload", "value": "72e2e23249e26d3b72fdced404cc34cd50bd390830e84e8910f99836048a5a6271d07c024399916017f693a5969536c6", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259970, "uuid": "14678a88-edb7-41fc-9355-6ca1c2904a88", "value": "T191773362D073F2574C7B7406C039E96F6C73069DCEC98A7A4A4E8253D7C29D87BE091A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259970, "uuid": "aac098cb-3784-4f92-9d24-b42b7a9a4a5a", "value": "786432:U9GkB2ZRFRNDwaApEyJtQY70W16WCWBn6YqpmwURx:qGoe7CtEwt16WjVq1Ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775259970, "uuid": "d6fef481-4cbc-4ac1-b987-7d499182d0f4", "value": 33721349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775259970, "uuid": "f7242628-bbf9-42cc-8e81-3b4f9ef8b07a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259970, "uuid": "96865161-d09e-43b5-86f4-7f4b5a5efc47", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6799fdf8-2eff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775180991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775180991, "uuid": "604fec14-fcc8-4c73-99b5-4881e9168fe1", "comment": "Malware payload", "value": "0b2dd04f55951e3d7e42268c47161128", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775180991, "uuid": "ef6c4f34-4223-4e95-8623-5e650e0b3cf6", "comment": "Malware payload", "value": "0748253bb84d8fd3277d926bee9aae97560c37921ccb3d1dbf3199fae3e62a20", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775180991, "uuid": "5463603c-d1cf-4499-8cbe-66766ba24f2d", "comment": "Malware payload", "value": "1b4cd4e9944032fe88cac5dc0c5fc46d2189b327", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775180991, "uuid": "706a87a6-562a-4095-88da-2f2e666f4a8b", "comment": "Malware payload", "value": "4424b756b0fd9c7c89ebe9552b3c331d6c941c841bd4a5ba63c7ef82a81525f8904ee54f41aee25a10ed126a3b8f6832", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775180991, "uuid": "950ec0dc-05f4-41f9-a620-eced003c7171", "value": "T109735BA772E74E5ACAAC46B980A1130103F3D307B593F35B28D851A5EE86BDB9501FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775180991, "uuid": "abbc0da8-2238-40c0-b8a8-28f604224c4c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775180991, "uuid": "ff5ae21a-d77e-4ba8-b186-1b2ac366b0b2", "value": "1536:Qpvlf3YHzsJnzXj+wngdh3GeOmonpjXb4TtrqeVc8Xq:QYzm7xg73zO9n1kzn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775180991, "uuid": "536e47dc-eb0a-4f02-acd4-44f16b6bd2f4", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775180991, "uuid": "d08b991e-1741-4b52-a018-10c115e029bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775180991, "uuid": "836dfc3a-ffaa-4e76-b01e-471c3ed00a79", "value": "bf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a05f64-2fb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775260022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260022, "uuid": "c8dc6721-85b6-4c45-8292-b7e1f2c151a7", "comment": "Malware payload", "value": "e7085f559567be0863cc33b52f4a65cc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260022, "uuid": "a0df38ce-4900-4df1-a428-1bf660560e92", "comment": "Malware payload", "value": "07f1f906cc3c81db1aeffa3850258d46b78c5c02131bf01d35aaa5fa3a1362c0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260022, "uuid": "6d727f68-727f-4887-bd5b-57579a42d762", "comment": "Malware payload", "value": "1fe34dbdf18ecfd8907fbddecbc40d4f8827c059", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260022, "uuid": "04d84b9f-40cd-411b-bb9f-8ed9b20e1b4c", "comment": "Malware payload", "value": "d171b0f32116e17eb745bac60dac573549433508eec56c74e5d8d7779f3e3ac017f8009084da2074d27f9e1c05379440", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260022, "uuid": "96f4e6af-b74b-4d40-9693-43ba1582b2af", "value": "T19AF61332F546B126ECF214F3D3FA0FB649665D586B29E0D360D478D492328E326F924E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260022, "uuid": "694b8622-f619-4e2d-be7e-cb0a3b21f754", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260022, "uuid": "03e96974-48c8-4ca4-9972-22ae83a261d1", "value": "393216:DAHsRh0VPqUiqwPST2KPhJ5n8ujiBptyxM1ZsPlQ:sM/0QdKTJPH5n840f4M1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775260022, "uuid": "377efd04-e863-49e8-80e9-d1f87d007092", "value": 16644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775260022, "uuid": "633f3f1d-b7cb-4b65-86d4-2f9e0c390ebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260022, "uuid": "8a11e0ba-26b8-40d2-a8ed-39de04048869", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a1ffa4-2fb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775260502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260502, "uuid": "f79ae51c-6a99-4563-90a4-595d2c499131", "comment": "Malware payload", "value": "4388afc6152b6c6dcf3759ecc321e64e", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260502, "uuid": "30886daa-2ca9-401e-89f7-5c0e378b0fb0", "comment": "Malware payload", "value": "09ab9c71fb2c74a05191051caae0658b3c056820a3b9f6a091a75ff426932cd9", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260502, "uuid": "ba6ef364-e2f8-4a25-9693-0726a5a85535", "comment": "Malware payload", "value": "010962428d53c6fd21f58c21be23bb3e7365649c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260502, "uuid": "ede42c6a-fd38-4b14-9323-5c2706d2cab4", "comment": "Malware payload", "value": "4c3d97a05ae5ea0a7f2e6e8d882d62b8f0838521f0739dad2072ce282ee63173c8f4053af31eb60bf233142402a1167a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260502, "uuid": "9714b695-3fbf-4895-bc25-33023e4ea64e", "value": "T1AF36BF32F546A125DCF224B353FD6AB605ADAC546B29E4C3B1CC3AD984724D322F634E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260502, "uuid": "a1e23af4-c33f-4ab0-95b8-1c68c5f353a5", "value": "b2a93297c823b89942d5a78509c4f6e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260502, "uuid": "4f019422-b726-442a-b189-b53351a22226", "value": "98304:KOCaRvn63VQHM9HXLMqEA+lLo333LetOaO3U0U9BFwx:n/RC9AAIhO3UVBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775260502, "uuid": "8f8ebc0a-f31b-4acc-80cd-092c39b2dc18", "value": 5126656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775260502, "uuid": "4e3fcb64-4fbc-456e-9d8b-dceb00d33425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260502, "uuid": "79efb0ca-0117-4a86-975c-8b99f188c9b4", "value": "python36.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021ec29d-2f45-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1775210886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210886, "uuid": "1f80fb9d-4619-478e-8c35-f9f9590e996e", "comment": "Malware payload (Socks5Systemz)", "value": "f2f5e18474c0ccda742a1fc80be19b75", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210886, "uuid": "3a50bf9d-fce4-452f-93b5-ed2a625f501b", "comment": "Malware payload (Socks5Systemz)", "value": "09dda73200a8456cdf684707e212326f9a96a6aaf0daa80dbf2e21a26564b457", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210886, "uuid": "aa84ef39-8249-46f3-a6ac-b2c82ff0f335", "comment": "Malware payload (Socks5Systemz)", "value": "78546e37890ccf9cb4f6e53e5bf93906e3c1a0a0", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210886, "uuid": "2c45ac17-c516-4bc0-8587-2d7596e1a2f8", "comment": "Malware payload (Socks5Systemz)", "value": "d3bccd8d8aaba768e8a79324486519ddfb9234c1fd69f10b1c1e3f5c513654517ffb307c469f48a9b9c0ff10fb7d1b9f", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210886, "uuid": "55ad9700-380d-42f0-8687-9314bb56fb28", "value": "T125263341BF9A50FCD593F6B04E2BE06A8B2BE60916761026B19DF7AF4933C452C1F225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210886, "uuid": "c6f25793-27d9-4adb-97d0-29db1fcd6587", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210886, "uuid": "e62436e6-b05f-487f-8b14-3c3c8b1d7ca6", "value": "98304:N7YSwDyUmLnx+nwl+3S5tintAJf5mr+GGNKQ2Lmkl+8:gDyTAwQigtAJfVNKvmk48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775210886, "uuid": "09323e38-56f4-452c-bd99-b557651c4771", "value": 4494402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775210886, "uuid": "37f021cd-2fcc-4860-8e5c-3dab91c0d4b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210886, "uuid": "77830304-feaf-4156-b1f7-ebe0f4d7fe08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a9773e-2f72-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775230269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230269, "uuid": "306148db-e70b-4057-8117-883814e42f09", "comment": "Malware payload (njrat)", "value": "06d5334d49746b9e5df32096867cf7e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230269, "uuid": "13446636-9748-414f-bae8-5cc1fa6fb84c", "comment": "Malware payload (njrat)", "value": "0b014555196d3200ff9a28efb49591f617c0ec9904da44b9348a4c27c4edc2de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230269, "uuid": "11ba8b33-f250-466f-81b8-fac3ec01bf62", "comment": "Malware payload (njrat)", "value": "1cb39a426b8f13fa36bac4e9c4cc47a6042fb0c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230269, "uuid": "dfe81574-d82a-4b4b-8cbc-e5764ac9d31d", "comment": "Malware payload (njrat)", "value": "1800a3d399628a7f0e8fd7ce6cd1f1e9a77b76c668a1065f57c10f061e496a867bb0c6763736eb2fd398b26aaa681ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230269, "uuid": "340404a7-fc40-4a2a-aadd-805a2d714b31", "value": "T1EFB2084A3FA98856C5BC1A748AA5D65003B4D1470423EE2F8DC960CBAFB36D91D48AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230269, "uuid": "1428c108-7799-4268-9d0e-3648ddb29cac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230269, "uuid": "58becf9e-efbe-42b0-95dc-777da701c498", "value": "384:/I2SUwXh0ZbAzlRGCvkodj46hgHK0hrV5mRvR6JZlbw8hqIusZzZ/Y2:YbhEkdvXRpcnuYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775230269, "uuid": "8d2e2f11-93d1-4b5c-9215-35081423ce57", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775230269, "uuid": "67de71fc-3ff0-4864-9d2c-2d06b97ce697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230269, "uuid": "d381f2e8-e079-4086-8c82-caae86375d31", "value": "06d5334d49746b9e5df32096867cf7e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10095093-2f6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775226800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226800, "uuid": "2edf7677-5a4c-43de-8301-20210afc3e42", "comment": "Malware payload", "value": "1e2d2841d771982bfb9e93a8fb01c83b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226800, "uuid": "b261ba18-bcca-4e6a-b750-85d69da3f522", "comment": "Malware payload", "value": "0b6b36a1ea647ccec195ef2b642aad2ff2fac4e4c53208cb9ee70ffcea6c81f4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226800, "uuid": "8ad4eeb8-e5e4-4fab-a927-186e1f65f6b9", "comment": "Malware payload", "value": "681b8c16f1ad68448b40d603058976d31cc2150e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226800, "uuid": "9b7bdfd3-73c6-44c6-b8e9-fce4a586ce05", "comment": "Malware payload", "value": "89a15b5065fa5da524fb4b8ab279b5d394cd7420bb30346318c1e452fcfffa13e5dc99d5d2ae1d33ee682949235783d1", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226800, "uuid": "26eb72e3-53d8-4010-be8f-c11fd369383a", "value": "T140B18D2072730CB21D4A12031E7FDDC34FB032DCB21A56E1AA3C71D28542C2D9A8AC6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226800, "uuid": "e3a66848-7d80-4a4b-a1ad-2451a4d310e7", "value": "96:nFclo5wLxwDhw2VDvnfvIw5GCebzuhKro3XZ+L708vgLvRgWuX5xFR:Fso5NhjVjAw55UuVcf07gWuJvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775226800, "uuid": "91373133-1c72-4e6d-b94e-92c2ea03a05c", "value": 5495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775226800, "uuid": "11d957d0-5704-4f25-8d9e-eb86aba5f206", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226800, "uuid": "cfe2827b-c897-4202-aad9-bcd0b3f0d2ec", "value": "NEW ORDER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5928acba-2f6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775228211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775228211, "uuid": "c063923f-63b9-4107-bf61-5a2f12044285", "comment": "Malware payload", "value": "6a87b2060e11772379205f10f1ed0783", "object_relation": "md5", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775228211, "uuid": "4521b571-f695-487b-bbb3-cedd99d223d8", "comment": "Malware payload", "value": "0bb0fa1f70e5ea93c596465e26ade61c02cd597af649368ad6a3c01544224e1e", "object_relation": "sha256", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775228211, "uuid": "4be0c69a-1564-485d-a7e4-525b91e93510", "comment": "Malware payload", "value": "536d74dfa263e81932aafb399f708d1cb3c70fde", "object_relation": "sha1", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775228211, "uuid": "11dc0a46-a875-4d4c-a2e2-09d91fa5a1cd", "comment": "Malware payload", "value": "fc5a197f969c46b78188f44381d77a4039fa0943375c894b0d195341fb71650b2977a3348f2e15190783a2ff330962a5", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775228211, "uuid": "49d2c88c-3a20-4289-9966-746359f82f13", "value": "T101B1B61F6D17E5B06536CF58863BBC2CDA91A027C86164583A9CC4C68F70E2CCDA45EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775228211, "uuid": "a75b3a54-33c4-4613-b98a-7b5b817cdd00", "value": "96:JmYHieJiIRT8eBEscOcml/2OltnF7xhyOI/C/MhSRfAHitkNxdKswQcANyaoF/r/:JmYHi5IyeBENOHl/2O97xhrI/C/qxn/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775228211, "uuid": "9a08a74b-fadf-46ce-9882-778c0341f817", "value": 5263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775228211, "uuid": "c52abb76-4097-4fe1-9715-661102026e4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775228211, "uuid": "09ce4a80-1ccf-440e-bc99-406de69b83d9", "value": "AccessWinRAR.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378bb918-2f44-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775210546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210546, "uuid": "606cb9ac-b18f-4d87-a434-785a82d9b7cf", "comment": "Malware payload (Phorpiex)", "value": "53f8b48aac10f29dbc8017c5b559319a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210546, "uuid": "a6a95d50-ed14-43a3-9113-dbdcd76be083", "comment": "Malware payload (Phorpiex)", "value": "0be4b693eea4b551de0044d8303c31749df873e005756db5a1d68db8c9a516fd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210546, "uuid": "8f42d9d3-aa05-4c19-b25f-192d26a5e46b", "comment": "Malware payload (Phorpiex)", "value": "1f9089055132e3bf6d730a76c3afe3cc2b772221", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210546, "uuid": "7c315fd9-6eb5-40ae-a433-7d8b62da2a4f", "comment": "Malware payload (Phorpiex)", "value": "d036160cc79c8f0ee01e66eb25cb94386c040cb8b54c4414f133d21ad66fa5b7fecf133bc5621c8cba6f833f140e9812", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210546, "uuid": "42f8c836-43fe-4ae8-a72c-ad0980b68d5e", "value": "T1B9823A0FB9424216D0D100B4A672867BC9B9A87637C864EBF7D48AED0A686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210546, "uuid": "4b0b479e-cdd2-4b0c-a477-a479d827f88c", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210546, "uuid": "edc41f67-c4a5-4aef-a5a1-4f84be1728a4", "value": "384:UI78VGwSRFqw/lsx0xu9NHmgdav8U9cQ:VXhsx0U9va0Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775210546, "uuid": "fce59f4c-db09-4ea3-b36d-87980f796e1c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775210546, "uuid": "b99b50b8-788f-46e5-b264-2b9adf8493b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210546, "uuid": "6ae0ddc0-dd87-47f7-8e8f-a2dbf3adf52d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef967d3a-2fb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775260247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260247, "uuid": "4463be49-1f29-4b2e-8092-5b99d4aaa4cd", "comment": "Malware payload", "value": "2a1d315282822ceb549d9b076f6096e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260247, "uuid": "10287a2f-0a52-4aae-802a-ab1b2d3d2079", "comment": "Malware payload", "value": "0d63cca52a1f18a4d1461e49739aabb46e28ef8d2e50f4e80404088e2ba6343a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260247, "uuid": "112aa643-070d-4c5a-a30d-bc547e06d226", "comment": "Malware payload", "value": "afb586f2d8dc8798624a3d7997f5333db35167df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260247, "uuid": "026e4e4a-a485-4e76-aaae-e194dd5e7c5a", "comment": "Malware payload", "value": "f0abe4150142ca3c7cd747229c0ab8108d3c52f0f5cfd62e5fa03fd2c70e22288ef3ed1c5d4f75f23912ab6c0be44ecd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260247, "uuid": "6917ff0a-cad4-440c-8119-89b735715a5d", "value": "T1DE4174E668B4A2F8BF4FA524496E31A9F00257524F876C9CF0A65C0EE5B4895232FC53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260247, "uuid": "06399d7f-df92-439e-9584-90bc9ac410e1", "value": "48:inOx1T70gMP1P4Uo4UlDlCJH/M18lBJQTYXLpIbZt:SS17q1QUHUIH/e8l4TYX90Zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775260247, "uuid": "fd393754-a315-4df1-a30a-c83bd9cae7f4", "value": 2435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775260247, "uuid": "5432b32b-25e8-445e-9523-ff7bcaeecdc8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260247, "uuid": "35cc6d7f-5cb1-4638-9029-4c984b3f5fa7", "value": "apt0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50306047-2f71-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775229914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775229914, "uuid": "22141ffc-fcfc-43b1-abf4-140e98c173af", "comment": "Malware payload", "value": "dda69aaac423ff9604ef879a703cad54", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sw", "colour": "#8EB5A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775229914, "uuid": "ffd6bebb-6ab4-44f6-812d-f0324a110f10", "comment": "Malware payload", "value": "0dc35c7d039cbd947630d7915022df44c9b5c6e849f93b5d597c1c93f171e79e", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sw", "colour": "#8EB5A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775229914, "uuid": "9bb989f1-1aab-498e-9609-4a6c3fd18818", "comment": "Malware payload", "value": "1a0a219fbabbfa7a88f65ad6ff980ecb9e84a332", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sw", "colour": "#8EB5A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775229914, "uuid": "25bda0aa-92d7-4c7b-beca-af51659294a8", "comment": "Malware payload", "value": "27ac96051400435b52f9ebe6ce1284325ac9ad6ab4931750d763a7e1887caa181889849e696043dafdb6fc05bf801212", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sw", "colour": "#8EB5A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775229914, "uuid": "cc95685c-3bd7-41b9-be55-d7a49e7c2255", "value": "T16C280142ADA303A2DD0D76FD70AD233958E08D5F0F2452A65FE7DD25CF2E0906A62D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775229914, "uuid": "a16f54ce-a66d-4c76-82e4-b70085e04881", "value": "a148a8db492373de1476064a76421f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775229914, "uuid": "a9dd0ea8-d2cd-42bc-ac55-85758dc699d8", "value": "98304:fbHdBILINGjXlLZCQg7tGb85bt4R80wsAufjGe7LB3CB7sFnwuAjGeOPF:rsMGjVlCQgpGbpNwFGBmQFnP1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775229914, "uuid": "a8887021-cef1-46c7-9d53-65741fb99adf", "value": 102391808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775229914, "uuid": "9cc16843-c6b3-43eb-9f41-6fb9ddccc762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775229914, "uuid": "a58cfd3a-532b-4667-ac10-37fac42ca30f", "value": "64x.2.5._setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5ea917-2f9e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775249505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249505, "uuid": "d45d9451-ec48-4442-b2cf-06d9d8919c5e", "comment": "Malware payload", "value": "e5822dbd8b7afee587628fa2d8cd4459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249505, "uuid": "8bd6f03d-5a88-4c35-9caf-c757659f7cc1", "comment": "Malware payload", "value": "0e328f948e2b12a2fd760bfa48675972448d73b9ebda89c7cf5433612faafd24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249505, "uuid": "c92fc0d0-22f3-424d-a19d-0693e19aaead", "comment": "Malware payload", "value": "16186b7c979b8f56db9bd6f50908e5e6d8785011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249505, "uuid": "5f927eff-70eb-4591-b698-52be9a8137d1", "comment": "Malware payload", "value": "6a1dd526d682f20a4e196b232b9973e49c5c9ae23ea1ddacacec5ab82847589385107a5eb173d00901224dc6862933d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249505, "uuid": "ba29e2cb-cbd9-4814-9061-9edd18fe3204", "value": "T162A4E1BC865E5C93E52C2A3D899235CC27BB95E00326C39F1D82B0E91FE37D28515E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249505, "uuid": "329f6b69-363a-4e2b-8375-0631f353804d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249505, "uuid": "990a5e62-8e12-44fa-a7b6-10933d691471", "value": "12288:FH5z6U+cLMFtSe5k3CnlX8jVgcIOx+ryR:KUZMrSTEsjrtx+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775249505, "uuid": "db863a01-05b1-4bd5-ba03-3c766b68dc2a", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775249505, "uuid": "5ffaad11-28c7-4500-a780-f2ab4ed4c7c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249505, "uuid": "6bf9b35b-c37b-43b8-bc36-e6813f93fd9c", "value": "unpacked_1bfc10e53f29b9c4d41d1956f6bd2e805370014c853574e04885921d0afa6537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fb7b30-2ef0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775174623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174623, "uuid": "b23c66a4-7fa3-4e19-8a5a-2b6b7e8ba06d", "comment": "Malware payload", "value": "4aeee792a7fe99de7b07f6e90c862924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174623, "uuid": "246ae790-d643-441a-8110-72938302a7eb", "comment": "Malware payload", "value": "0f3ea31d07858c51cb58b8fa1c675922f35f9717c9423bf33fcc780ab4bc2471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174623, "uuid": "50fc405d-1528-49a1-99b3-39bdeef5aebb", "comment": "Malware payload", "value": "25e1706155cbb7b98bac9546ea4f9904d7ede456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174623, "uuid": "17f27509-9b3f-4c06-9773-ae445e1acc39", "comment": "Malware payload", "value": "92d77a83863d14fd9942da4cb4939c695f1968618b9c45dec89da2d2e3adde145cc9d37054238d87a78475b8e94f2c88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174623, "uuid": "916fea32-866e-4632-8709-c87cca31f04e", "value": "T1AAE4E002F7C72036E8252A3584674072FE2F39BE18F1E4162DB6D61E4EBA3D54C76663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174623, "uuid": "03bf4687-4ff2-449f-8d6f-8fbe1883ab79", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174623, "uuid": "a70f8fd3-506c-4cbc-b62a-f9fec1dbc317", "value": "12288:paHc64p888888888888W88888888888If0EaAgdlpKwKT3z1PpNoxMs4PPTu+sOu:8863fliiHj1PpNoutPPzsUAxm1fulR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775174623, "uuid": "5d2b0096-dc11-4386-bad0-28f38c784b88", "value": 665379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775174623, "uuid": "3379d4e3-f6bd-4c77-aed3-84da5aa0d5e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174623, "uuid": "05fa97f2-6764-40d4-bf0b-45506d4d4ca1", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0facd9cb-2f88-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775239685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239685, "uuid": "5f61aa87-8c65-4ee0-baa4-c5aacce0663d", "comment": "Malware payload (SpyNote)", "value": "7ba826f39c65448f422a32627ad4b4f0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239685, "uuid": "d58ed44c-28ea-4cdf-a828-91a18dd8b11c", "comment": "Malware payload (SpyNote)", "value": "108ca43c5a62640b5e3d71df33c00549c46634c1109c1ac6690df89fbc4211fd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239685, "uuid": "60703606-7aeb-43f9-b390-a97bbd4a80d5", "comment": "Malware payload (SpyNote)", "value": "06378209f759cc96fb91afc05f9aa754a2d48fb8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239685, "uuid": "a5378eb6-7bc1-4017-8566-4499136b8f17", "comment": "Malware payload (SpyNote)", "value": "5932cd3d1a3fbb06818e6797147e2bea39f9f1715b98fcef2d044074285642acb17835d77115e44751ef775efe16024e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239685, "uuid": "098b98c2-f088-4234-9681-eae272baa2be", "value": "T11736F107FB44CA8BD8BA83F66F230DA85A130F25C7426AE31464766E3E771D14DD5A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239685, "uuid": "a66a7bc4-2807-46d9-a5d5-c258e9950633", "value": "98304:ViaBvWjq0ZIfyQMAbIonOtPx6mzH+zBXTR0twQcdTcr:DdWjq0Kqea1zHWuGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775239685, "uuid": "d821366f-aae6-4871-99ac-247cffb8c641", "value": 5066694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775239685, "uuid": "d9ee779e-89d0-4031-b2a5-482b45b8fa3e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239685, "uuid": "056167eb-e5d3-4319-a276-51e408d1d1da", "value": "Youtube.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3724547d-2f6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775229013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775229013, "uuid": "34eac4bc-05fd-497a-9ad3-7aed223235a7", "comment": "Malware payload", "value": "d67d5a0b182e853591a0c6775bc0b456", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775229013, "uuid": "bb7671d1-545d-4249-8c5d-6d577bc34bc8", "comment": "Malware payload", "value": "10f4ce434c34aafa6e53e4869235a3314ec679daf38dbea6b2f1b219d4d83d06", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775229013, "uuid": "a8fafdaa-da51-47cc-9458-ee2bd4659396", "comment": "Malware payload", "value": "befd2f92bf5aff2ccbf55cd6da483a91713cbc41", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775229013, "uuid": "06114af6-5380-4be2-8ef5-db5728057032", "comment": "Malware payload", "value": "192d973693dc91faab5285327cf19a6ea90280b8e9d744c7721374f2e46b3a4c3a92c98a953a7d66d714cea3dea20d9a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775229013, "uuid": "20811d50-4fa0-4ecd-8d6f-2955bf16e5f0", "value": "T198E312ABB4735908171FF620122C2F1593E949FF0A2B5A57B7EBCF05A0426F7245C29E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775229013, "uuid": "c23834f9-c2b7-45ba-bc36-65a5e2b496b9", "value": "3072:wv9EcxsV/RjpxJLCcsvVcAxS94aNuIlfprLX6S360EJlyQ:SmPjpxJF8VA9NlfBH36DYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775229013, "uuid": "db3bbad3-052f-4318-b858-3016f598a3a8", "value": 149474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775229013, "uuid": "a4befee4-3a46-49a5-8c60-d7764bef2749", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775229013, "uuid": "1da78443-fc42-4655-8bbd-129ee22d647a", "value": "Stoves.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae67803-2f32-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775202793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202793, "uuid": "773feb16-c13a-4397-ac05-062b3ba145bb", "comment": "Malware payload (AgentTesla)", "value": "7ba5f9e3a82c6a996a71b46e1d693467", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202793, "uuid": "d8a90d5a-cf97-45b5-8fdf-5294d6360324", "comment": "Malware payload (AgentTesla)", "value": "11bf8c110a1318e8cf0d72d634fdc6a9a012586d782bda04c64cb58a45bd997c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202793, "uuid": "9e28a0af-2d16-4f72-95a8-c5f536fc3326", "comment": "Malware payload (AgentTesla)", "value": "8b3633d30c2f8f12b585ae8891605586dc378071", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202793, "uuid": "aeb8376a-e29b-42ec-ba42-19fff556f328", "comment": "Malware payload (AgentTesla)", "value": "2a8eaeaa6e2027dbee9ee7f8e473680b8d55e53637e960264b4bdd2d80a81b6f44c220858bac350a2a9af3d2c376ade2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202793, "uuid": "3f606c47-6eac-43c6-a542-99cd47f3f94c", "value": "T15A54DF24F2ED000CF5F15EC8A5B658A2A877BEB75B0EA4CC09144E8D8B76544C9B3B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202793, "uuid": "7077f50a-9f36-473b-9da2-5253133aef79", "value": "6144:pFRYdj123spsnDTLujthfiEDSZ31Lf7mWXgDbDaoESNdC+Gn:p7bcpsD2hh6EOZ3p83CsdC+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202793, "uuid": "0958e1ab-12cc-4652-9f95-11e77a8c18d5", "value": 303648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202793, "uuid": "e75d426d-1edc-4e8e-9d55-40546d95fb9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202793, "uuid": "c92eabe0-7d21-4f5a-b0d4-beeb600a85cb", "value": "SALE CONTRACT NO- BC-25-0024 - BF-25-0059 - CC-25-000031 - CF-25.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ca7052-2f44-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775210539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210539, "uuid": "5cb85711-0363-4a30-b0de-725fa832f0fb", "comment": "Malware payload (Phorpiex)", "value": "0b7ea97cc3719b9e10d65dbc5dba9d75", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210539, "uuid": "616a48ec-7995-43c7-bdc6-8d3bdd770f37", "comment": "Malware payload (Phorpiex)", "value": "11fbaa9f11fb195b7a2da2030dfd8e29770f46646fd783c4b969a79374be2cb2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210539, "uuid": "d62b14b2-5696-475e-b472-2922fd3909e7", "comment": "Malware payload (Phorpiex)", "value": "0be8752d9f79c158a898ab1bc332df0553dd2cca", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210539, "uuid": "710a7551-5578-466c-927c-b281592d281e", "comment": "Malware payload (Phorpiex)", "value": "9166ed29275acb50bc38ff85de21048df7b4f12a045ae6557012a1b2cd267f773f96a8640673acbdb78c6d223375f84b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210539, "uuid": "f756588a-e240-4f5f-b535-3efdaf79404c", "value": "T12A824A0FB842421AD0D10074A672877BDABD9876378824EBF7D48AED1A686D1FC3314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210539, "uuid": "48145fc6-6ffb-4fd4-bfcc-9a76437d4dc1", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210539, "uuid": "33af471e-fc38-4a82-be1a-6daa1ba96050", "value": "384:gI7MVGgiBFqwTFshSZRu9NHmgNav8U9cD:xHNshU09fa0U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775210539, "uuid": "62cee0b9-c232-4268-84b0-73c5d5f24aa6", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775210539, "uuid": "2a8b2cbf-a872-4195-90f9-fbac72db0510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210539, "uuid": "eaacfae7-a33e-4c02-ac1d-848a9140ae75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f685e7-2f9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775247996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247996, "uuid": "899eb75d-4625-4e52-b8c7-8e0d8d0d99e1", "comment": "Malware payload", "value": "6eec3ea965ecb6deaf3eb9f1eb06c00d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247996, "uuid": "ed01d22d-8602-4046-a05a-0f369d895f13", "comment": "Malware payload", "value": "126a550686490b9354cfb51fa2d4d4703b469b8eec2497889d017ce4f32f38e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247996, "uuid": "99d35a93-3b08-4324-885b-0caf480620fe", "comment": "Malware payload", "value": "f6f3f4a184f3becf0b7cef4ab2ab31b22329420d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247996, "uuid": "fe734a7d-75ca-408f-9868-4ec965aeedb1", "comment": "Malware payload", "value": "a64164d99b8f3b883c6aceb27a7535a1b6570adbfa343a1230b1a0a0286a9ec54923423b6c968cb9e9e5b4151a1978d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247996, "uuid": "158cf7fa-11fc-4df6-8d79-793912e63221", "value": "T1C775334C9BE3C770C5B80FBA55C13177F6ABE33225C94AC5C23080C9566EBEC766526A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247996, "uuid": "fb8564a9-66d9-4240-997b-fa73b7369739", "value": "5866281e215e3423206a9a3f2dd81b7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247996, "uuid": "a6808ca9-a6cb-48cb-b6c5-fd85b153a6d7", "value": "24576:D45aKVcGlEINXVreysUh4tga0VhiKZ2yAu6lUpQScmL2FrDpirwzORy6sd:8xrXVrHlh4tChiKZc453UzOAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775247996, "uuid": "69eb9d0d-e50e-4756-9a8b-ecd40e2c91b4", "value": 1554048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775247996, "uuid": "7d1a2151-c8f7-4890-b7dc-aa54fe032b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247996, "uuid": "8c5c6214-b5d4-4484-b17a-f9c8dacd7f55", "value": "cripzw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d4ab22-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775238037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238037, "uuid": "25d4b035-ab01-4c90-88a4-814688a7adaf", "comment": "Malware payload (Mirai)", "value": "b808af37b0bb7a5fab18ae0e589678cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238037, "uuid": "3b24b756-1e70-43ae-9dc0-80561ad180fc", "comment": "Malware payload (Mirai)", "value": "1344477db0b4c89aba141ffcddc04db45d33d785923092b688dbe368ba8ff1e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238037, "uuid": "5834cb75-50fb-4b51-8c88-057537f5786a", "comment": "Malware payload (Mirai)", "value": "93b91bee01ada2e88688b47783dd004c9ec412ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238037, "uuid": "0e3d8094-a46b-4728-b6f3-40c964bf1bd4", "comment": "Malware payload (Mirai)", "value": "7f54ee94bdecccc98b00e2ed4d026bb7bd64433e9b8b894f2d71798483aab0e8b0dee06d7e2bbca57a2d367302bfd2bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238037, "uuid": "31156f71-c06f-4376-ba0b-70928e288037", "value": "T15043F752BCD2972AC2E012BAF96E919E333073E8D2DB7217CC210B147AC654F1D63E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238037, "uuid": "170fe4e5-d50d-4b55-a89b-6811ee6371b0", "value": "1536:gHwknpzCrTKAsba1qJq5FvpBgl0M80Evrx3Mt2FhENAr0h8D:swknpziM0MwE20hW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775238037, "uuid": "ace98e12-b356-4b7e-b998-1af80c13c905", "value": 59004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775238037, "uuid": "f4a5bb7c-7f50-48b6-ab5a-d2c6eeb04dfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238037, "uuid": "13de4827-b340-445e-a6ca-3e611427d88e", "value": "yakuza.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb0e7bd-2f92-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775244139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775244139, "uuid": "791e28b6-f4b3-44ad-8482-a15f2568d400", "comment": "Malware payload (AgentTesla)", "value": "1a2d950c370853ef89deb9a673a7d07e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775244139, "uuid": "f2c47e61-7cbc-4081-81b3-243d6088902d", "comment": "Malware payload (AgentTesla)", "value": "149bf791a0d8a880ebdd777389bfa7a96570c121749aed03721d3af7d0e9aa28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775244139, "uuid": "1ee2c223-a31a-4b67-9f81-88e2c8ba0e31", "comment": "Malware payload (AgentTesla)", "value": "7530cfd78ab4458dc5d795063865fcf956d45ddb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775244139, "uuid": "8c2f1042-b89b-4a74-b0c5-c7990f8220ef", "comment": "Malware payload (AgentTesla)", "value": "235f5eda541032bf1ee6ec95272d88a608b5b1c2ffcb6daa3aca5450399482347f61c089ef666f5b4799b56806439792", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775244139, "uuid": "2e38b6a0-01f6-45a5-be4e-f6e08bcc5444", "value": "T15F45BF027381D062FFAB91334B6AF6115ABC79260123E62F13981D79FE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775244139, "uuid": "002d3ab0-23de-4abd-8c0a-c0aa00fea1c0", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775244139, "uuid": "2b243eee-1ced-43c0-8e5c-3e7887c3da1c", "value": "24576:A5EmXFtKaL4/oFe5T9yyXYfP1ijXdaEPKMkHqIkVhK:APVt/LZeJbInQRaEyMkHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775244139, "uuid": "8f8632bc-b05a-4bb2-a0e3-fb7379f6da39", "value": 1218048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775244139, "uuid": "87b4a8e7-de95-47d0-8d66-54abde0f134f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775244139, "uuid": "f8d3efcf-1208-4e8c-aa4b-6f2887ccfdf8", "value": "PO E2329-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd5b756-2f88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775239765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239765, "uuid": "3b80683a-e6be-4461-8949-45da3b83ee83", "comment": "Malware payload", "value": "bf2438c91b6d4eb09a58b81ee14bb978", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239765, "uuid": "a09bab6b-113e-4bad-ae3f-bae88447d1b3", "comment": "Malware payload", "value": "154193e63ac4a577d609d0b8ef99417d8c2fd6c62bf307d6a733f29c295322b5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239765, "uuid": "d7f87c45-9824-4bce-8d8c-2746378e101e", "comment": "Malware payload", "value": "392ff12b048b65fdacb1abdf0fd934e727de9220", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239765, "uuid": "a2ecd584-3672-445d-9a93-c415b3a4e351", "comment": "Malware payload", "value": "034754f1e26121d216c64e82d652440b737cc913d8fc6299517fa7168208e6d74eb769c3a178bb049f6eb7a4873c4475", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239765, "uuid": "644cb3ef-9928-49c9-a4f0-6be4a11c8720", "value": "T156428247B511C23AC189BE358EA7CBA807767C04DE9B11073AB6B30D1EB71D03A963E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239765, "uuid": "f1e04051-4374-436c-9dfc-b6570352f26c", "value": "192:5TBi4wXL5M8woRMwA50Pm3cBX/1Z7H+Vug8Al:5TB7scoaj0Pm3cJ/1pH+Vuwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775239765, "uuid": "473dff08-2ceb-424e-b004-8f5d5cfb20c3", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775239765, "uuid": "c9153640-89ea-4b34-931d-e465c4d7d12e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239765, "uuid": "357b86d3-6a87-473c-85f8-ab623fb7cc3c", "value": "file.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc9be02-2f8f-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775242794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242794, "uuid": "efd6ba1b-c226-47c3-87b8-f11fa11c185e", "comment": "Malware payload (SpyNote)", "value": "ac079a40d5a5097319818fadc1ac10c4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242794, "uuid": "c308bb09-e167-41f0-bacb-1bf0c908a782", "comment": "Malware payload (SpyNote)", "value": "15839ac050341de16481e5e425f5f1a791547651d4aeda398217f823f0f321f9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242794, "uuid": "998a92d3-629b-40bb-a867-1d560f2bbda1", "comment": "Malware payload (SpyNote)", "value": "533e1a03f61216e42f04134f542649ebb2ce9b3c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242794, "uuid": "6c40bfd4-6ff6-4c52-b263-cc26f8648845", "comment": "Malware payload (SpyNote)", "value": "d1b01ed01774997779c754d6addf20e4ef718ad83e4e504a9f83f792bac9d654b39b20deb549e15fbc4401c13b6d34dc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242794, "uuid": "d0082b9d-e064-45e8-a840-bf243176297d", "value": "T17E260203FB45D6C7D8AA93F66F630CA919070F15C652BAEB0465762E3E772D10DC2A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242794, "uuid": "62575f81-b82b-4020-b028-ea33f5bcec15", "value": "98304:cFy7PQROiNJvdEOF8AVBv/wtmzzzBkTz0tskM7U:FPQlzvdEapv/Hzy8LD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775242794, "uuid": "d2952909-ab01-4b4e-84e6-c13fbed854cc", "value": 4648402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775242794, "uuid": "417f8d92-6507-43f3-a0d9-82a9bb30456b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242794, "uuid": "69d325c9-32e7-42b6-a170-603a7cabfdd0", "value": "Blockchain (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df56e9e2-2fb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775259790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259790, "uuid": "76e6b355-49f6-40df-b2e4-145168e1d07d", "comment": "Malware payload", "value": "9d2286cef1d462b09013cb0f311adf32", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259790, "uuid": "2f05031b-1405-4072-a6fb-9f71cc796070", "comment": "Malware payload", "value": "15c7d386f2324dc0c0ddf58ead72f8b2c268ba994d1bd1b0b94f071c462ff4b1", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259790, "uuid": "98204053-9790-4272-b19d-bf03024d3771", "comment": "Malware payload", "value": "cf4f543702933e8802f04d27e3e34777a2390b8b", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259790, "uuid": "41563059-0bf9-463d-bf9d-f55a46381ee0", "comment": "Malware payload", "value": "06fa3596601901018382a4a70b1f90e7e4a159ab3189d7b0e5cc0e71a67a4ff0e6d96a453a61afdb716a59deca248fdf", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259790, "uuid": "aca86b48-be4b-4c4f-a43b-4485328a2dfe", "value": "T1FE17339C2E438C96C67C87FA326140713EA8D7B61859C64C2924FF52539B7385CEA9CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259790, "uuid": "d9b17b33-9436-4961-b4a4-f7425cfd2ea4", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259790, "uuid": "886cf335-e0b5-475b-aca8-de85e1827b25", "value": "393216:D3rJgZJDVI+ROaZ+qE6R+AbE+vuN79V2+ZLfwCJaiPoOw:JSlGoIk+AbE+vU/xZLfroh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775259790, "uuid": "3d5a2b93-111f-45c4-af02-2e10080f7da2", "value": 19807232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775259790, "uuid": "9894d836-5847-449d-8985-747ce0fe615d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259790, "uuid": "a422df38-57f3-496d-a4e8-a159ebbc6b05", "value": "Installer_v2312_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473b3a3c-2f5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775220021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775220021, "uuid": "c2f18b13-03f4-4a97-b5bc-a38541899e72", "comment": "Malware payload", "value": "25d13a43f8e8f2d0933389b4463e6281", "object_relation": "md5", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775220021, "uuid": "6345bd48-aa0a-4fb7-89e3-c6a55ddb5d77", "comment": "Malware payload", "value": "17ef90287357375f65849773176f5da3490080403170ccbdaa1358f3db767d15", "object_relation": "sha256", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775220021, "uuid": "4ce716d4-79f7-480a-b70d-0337ae96c15d", "comment": "Malware payload", "value": "733db824bee5aae7238a4905ee8a1635a8cc74e8", "object_relation": "sha1", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775220021, "uuid": "06d9b27c-14e4-44a2-903d-89ed19c3cf3b", "comment": "Malware payload", "value": "a559d8b93f6b4daf36c5963f1642f59261ac0064179f6b7be7312abfd088c13bb0df6943278c9c6d31e67e33dc49f1e0", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775220021, "uuid": "e96635db-0a5e-4fb4-a32e-e62fe80bb1bf", "value": "T155361853ECA550E8C0EED1358A63A613BFA17C49473573D32FA0A6201F76BE0ADB9354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775220021, "uuid": "75eff94f-bb95-4629-bebe-f7fb13fd3fb8", "value": "49152:rs92BTUzMQ9VojKVWVw0Cb+rssM2pX1itrOBnPqyCsTmboXkTcrEV5DDXxt:rsoR2maorQ0R/UTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775220021, "uuid": "66c0c5e5-3f1e-4bad-83f0-a76cea31fc5a", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775220021, "uuid": "2e197f93-a806-46df-a50a-f613329a9cdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775220021, "uuid": "9aad9118-482b-47a5-85ae-bf8dfd43aab8", "value": "RodexAgent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d9e3c7-2f88-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775239675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239675, "uuid": "9cf28a6b-62d9-42ca-9d81-adb2cd7dffa7", "comment": "Malware payload (NetSupport)", "value": "13fe7b3e9e2c726406e691b1f30310a9", "object_relation": "md5", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239675, "uuid": "a1f2c56a-66be-4904-843e-03bc0868233b", "comment": "Malware payload (NetSupport)", "value": "1815bcfa86c90d0a4d6b1bdd6d04ee38fb259d1f34a69e4b53a9771263c7d58e", "object_relation": "sha256", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239675, "uuid": "c7144ca0-d89b-474f-9069-12ac7b9e3145", "comment": "Malware payload (NetSupport)", "value": "9a502855a8fa98803c6ce86956428fcd1033ed5b", "object_relation": "sha1", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239675, "uuid": "5919d4d7-5cbb-43a5-a70c-f8d3d8d2819f", "comment": "Malware payload (NetSupport)", "value": "462395144a51da6585a129e7f3cee41ee7cc8da0e9247fb5c420a6c7c80e49a406fac48aa5bc70f6e3361a0a63c3b01e", "object_relation": "sha3-384", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239675, "uuid": "9ee66b0f-9495-46aa-bec0-3146f32e2d5e", "value": "T1B3B0125B7852869C5F0DC621631D3F212B13438593A8EAC7E9D996A02C5D42D4213C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239675, "uuid": "1694f3e1-24dd-471c-81b9-fb2dee55ac55", "value": "3:LjD0rSLqVMnlRl7bJJFISkMoVsBeLYXLzEfFOLCP1wUpVW1dqCn:L0GLqVMlRv8SkMTUoqFOL6GU7W6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775239675, "uuid": "1c7cbbf6-9ad2-47c6-aac4-9ef18c7e32a7", "value": 117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775239675, "uuid": "5d86e887-52cf-487e-80cb-34be3f8e777e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239675, "uuid": "075dd7f1-aac8-48c3-b85f-b7b1aa0c3446", "value": "jskeowgo.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2e9dbb-2f9e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775249156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249156, "uuid": "318f3fd0-c51e-4189-9246-0ffb33daa758", "comment": "Malware payload", "value": "1033376328b80ebddea337cdee483191", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249156, "uuid": "8900443d-a718-4a0c-843e-4ae8f915c6cf", "comment": "Malware payload", "value": "18f79e4032e8ad64ac4c25aed4f2e9e6e510582d45a6126b9184a307a9ca480a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249156, "uuid": "acfa1a19-e564-4c51-88ba-212f68fe7b72", "comment": "Malware payload", "value": "4aea3f09a1ac9ac05c745a747624a4f0d199c6a4", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249156, "uuid": "f79489ba-0ed4-4f02-8178-e5a6ede9662b", "comment": "Malware payload", "value": "67b7d114a8dea7ee779f7fc38a8631caa4de23afe7728981201bfae4f43475455e2d9515a2079a1a4ec695975c5fcc70", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249156, "uuid": "5571edf6-ea61-4980-b655-95e2eb123d9f", "value": "T1B2124356DD74CEC486AF76A405683C1A2495222783605D69FCCC49CC3F2933AEF693CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249156, "uuid": "58ad719f-cd00-4997-9178-5ea8c841aa5a", "value": "96:nzu5qS14mdUJjxNF8QhdV4xGXHPxEkkVtNQIG7jsBE/98VtNQIGLzcJEAxmVtNQL:zUKljhKiIc7jszcLzcBIcLzcjTWTUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775249156, "uuid": "2c303907-92ca-4e1c-9193-6da4c8ea5385", "value": 9298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775249156, "uuid": "36bbf671-595b-49fa-aa70-f32f96f4a196", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249156, "uuid": "f9f7c8ad-b0ef-40e1-87e6-49bb61184eec", "value": "Figma-project_01866251.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7833bc62-2f8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1775242866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242866, "uuid": "4bc703a3-f9bb-4150-87a6-ab1ffc0316f7", "comment": "Malware payload (Amadey)", "value": "2d2ef7c1b0cbd78cd83815107fe413fb", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242866, "uuid": "7c56cb12-d10f-4f53-a1a6-c09ef08cb942", "comment": "Malware payload (Amadey)", "value": "1962b1acb673b0019006aa41c27fd05b25c978625a0e4851632c1cd93f2840f4", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242866, "uuid": "98dceabe-d6f0-4edb-baed-e9a406d3f953", "comment": "Malware payload (Amadey)", "value": "9db79b020892ea63035c77cc9db33652993d5018", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242866, "uuid": "380eae67-6587-4080-a533-932a4a7f0158", "comment": "Malware payload (Amadey)", "value": "da684ca95e7cb9865998e9a46cb72ce794cc4e28681924486450bf13169b8374c2f3b90dc53e191e7c5134389bb2c8bc", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242866, "uuid": "3643341e-7796-4aba-9d61-b10f13425883", "value": "T1B4557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A62F13FF1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242866, "uuid": "ac4343ba-a36d-49e9-9071-a0c784fa2550", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242866, "uuid": "344b8eea-ea62-4ed7-80e5-6348ac2e7125", "value": "24576:7KR0N2OH0RkXyCksn6JCc2RCdErmQ6OtsDw+mHjBjc5:798RGyCkhh2MQ6Otuw+kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775242866, "uuid": "f89f9a71-9c1a-4f7b-b4c8-f2ab3c9e4f97", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775242866, "uuid": "042208cb-1c89-4178-9a30-f381b1d8f84a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242866, "uuid": "1e17bb74-c73c-4c1d-b1fa-5ece79b83e55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a1403b-2f64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775224206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224206, "uuid": "c9f9b9fb-0967-4abd-9a7c-6eaa15fc3077", "comment": "Malware payload", "value": "bf1b526c16589a31d09842c063bd1789", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224206, "uuid": "9718276e-2450-4a55-a8bb-74a2c33e65d2", "comment": "Malware payload", "value": "1a0aa69d37db035fb7097451b002324c811d5bf857f90b4da5853d8cfb0fdae3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224206, "uuid": "2f42f366-5c03-464e-8cfa-4784a2c26c3c", "comment": "Malware payload", "value": "effc583f85d757f6deb9df2dfb656233ad4b9417", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224206, "uuid": "78822130-96de-41b8-9930-475bfcd9e576", "comment": "Malware payload", "value": "51befc8eb9fff3a07d7bb7774a76632a4b99e2eb01957e8fadfbd4e5f19b217bad56b9624c749a58ea6a0b7cf3e1cbe4", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224206, "uuid": "b1d1b179-c060-4d71-9509-545bd4d4082a", "value": "T1C747332104B27FDCBD57D916398BE3FB995602D7FDD7014C89B36AA28CA346D20868C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224206, "uuid": "eb768be3-f75e-471a-8983-e7d2cef91a7a", "value": "786432:WXm5M7/QzHqTdC1KbeUGU9ZepHAJXBZkZo0gOBi:WXaEQz2/bes94Y/kZ1Xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775224206, "uuid": "5e12a957-d5b8-4484-b7cf-b8f11583ba8a", "value": 26923676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775224206, "uuid": "43bab488-60bd-4650-8e1b-3101d1cec716", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224206, "uuid": "baf7ac1c-1875-4f32-8ab1-e6d62a6e9f2f", "value": "Kunaria_Setup.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e333a72-2f31-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775202557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202557, "uuid": "7e7a424a-ce12-45d0-b4ca-b19f0b1830ec", "comment": "Malware payload", "value": "d2b0f1474f42fbee4a5a88221ca6dd94", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202557, "uuid": "8f8ec9d8-6993-407e-9f43-e5230a31b94f", "comment": "Malware payload", "value": "1a9ab8ac2712aaafe991ce5d3b177e42b460810dd8799535d4301498107dbfff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202557, "uuid": "168aefb1-4eb0-453a-85c5-1946b1a2c55d", "comment": "Malware payload", "value": "9c68a5b5d32982974786812e3e14dc5c6d5dc5b7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202557, "uuid": "2cb955af-4af1-4e5f-921f-d7f91abfd5f1", "comment": "Malware payload", "value": "f0e40cc2839c2773fc59e495eac6bc65f91dfdcb4591c6140c01e0c350960a124655cfbe1316c1f2ba9f536f17244ff3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202557, "uuid": "6e1d33b1-b657-4407-9557-afbcd751b5d0", "value": "T11507AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202557, "uuid": "3a2468a4-2598-4787-9add-ec795943fb77", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQw:cqYUQuVDt0TZEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202557, "uuid": "0f1da291-b609-40d1-b3c7-dadaa2f13356", "value": 17104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202557, "uuid": "418e55bd-8c3a-4eea-8e63-d2eb3b8bd3c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202557, "uuid": "a0907e63-8738-4f5f-8bf9-e8923ccd140b", "value": "1a9ab8ac2712aaafe991ce5d3b177e42b460810dd8799535d4301498107dbfff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ab04ae-2f79-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775233500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233500, "uuid": "8d29d60a-d3f6-45c9-a722-efc09b940b9e", "comment": "Malware payload (SpyNote)", "value": "ae36259c2e9198e0643d1ee95496bcdb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233500, "uuid": "8aae9b76-a4ea-42f0-b0d0-ee7ed22cc4dc", "comment": "Malware payload (SpyNote)", "value": "1aeae34c264bbfbd4eed6d92a94ac788bfb9b050a54032fde811402d63f18bf8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233500, "uuid": "304f2fd4-d214-45e0-b071-ce4637d33c2f", "comment": "Malware payload (SpyNote)", "value": "0b98a02692ce5d8b8a7024b8bccebbc45cb0baa0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233500, "uuid": "97b7616e-ed38-4405-8dee-62fe3b6a6bea", "comment": "Malware payload (SpyNote)", "value": "147aaf6d030dcad5fb9973b0af5490a8139aacee2f76e00080d6def727c0169fa9a3b8648a7af4bb059294b47c286b20", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233500, "uuid": "5f959e5b-ab3f-4718-83a6-6501088a9a38", "value": "T16B36F103FB89CA87D8AE83F26F670DE919175F14CA42A6E74444366E2E771C10ED5E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233500, "uuid": "9e18910e-7cbe-4fde-beaa-004a7e07fe65", "value": "98304:twP3fPqQYlrOp1YPK8NjIjVASsv4mzMIzBVTN0tQpkhPq/:taq/SgVYSvHzMOCskhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233500, "uuid": "23c663a1-562e-481c-bc8d-ef1fdcd50afc", "value": 5035319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233500, "uuid": "affefc39-586d-402c-883a-461e8ba41e6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233500, "uuid": "89e4c4a7-5f16-4d72-8ccd-cc501b3623d9", "value": "MYGOGOGO70.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8373717-2f9e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775249497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249497, "uuid": "138fe6b2-cab0-4c48-a32f-a9bbb4b77836", "comment": "Malware payload", "value": "2603e49f3554ee6ab8d41f35fef2bb37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249497, "uuid": "dd58e45b-5c3f-4883-ad13-90713ce85720", "comment": "Malware payload", "value": "1bfc10e53f29b9c4d41d1956f6bd2e805370014c853574e04885921d0afa6537", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249497, "uuid": "4b4e8ba4-0e4f-4777-92b9-b57e3fae59fa", "comment": "Malware payload", "value": "312b08eb20dad753e66bb9503eb7d5780de0030f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249497, "uuid": "d2ee0248-080e-47b9-9ce2-ffca328d0adc", "comment": "Malware payload", "value": "2da90cec086d329a4158504a282fda608babf0ef58ecfc4cb246e627ac1b19fce6707a2c2aac5877847074547730c1be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249497, "uuid": "54172228-d595-4542-90d3-23b09beb8a05", "value": "T12094D0BC865E1C53E42C2A3D89D536DC27BB95E00326C39F1D82B0E91FE3BD28515A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249497, "uuid": "728287f8-78ea-416c-a87c-7286c4d0f418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249497, "uuid": "4cbc9bce-fe17-4131-8d58-1f15ef67c789", "value": "12288:HH5z6U+cLMFtSe5k3CnlX8jVgcIOx+ryR:EUZMrSTEsjrtx+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775249497, "uuid": "4ac8d68b-4252-42a0-a6dc-004f68d469b1", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775249497, "uuid": "01240c1b-4d55-4f78-b60e-12533cc87387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249497, "uuid": "df8cfd6c-8466-4024-9c76-f01a55a2ee8c", "value": "7BY8G5W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef61efbb-2f54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775217726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775217726, "uuid": "a76fafbc-9573-40c9-a79b-5016a0e46372", "comment": "Malware payload", "value": "a5b4a7b5fb2b47ac32bb9aea979b608c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775217726, "uuid": "8509c540-d97f-46a8-8f1d-9972ed7d01fa", "comment": "Malware payload", "value": "1c42aa0cc6870aaf3e8d796423e00b2d0f60742674ffc3156d07957ed3dc7052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775217726, "uuid": "b96621e0-4331-4797-a278-44eed3a2f823", "comment": "Malware payload", "value": "63c8e7a9b8463d7902839f1b7cd752ca670c288d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775217726, "uuid": "a8625659-1c5e-47d8-b301-22be753c92b2", "comment": "Malware payload", "value": "abefbea2cc9abab26327419db87ffb607ce57cfb023ae44256c59cdc17e62d33843c9a1134bf9eb6d2e455ea21fc3e84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775217726, "uuid": "28b17010-45c5-4ae9-b7f4-b815382ad364", "value": "T177750244331ADF02C9A69BF40D71E3720BF66E856411D313CEE27DDBBA29B159E04A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775217726, "uuid": "358a4d27-daf2-4df3-9b6e-0415c7664f43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775217726, "uuid": "e5d573e4-0265-4e01-bcf0-8085b88a23e4", "value": "24576:qu5lDrkW+89mzXWHlah4MJEr5PZROj1RZVCTNVuc9IazYUJmzAvtBn9t9SJJSHw:qilDonsaiMgzsj1bsiazO6BX9qUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775217726, "uuid": "7ff4bf2f-e7e2-4dc4-80a1-cd4301dcb497", "value": 1559552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775217726, "uuid": "eca83b9d-a474-4ad3-b5e7-c821732185d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775217726, "uuid": "ce65e9dd-52da-4270-a9e4-ff03f086445a", "value": "SecuriteInfo.com.Trojan.PackedNET.3505.2176.29677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4bb27d-2f19-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775192219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192219, "uuid": "44c6d160-f825-480d-8c07-3d23854eb30e", "comment": "Malware payload", "value": "f028003434a20044d794a971d464016c", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192219, "uuid": "72668e95-7f37-47dd-b313-5077c80de396", "comment": "Malware payload", "value": "1d0f3505e3db852b90782ee60f0e458dc35877f6fbd77bbc2990fb4ea5e56c34", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192219, "uuid": "3bf9eacd-3d7d-4f78-a4e3-47139aa566a9", "comment": "Malware payload", "value": "11b5742d3c4191380042ab9bde14fbc4fec75a74", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192219, "uuid": "629e710c-bcf5-456d-a3d4-ac33760b012f", "comment": "Malware payload", "value": "31e6cb3d5638f3d0190955d152f17be86783ad5b50e40d94cc63e031ace9e5cf8238d2bce0c5369418dcf0b911fff603", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192219, "uuid": "fc95657f-0e2f-45b9-9282-13e76a24c4fe", "value": "T1DA66AFB436187CF3AA3F426BD6596C9C0367263387CBA9CDA17872C11653B75FE16808", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192219, "uuid": "dff3a882-6e5e-436b-8c2c-835850a02050", "value": "c1efa97e29c805072224988e66009145", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192219, "uuid": "6a4cddfc-ead9-466c-8e87-3c2ee69e7e7c", "value": "24576:8C2t77WcR7SG0EuC/VtGG0vufJIZGCtRSFQKHwW2/xM+knkTQH2I2YN7nWocMxDV:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775192219, "uuid": "36379a22-3010-4359-9868-b12a7a5170c4", "value": 6792704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775192219, "uuid": "9b61c443-642b-4587-97c1-85fa4dd7a1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192219, "uuid": "e2f0832b-fcf2-4c9b-870e-6ff7e9104035", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9df287f-2f8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775240802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775240802, "uuid": "7599b05e-432f-4508-a003-0ec073b7d598", "comment": "Malware payload", "value": "03ca0221a1d7e49b72692ba12405216d", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775240802, "uuid": "a11bca66-c908-4838-9942-44c9d9db49be", "comment": "Malware payload", "value": "1daade171b2f029c80787880db2ce893e5f1252facb6980fb7a93cb0dbb014c3", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775240802, "uuid": "e54850a3-921c-43d2-8c34-a3725825d555", "comment": "Malware payload", "value": "fc79e523d97e4a8b46488e0cfd9c42e8d6012295", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775240802, "uuid": "0ccb021f-b464-40ed-ad60-6feba1908e9c", "comment": "Malware payload", "value": "e54b2d241ea931d5728f37d528f3ef2a4447cc7d2de70059d84b9b9da6ad35f4a849e26ceca9554d3fc724b3de98755f", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775240802, "uuid": "65963601-732e-4beb-9b3c-6aa43bcb177e", "value": "T1047423DB646B24E28C4C9B3A8E8377EE5B7ED51271178F96BC0586D570C0F0AC89D09E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775240802, "uuid": "29296cad-80de-4774-8234-c3e97e63ffcf", "value": "6144:zbfDEHKg9fI/edstmHANR63DbkcCcOjKNtciQl6q6QS3f2lT61ZlmP63:zTDEHKgSqqaUecHln6Q4f2tPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775240802, "uuid": "4c9379bb-bd64-49bc-94cf-bda35403bb18", "value": 361402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775240802, "uuid": "1139d123-c86c-4a6c-8d30-5d0a9a1c0a3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775240802, "uuid": "ac7c7461-2498-433b-a591-4447ef6ff4ef", "value": "1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdd96b6-2fb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775259757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259757, "uuid": "0204fba6-2cb2-4834-ad6a-2e8a2dc3d699", "comment": "Malware payload", "value": "99d7fc77a557a5a082a86e6dde12eecb", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259757, "uuid": "624d3a76-0a0a-46f5-a3da-ed815c129cd5", "comment": "Malware payload", "value": "201cf8213fddeeb683d886fd79172325fb43d5879f46b974595e15481bf0b5d1", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259757, "uuid": "de0fc731-90c8-4ea9-97ac-410f68fea5fb", "comment": "Malware payload", "value": "96e9fb31c8e9e7e2b63a3ed9d60f0338a5084e47", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259757, "uuid": "896c899d-b372-4db2-b7dc-0cb656e910fd", "comment": "Malware payload", "value": "175f9be58dfb764fd16c92d557b7fc11de89bfd6e8ed62ffd1ccc3b96b9ed8d0c36dc1e8db783ede111235915e324bc1", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259757, "uuid": "19d17079-657f-45be-a97b-868f2d7d3465", "value": "T16C17339C2E438C96C67C87FA326140713EA8D7B61869C64C2928FF52535B7385CE69CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259757, "uuid": "9bbb38d5-d072-4d04-b3a2-7d8d00d035aa", "value": "393216:03rJgZJDVI+ROaZ+qE6R+AbE+vuN79V2+ZLfwCJaiPoOw:gSlGoIk+AbE+vU/xZLfroh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775259757, "uuid": "6ba64145-6414-4ed0-8b20-e3c2336ca3d3", "value": 19861504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775259757, "uuid": "675e5566-d320-4cb9-8198-7dfe735d7c3b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259757, "uuid": "1c340623-8334-4d0a-90b4-e8738dc92235", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ee1d4f-2f31-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1775202562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202562, "uuid": "15225099-189e-49bb-990b-8b441e90190c", "comment": "Malware payload (Prometei)", "value": "891c6aa80194108ed3861a7de3bf1640", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202562, "uuid": "447e7689-7884-46ff-a4fb-3dabb39af865", "comment": "Malware payload (Prometei)", "value": "207a7e0a93ff730c9618409f15f75280299b3020b92bfc4fb6ee8c73476c3f92", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202562, "uuid": "271c0d93-d991-48f0-8e58-eef3fe1e0c9a", "comment": "Malware payload (Prometei)", "value": "9bbaf1553d83e42eeac749bde1abd1379012c02c", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202562, "uuid": "6d726cb3-ff67-4d5c-af7a-8765124817da", "comment": "Malware payload (Prometei)", "value": "4b4929ebbc9d400980606f65ea04c1d1099b1f70c9f96b01a635b410598f64fb072fc7e77640a6ee6b6ce22fd528b95e", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202562, "uuid": "51e9e715-3b39-4923-83cb-76bf0c77c5c3", "value": "T10DA423B4F9219E9F6DD769B91B24831DE181C172589D4C2313AE94E34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202562, "uuid": "5ea2d5aa-2386-46cb-92af-2d26dd9e4988", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdH:Fs6pyCC/Ya2hpi6T6N4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202562, "uuid": "9015b269-66b0-45b6-8857-4900a4cc8521", "value": 449062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202562, "uuid": "56afd2fa-c572-455f-af72-6e9da310b1b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202562, "uuid": "95100f9b-e957-45ef-8788-05e06fca53e2", "value": "207a7e0a93ff730c9618409f15f75280299b3020b92bfc4fb6ee8c73476c3f92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a75550-2fb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775260597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260597, "uuid": "290220ac-41ea-42ab-af7c-714917e1afc5", "comment": "Malware payload", "value": "e397f2bccf30525c0cd4a2e6dbe05d89", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260597, "uuid": "efbce139-12c9-4253-a922-ab1aa2522cc3", "comment": "Malware payload", "value": "213f626b6f80d6401bef391a80d092a67916bcfd4013c48695333bfe3f775152", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260597, "uuid": "6d29f6f1-c06e-4907-ab6e-b0b299e1cb9a", "comment": "Malware payload", "value": "ad210e45beca8901554c5686c4ef079c9d147e04", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260597, "uuid": "3967c4ee-f740-44a5-bee7-080cc94b8e01", "comment": "Malware payload", "value": "02c4622d6b57122bbf7894e3cddb3164c9cbc89df3758240835397106a37473c36e00ec377ae6d07a9d35144219ace8c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260597, "uuid": "6bb3d7c0-39c5-4880-9016-ec99e8a8fa05", "value": "T14E07D022FB8290A0ECEE117552F99BBB1D3A9E20572194D3D36138F48D326D3663E35D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260597, "uuid": "1ca0372d-2f3e-429f-adee-2d3d42d98285", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260597, "uuid": "f8646302-a9c2-4f6e-9c68-4b0b576e6d79", "value": "393216:BAE4Qij9qs8OWq8PrneNCaQ+o6SVP1CPwDvt3uFrCdP2NOUAIP:eLQijB8TeCae6BP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775260597, "uuid": "bb77a35b-2fda-49f2-9df7-f3a27332224b", "value": 18419288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775260597, "uuid": "7a5cc24a-e962-40f9-a382-d774450aa2b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260597, "uuid": "2ecf2f70-5f28-4a86-9c29-1b64da99917c", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b938cb05-2f8a-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775240828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775240828, "uuid": "34afe918-10e9-4a17-a5ee-bf0c280ef29d", "comment": "Malware payload (SpyNote)", "value": "d171746bb85223a4da5fad0dc9d3155a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775240828, "uuid": "50cfbd6a-4744-4da3-92b3-6905f5d7195d", "comment": "Malware payload (SpyNote)", "value": "21b6b9c7262fe39d2f2ce49115c9c22f50d3e5b0b083a0f8c1ddd776c369ffd3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775240828, "uuid": "1a6d37f4-c771-4256-9fdc-d28918fd695b", "comment": "Malware payload (SpyNote)", "value": "e1078c9590c60e9c02d0c6b00644a684487ec011", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775240828, "uuid": "685ea270-6f42-42ce-8ea2-530f95888c4d", "comment": "Malware payload (SpyNote)", "value": "a7328296fc3c7d15eb5358019f47178ba102bcc767a28b25e6a5509aa32d16bd6b3a53360a3bb31df9f60b4009676268", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775240828, "uuid": "da7f4569-eb5c-409e-8e4d-685b1d9b32e4", "value": "T179460203EB49DA8BD4EA83F1AF670D995A570F54C742B6E744503A2E3DB72C10EC5A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775240828, "uuid": "19afa5cc-e9e2-40a5-a006-1c38a2339142", "value": "98304:s570WNbYpWg4xbERCCwAJwEfmzMzBKTf0tQPi51cBFoSlwMB:OYCQWgIERpJwEOzJQgi/cBa8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775240828, "uuid": "57cd653d-24ea-4400-827a-eaf91e6ba7c5", "value": 5357019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775240828, "uuid": "545fee1d-f6e3-4305-887b-0d848508288a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775240828, "uuid": "4392c1b6-fb58-4264-8e24-ea56c0d9c078", "value": "MY COCOG 500.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d8dc88-2f8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775242866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242866, "uuid": "78cddf6d-c01e-4d31-a8b5-4fbdfec6c8c1", "comment": "Malware payload", "value": "0afa34d149cb19f886752177e74f3510", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242866, "uuid": "cbb1e2ee-eee1-4e90-8b10-f1830db40729", "comment": "Malware payload", "value": "22af12cb639b2fd1e3c0fff93230c98fe07b519eabcd4d902d09458e71bbefec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242866, "uuid": "062481f4-a417-4602-a537-725999b0bbb6", "comment": "Malware payload", "value": "ec1f3da44028537b6ed72b3fe2f9981a4f65a301", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242866, "uuid": "e022abad-b8fd-4342-8e8d-ddd683282d84", "comment": "Malware payload", "value": "facedc3172f3ec421746d219344caf99786e3b04c32a066cf08ac87da4d42fb168d6cbb1aa77c6eae222ebaaa6c622c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242866, "uuid": "56ef6aee-e9fc-47df-b4d2-6c7b04c8475b", "value": "T11AF733E382F04059FA10EDFB53508C759F59066514E215FC82BE986972FA80A63ECF6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242866, "uuid": "96c5b29a-f83f-4f7d-8aef-f6edbd84c8cc", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242866, "uuid": "860219f5-69ec-4a8a-91bb-76ed71abe953", "value": "1572864:qejOYfzLAFnfUGBV/PBk1fyjJ5Y69AFgMp0C649n7SWovZAa7:q47mHHS1c5Yf1/jhSW8j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775242866, "uuid": "393a3265-7ac4-4952-8b11-70c07fb84c2a", "value": 72009616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775242866, "uuid": "a9f31be9-e778-40f0-afb8-25e2ac01ad7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242866, "uuid": "827e00ec-984a-44d7-ad22-292dc61d146b", "value": "MyBuild (8).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214921c5-2f9c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775248304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248304, "uuid": "4254f0f7-5933-4346-ab73-18de22e479a1", "comment": "Malware payload (Mirai)", "value": "ccf0043a62ef0083d8c6beaf4fe1df90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248304, "uuid": "e9e51a9f-c2a1-481b-a082-6ee4b6a3a64c", "comment": "Malware payload (Mirai)", "value": "253ee9fe2fbbd0447a186724de9a352c229872e3e46fd61197c322bc7c9878aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248304, "uuid": "de8aa973-0eac-42c4-b976-7cb51944563f", "comment": "Malware payload (Mirai)", "value": "d512fe3ab7089d86b8fc86c5b23d19cc40d7d627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248304, "uuid": "8d89b6a6-8814-4af4-95cb-ba3bd02ac917", "comment": "Malware payload (Mirai)", "value": "57301496886e2be6f074935456e79f338798dc6ad5ba8cee763a6b07f8be00d9dbb1b9b5e7e8e59cb3d9bfb07ae24108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248304, "uuid": "2ff57e41-19a8-4c55-9e70-7a97c599e207", "value": "T172C3F80AAF210EFBDC6FDD3706A90B0525CC941722A97B7A7534D82CB64F64B1AD3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248304, "uuid": "61d941bd-fb85-4eed-a10e-5681876c969c", "value": "1536:cSCzU1S5+m54kQKr3rHRjGKWr+N/ObxUWzxZbTPT3/Cf5LruOg2w:cSCzU1FpkOWO9zx1g3g3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775248304, "uuid": "9ca19033-2e88-47bf-8874-bd83c4a807f7", "value": 128284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775248304, "uuid": "348aa97c-2c85-4f8a-b9a7-c908e48def8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248304, "uuid": "d84a4418-b6f9-4c59-bc4f-d6374360d844", "value": "dipndotsk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ab6c2f-2f59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775219646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775219646, "uuid": "9461573a-781c-4910-b2ce-fb1fdd2bfad3", "comment": "Malware payload", "value": "3882d45b4c8e29224f72538b6cf9b1ac", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775219646, "uuid": "35540257-93b4-4ff7-9276-333624e71afd", "comment": "Malware payload", "value": "255ad359962cccd9b48e81c5ea98bb71e2f212ec175b731a2625314bcce7711c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775219646, "uuid": "12374374-11fb-46b4-8518-8ed43aa06b30", "comment": "Malware payload", "value": "e63a5340fdb7786665c41e5bd4fecef1a7fd01c0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775219646, "uuid": "9732240e-0bda-4368-879c-121ee41a2d68", "comment": "Malware payload", "value": "a39d71bed5bb3afbdd926bbfa27026074f48ba4b857a8a5868e25336444a4ad6a6f1f6b9f2631d08811b185d1b634e36", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775219646, "uuid": "1c168b6f-4191-403b-bb1c-e364d62daec8", "value": "T12CE31281EF208820F022E0FF2655F97021419B5379CEF15D9EC69B57E639BA64181B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775219646, "uuid": "e78d8f3b-48e2-4603-9c79-512ebef3a72a", "value": "3072:SzsubtgwVr4QjZ9/zg4NxoKDYDYUWWVke86iOVpY//Xzqrt3riH:wsotgGF/M4NhYDxVhiOVpYnyNriH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775219646, "uuid": "7e1e2978-147b-4b51-a6b1-e9a7219370d1", "value": 148539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775219646, "uuid": "ab7ee03e-0f7f-4bff-834d-2a57c3e2ffcb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775219646, "uuid": "783a41bc-db1a-45aa-be16-4cca1e1cf382", "value": "Krypton-2.1.2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff8cc72-2f71-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775230156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230156, "uuid": "1878cc36-7d84-4c8f-ac0e-d29972fa3b88", "comment": "Malware payload", "value": "c3031b317c4d639a6b750d112830e01d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230156, "uuid": "f6d6ec3f-ec12-4c60-a115-565173e9e6a2", "comment": "Malware payload", "value": "25adf9ffbf6b0a1b8fe6fd2df6d091db286449529d3104d43c36e32e41fc55a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230156, "uuid": "cbf7d60f-2440-484c-94ba-c6a991a25821", "comment": "Malware payload", "value": "75c463fb2c44dcf8bed989755f5f45d23e4825e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230156, "uuid": "521b6a8c-c4c2-4657-bb22-6803534047ad", "comment": "Malware payload", "value": "7a41a4e561f14ee7131cca0d767ecea7e73f6f7de298fa96b926d064124e503753100857c0f623a248cc09b8ea9a0029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230156, "uuid": "119923fb-5da0-4b7d-bc92-fb64570f6661", "value": "T136F47D57EA8011E8C079C17E8B529727E7B1BC0616A0F65F2BD05B161F33B58AF2EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230156, "uuid": "a00bafaf-2a77-4091-83d0-02ad7e1a1411", "value": "67fce0b72ecd026f47fce47bed0d9515", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230156, "uuid": "5f524ccf-db53-4cee-a26a-8a78a2e9aa86", "value": "12288:PV6naIDKGXG1+cPrl92Yhtsj/tj08Cb3eQFaBrPdMafgNcrCxfM5o07bop:onHGGXG1zTHfhSjrCjtarLoNDE5omM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775230156, "uuid": "43eefcc5-a831-4b4c-a2f7-f00a2e3a2601", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775230156, "uuid": "e8475d50-2ab9-4589-9f8f-ee4994e53dc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230156, "uuid": "deeb6881-74c9-43a8-99e3-9e507685f6f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3212b0d-2f6e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775228819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775228819, "uuid": "87dfa76d-3eae-4039-a00c-7dfb5967ec67", "comment": "Malware payload", "value": "a0e6b77d312bc3ba938f92c93f7516e4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775228819, "uuid": "0afef81c-6c98-4818-a020-527bc5cbe562", "comment": "Malware payload", "value": "2b71cc2d38c47f9bad917201b6e510eb5658bf9ec6836d780662559d54f97432", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775228819, "uuid": "d50731af-793b-4959-9890-87fe4e1c2d02", "comment": "Malware payload", "value": "fea488bfe1cb5a2dca763625e6ce373013d45112", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775228819, "uuid": "84d2cb4c-5824-49a0-b294-26525a700363", "comment": "Malware payload", "value": "2619a579c98731ff4104e8458fe8db23ac0e6f6af48dcd4c40ad6b9d5c1027dc6600a366aed0b18ccf174a29a105dc0b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775228819, "uuid": "5b187c17-62e5-480b-ba74-c5e9c5ac0c95", "value": "T162F544124BC317AE20E65724DBCF241530D2BEBF2DBD71166F9E770966B058E8248DA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775228819, "uuid": "6d92d1e9-3930-40d7-91b0-f96a51321293", "value": "3072:no5mgzB+MNd7YKRZW5lRGRUb84d90pP691tbkDcJlQsLS2c286p+Balzc5lw/5v5:nou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775228819, "uuid": "69374660-ccd3-4f3a-8c92-9fa25c5af5b6", "value": 3592685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775228819, "uuid": "fa9adf9d-a580-4e31-abc6-f32791b5b9ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775228819, "uuid": "c231aa74-5bf4-49e6-b9f8-eb35864703aa", "value": "Dental_CT_Scan_Consultation.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e1a6a8-2f80-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775236524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775236524, "uuid": "45d4b3d1-f29a-4dd7-a6bc-54cc5efcdd0f", "comment": "Malware payload (LummaStealer)", "value": "52d8d3ce2f1fb01e0a9b83e487be7dae", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775236524, "uuid": "285c9401-8965-4f0b-8c28-6f8eebeb3d17", "comment": "Malware payload (LummaStealer)", "value": "2cb1969ccab20338ba96687a793a6371bf27ea16cb14da93c9ed5717a9184cfb", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775236524, "uuid": "610426eb-ffb8-4a25-8788-dcc72747aa25", "comment": "Malware payload (LummaStealer)", "value": "b1cd1f4d82d0448f84f7123795712803c825c77a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775236524, "uuid": "991d4a5a-d6ce-44a2-838b-e15c5b4f005b", "comment": "Malware payload (LummaStealer)", "value": "7f51526c66d7f368037524473abae0ada182b1c80f11b1a1c0f4e84455ccf6ce9ff77228299afa4b0b941d79010a6208", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775236524, "uuid": "86b84097-c49b-4690-a8c5-daaa38454c6a", "value": "T1B9957C01FDD744F6E416173295B7A2AF2339A8090F32AAC3EA41767DFAB76D50832345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775236524, "uuid": "b49ac7a3-69ca-4f46-a63f-a5ea9237f244", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775236524, "uuid": "7a8ed99e-2725-4dbe-bdd6-5a83daea7afb", "value": "24576:tp4lmTeBEQvLs+puffFN6EuF0uPzw6A7ibd/kEBxb5yFDR+pN538A2vJUmYsSAfN:tI7IHF+Vs667+7d8/Jr7dMifuBqw0E2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775236524, "uuid": "6a6b51b7-eb2d-458f-a1ea-e51ddc201f04", "value": 1965200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775236524, "uuid": "2b79a9d7-72fe-49b9-8fee-998754222c72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775236524, "uuid": "8f99fbb4-90eb-489e-9d39-3542bc2e5641", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4122c32f-2ef4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775176202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176202, "uuid": "430fb51d-27db-4e07-b277-aaa1c4b5940d", "comment": "Malware payload (Mirai)", "value": "c1ab9286df653d335565d8fcd4b60d64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176202, "uuid": "6926edb5-241b-4af1-95d9-d33b931b50e1", "comment": "Malware payload (Mirai)", "value": "2db76251333918e6bc5d8960aad6e2a2f7b8a01abaea32350c58530d3a818a8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176202, "uuid": "2a833f1d-e211-475f-b0f8-93f9dde7d58b", "comment": "Malware payload (Mirai)", "value": "aacacc944d888935a220c5d1a0b2543adae600d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176202, "uuid": "45ca179d-c122-43e6-bedf-87700f088921", "comment": "Malware payload (Mirai)", "value": "fb2510ffdb93380195598e433e8623efc308dc4adaa947824f68f61ac631e7bdf2c2439e6a53bb751f06939e51ed33be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775176202, "uuid": "697b5654-7f5b-4e3d-8383-7711cda6a4df", "value": "T13E242A45EA418B13C0D627B9FB9F43453333AB64D7EB63069528AFB43B8679A4F63101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775176202, "uuid": "c7e0370a-962f-4668-abbe-5cb7b0c988f5", "value": "6144:XUdbYN5dO0fSM5aE0yEqt4KzJAHd/yAz/TzM/Rsnq4n+vH5V:XrfSM5aE0vqt4KFQ1yYTo/ZFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775176202, "uuid": "0f83a2c2-236d-44a3-96c3-a4f7a1936f71", "value": 213000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775176202, "uuid": "d72c1cda-2e3e-4797-b69d-63496db1a816", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775176202, "uuid": "c7559954-e3cc-4553-896a-49c7b39057f7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bade4e-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775237982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237982, "uuid": "e5b14462-731f-4856-b948-0d809cdd48e2", "comment": "Malware payload (Mirai)", "value": "e3c9156107b8aef3beab24b4b0c1c067", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237982, "uuid": "e6426e02-8aed-4bb2-a47a-71e4f5c3867e", "comment": "Malware payload (Mirai)", "value": "2f23d74eafdb3a2d175d93c793a82fb837ab3319317658bd7681b723c082a2b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237982, "uuid": "e278a750-52ae-48f8-8cef-c6816a08f59f", "comment": "Malware payload (Mirai)", "value": "cb80ca9e7b868e4bf91fbb5d0583550e1c1fd111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237982, "uuid": "9607d9a0-e961-407f-8af0-7aefd2f52f8b", "comment": "Malware payload (Mirai)", "value": "b736a923f44e011bd4b25e6017aed17da997cd5648ee4a9ec3f3bcfd01431bb3f3593a91a0587d1aec4cbdf1a625a1f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237982, "uuid": "5e4a9de4-7388-4994-a234-9cb387fbcb5e", "value": "T1BFC2D03A878905B299D40A32D8F6824585132ABC597B30BF27100BBEBBD10DD72FD55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237982, "uuid": "da804531-47cf-4a7f-bf71-5b4c11620f52", "value": "384:7c0uLKnLnUCBKBkomFv/UAEEz6BDXEW2q8mEN5IZXP3WEnyNQUQdNRpymdGU5EUC:q4nN8BI/RVu32q8pNufWpIHy3Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237982, "uuid": "6c95afb2-1f53-4898-bd10-0cc1887bad8e", "value": 26056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237982, "uuid": "83c5c7be-0348-4282-91a2-34ebafb5ba0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237982, "uuid": "a82e743d-ec92-48f3-a261-c44e118c582e", "value": "yakuza.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c2a657-2f8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775242882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242882, "uuid": "cc816339-18d5-4d84-9b0b-f74a31bb8fc2", "comment": "Malware payload", "value": "1e6ddc5cd77af7641f14f9f49895683e", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242882, "uuid": "8e7a825d-4e60-47e4-98c5-d57a9e6f561b", "comment": "Malware payload", "value": "2f77b32d357ee32396ed1724ed88c5c5f9fd8db8cedbd1b07a1bb1d58989862a", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242882, "uuid": "51043f3f-379a-440e-b70f-8794b13d512a", "comment": "Malware payload", "value": "f507837db6e4761942db35e7506b7075ebafedab", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242882, "uuid": "f1c9e9e2-098b-45ea-a74c-a8119a0bd185", "comment": "Malware payload", "value": "07bc99210ade6195b9db2cdf4f72dcebe62fcc2094ce3f10dec2ab86ab14254366088a0f86db3ba427c8e23549974b79", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242882, "uuid": "307ee62c-90e1-4088-98a9-5a29b828f45e", "value": "T133544C4933A450F4E8679239C9A78A46F7B2B855477063CF136443BA6F277E09E3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242882, "uuid": "a7d610fb-316f-4098-8789-5db135639f4f", "value": "a39382452de1c86f6b14ac15806d4523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242882, "uuid": "02a45010-9309-4e3c-b8d5-84994c532925", "value": "6144:y20XlTwP4g6gim5vGr/bQNnQaT3+21OqIB+PSr/7:y20trQH1KB+Oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775242882, "uuid": "c282530e-a633-45db-bc43-4402a570ef06", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775242882, "uuid": "007c4f3d-4cb3-4cdb-84c4-bcee3b628424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242882, "uuid": "f374d849-ffd2-4990-823e-e98f0a5029ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b2aee0-2f78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775233152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233152, "uuid": "c3abe1ff-b759-4b88-a0f9-0ec6b8426e26", "comment": "Malware payload", "value": "5a1fc986e72f41d1e07c21e1e66f9fdf", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "tinyfilemanager", "colour": "#7A418B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233152, "uuid": "ae6705e0-b9e2-4bc0-8bde-c31e9eadbf71", "comment": "Malware payload", "value": "331b762517f3b2f1a5b91feeca08f7ced6c805c85daa205b141ccea7cda3f689", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "tinyfilemanager", "colour": "#7A418B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233152, "uuid": "6324aa4c-f330-45a5-9b66-7104c8c8a8e0", "comment": "Malware payload", "value": "18a3629c1105a0dbb15ede7338ae9c1f1ea2d6fa", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "tinyfilemanager", "colour": "#7A418B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233152, "uuid": "ddc7512f-ad78-4758-a597-37c6138ac03b", "comment": "Malware payload", "value": "010f1749ceb8b096be0c2a8582f7284e537c6e3cf08527f50a72367b93ac06fb3787da01ae5471e5e72d044d1067e2f9", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "tinyfilemanager", "colour": "#7A418B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233152, "uuid": "165d2bc5-3bd7-4d34-abbb-261fad0f63fc", "value": "T11E042916F6F8257B4217B4E81E97544C3AAE803BC2061D1EBD8E52D81FC486DC4BBF69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233152, "uuid": "2012000e-d6ae-40f0-af53-a29f612dc5af", "value": "3072:NZTZCs2XULSPv68XsGPKBTUIvr38PUYkA1uOFmS8ovnDUPDEr+Fqu5JVPNdhb+A:pCPeLSsSuAQ38PUYkA1ummevwP51hb+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233152, "uuid": "e13dde37-d35e-47b9-aecc-f46b2b421a83", "value": 185495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233152, "uuid": "a8b69671-c483-4b39-a3f8-4d963e68e9e9", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233152, "uuid": "cfc69af1-a71c-4ac1-957a-3b334d59db40", "value": "tinyfilemanager-v2.4.1.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da01ef8b-2f1a-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775192779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192779, "uuid": "51866b81-c072-4593-906d-8f22438c3bf8", "comment": "Malware payload (LummaStealer)", "value": "49c74b302bfa32e45b7c1c5780dd0976", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192779, "uuid": "df05031b-1d35-4a17-8fd6-456e9060b4fd", "comment": "Malware payload (LummaStealer)", "value": "33d2ede41373ccb57c46aa7f608f7b8610cff511500eaa80c24427a1de11bcb0", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192779, "uuid": "2f377d4f-4404-4b29-8b25-7a5534d48e74", "comment": "Malware payload (LummaStealer)", "value": "0ac40a9e4bb3a1a26208855297da0110b2bb5f30", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192779, "uuid": "1b3895d1-691b-482d-bbfb-105463d50c86", "comment": "Malware payload (LummaStealer)", "value": "b89947f9dcd743122c0c9cad94a35a5c7c0f3c21e6387f01590b61e25049d52ec20062320cda4481896c35bd4b326733", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192779, "uuid": "fef5171b-35da-4a36-a0ba-5c14617f0668", "value": "T15A95330EF1162B9BEE3E90B7C69150C550D0F13A90D01FEE8322ED979C99CE5467E7A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192779, "uuid": "414f3926-5ea7-403b-a28f-ffe09195df2d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192779, "uuid": "ca1b2b90-456f-4dc1-8870-3a0fef135a2d", "value": "49152:ZldVWSEAhsJGThsgl+wJpYqIajNPXcisBm/cSo:ZldV/EAssTWCJECNXcisBcFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775192779, "uuid": "3a73707d-4dba-45e4-bc54-5bfed599b7b6", "value": 1915904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775192779, "uuid": "2cc66a4e-c319-4b56-97a6-c98a2269cec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192779, "uuid": "b3743bff-d1b2-40f0-9371-7af6a4590b44", "value": "33d2ede41373ccb57c46aa7f608f7b8610cff511500eaa80c24427a1de11bcb0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d4067e-2f31-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1775202575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202575, "uuid": "8126627a-c78f-4806-850c-e26372d61f22", "comment": "Malware payload (Prometei)", "value": "7f7531054070e3489427da51576eeb62", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202575, "uuid": "f858dfdd-84de-45a7-946f-b5438dee22a8", "comment": "Malware payload (Prometei)", "value": "34e9982ee33cd630b7a9dd4070225ced552dff25e6284233c65aa4e6d6c51186", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202575, "uuid": "d3c070d8-c0f8-4735-85b9-ca49e29c0067", "comment": "Malware payload (Prometei)", "value": "2ac48e6e9a319e5ef1c1070407b58babd71c0d55", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202575, "uuid": "8b617e3f-26a9-4e55-9c2c-23f70cd7530c", "comment": "Malware payload (Prometei)", "value": "cb71b9085a3339f13cb2321c5f4b34f62997edc3a42265f8dbf94fcd814b2320cc90fd593401e1091b7f8293d9079dbd", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202575, "uuid": "082a5b90-3ba0-468b-8bae-97947841c973", "value": "T11E85336A851BC8D1C949BB1E2B3D3D66B51A883281FE11216DDDC1DC09BF9EF831268D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202575, "uuid": "61202755-a620-47c0-b5bb-49aea069b6fc", "value": "49152:IRApOJTiHHEFBn5oiHqQK9XAD5VWsTgstvRf8h+YstL5r0w:IqSTiHkFJ5oiHqLCtQYgevRf8h+TtLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202575, "uuid": "b01f62a2-9489-43c5-a753-2613f11c487d", "value": 1773400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202575, "uuid": "6770bd58-d297-4706-b479-c0886982f80b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202575, "uuid": "45af658e-ee69-43f5-afd7-8addb55dfde5", "value": "34e9982ee33cd630b7a9dd4070225ced552dff25e6284233c65aa4e6d6c51186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1134d67c-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775237969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237969, "uuid": "bda766b1-d0df-45e5-89b7-c8719a8e731d", "comment": "Malware payload (Mirai)", "value": "0b75bf6967049fce73c54cb22d319f34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237969, "uuid": "6e2a0a68-a63a-4568-a733-6a3c022b3355", "comment": "Malware payload (Mirai)", "value": "3676fcf94cc76987f4e5cd06e78efd9e7556faae301318c76823a3e5495b2be1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237969, "uuid": "31d9660b-31eb-45b1-9d6e-52f615310835", "comment": "Malware payload (Mirai)", "value": "81406176c32cd19dd0cdbc04d444248d3846387c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237969, "uuid": "ba494b93-3cf8-46f5-82de-faed732ecfbf", "comment": "Malware payload (Mirai)", "value": "7ea818d2bcc773bb884e577b2f3465b5b6920b00bc1c674bb4c567876d41c35c7fc8d9c888c5ad900d88549c7575818c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237969, "uuid": "1e81d9ee-6210-4f5c-b735-8db1297bb5dc", "value": "T16CE33C46EB818F13C0D6177ABAEF42493322A7D5D3DB730699246FB43F8269E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237969, "uuid": "96667b0f-f5ce-4d7b-bfe4-d2b3e8af16f4", "value": "3072:DNzpkK1r17/CnvVMq8+WsueU/RIJRwedsuc3zNQFM/90TL1Q:DNzpkK1r17/CnveqoeU/RIJae9c3zIMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237969, "uuid": "cdc78798-cd5f-4dcb-b390-d226d06d2948", "value": 146734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237969, "uuid": "2cd68fd2-8597-4a22-9829-e05a69a4e307", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237969, "uuid": "c26edf1f-7b70-4338-9f3c-12772109f0ca", "value": "yakuza.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c764ce8a-2f71-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775230114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230114, "uuid": "76e679c1-392d-482f-8f1a-7731565e0924", "comment": "Malware payload", "value": "3a0c7d6b576be0c0b130479f1be04efc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230114, "uuid": "c648845c-5d17-4c9d-84bf-e8eb5aa19b91", "comment": "Malware payload", "value": "36cfccc84b21d9bb8b3eb93589870aea0b146fd9ba649b785d44bb8dafd82656", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230114, "uuid": "7a209c22-e605-4d0f-a715-392707d5766e", "comment": "Malware payload", "value": "51dc22a7f1896df9d5dd8c7de52e5b481ffb26b5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230114, "uuid": "13b3994c-cfaa-4c89-889b-10a079abd777", "comment": "Malware payload", "value": "8a5bd58fede012f4d0115944a1ff77f813a2a50e94e5e98ec06ea1e04e86ff4c69f01e1f20f9d75105c90ca3ecd5ab03", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230114, "uuid": "b6a4a448-0100-4abf-af77-0e5276b8e89a", "value": "T165642341BC98353BD5234EB3AC0FDADF5D7D3AE42E79D4699620F81AE1AD41EAC70900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230114, "uuid": "cb26d0f7-8508-4ecb-99c3-81b8804be13d", "value": "c72d40c71bcbf3442320a9ed25ba079c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230114, "uuid": "41ff19c9-6a3d-4007-941d-cd0100562fa4", "value": "6144:M+R1G8O0NiIPoLt21g1Mauj/zlcQAcDLjoiOlDcXPcIZf1:M+R1VOkRPgtb1yTzlcQfXjof5acKf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775230114, "uuid": "e76768a3-b7aa-4750-a038-ce932355d378", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775230114, "uuid": "daa3d1a7-0ebf-4ecb-bdb4-a1e4af9db008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230114, "uuid": "ca8e164e-9918-49b7-bc9e-cb826411c0b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd92d3b-2f8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775242928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242928, "uuid": "8fe42696-49a5-4495-8f19-8dd72e81eb01", "comment": "Malware payload", "value": "47839a98804468a9da7a58d5099082dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242928, "uuid": "3d575d9d-5b59-4c59-acd1-0cf65dc48eb0", "comment": "Malware payload", "value": "392fd5c341138983db810342dd1395fa0b079f956d4d41a3e266967fa4768e42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242928, "uuid": "cf00b5a1-a17f-4fbd-a754-33665f59a949", "comment": "Malware payload", "value": "2134dbab8c7c561a4f198db3aff97cf6c56d6d86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242928, "uuid": "52ce13af-17ba-4021-92f3-a89267e84c8d", "comment": "Malware payload", "value": "fe2c861a88ad5bd5f766fa42cace7eded7e6bc0bd14baa7ab0cd8b94f16c16b998d453947e98fb0b6e2a952d2598c404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242928, "uuid": "1a6f104c-c240-480e-93c9-9c7f3c56ab2f", "value": "T1A3F733E3C2F0805EF940DDBF63508C749F55061515E621FC42BEA1A9B1BA90A63ACF9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242928, "uuid": "93fb948f-6ddb-4e9d-86fc-746b1ef671a9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242928, "uuid": "78298a01-30ec-4d52-9ca5-956a171ce7c5", "value": "1572864:JejOYfbuYlfUGBV/PBk1fyjJ5Y69AFgMp0C649n7SWovZAi7:J4jVHHS1c5Yf1/jhSW8t7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775242928, "uuid": "6c2e4b38-2873-4445-a93a-e4fe47dc4dd6", "value": 72008116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775242928, "uuid": "b2564612-3c9a-4c9a-a0a4-20d8e00ce52c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242928, "uuid": "7ec09046-fe2b-4ff0-83f0-47f13a3453fe", "value": "MyBuild (12).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e919538-2f32-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775202907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202907, "uuid": "995b7dd3-ef03-49a0-a18c-47c53542f185", "comment": "Malware payload (ValleyRAT)", "value": "33290842f274706d660bb42ef88944ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202907, "uuid": "2eb66efc-6c52-490f-9f14-256a2e9b0e89", "comment": "Malware payload (ValleyRAT)", "value": "39c0224697ee5275d2809a95f0ea0316eb82500c13eb8a61337f760348e87689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202907, "uuid": "7921d81a-2019-4ac9-a8a4-ed850b572bee", "comment": "Malware payload (ValleyRAT)", "value": "708dabd2190f64b40fda08221bb7b1609ea06503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202907, "uuid": "ba32f9a4-2df1-4846-92b8-58559a679ef4", "comment": "Malware payload (ValleyRAT)", "value": "bb3e3f2d7a92432dbdaf20e5a60a2c7b007b8a4c3448e9155bd005d4b1336a990f1db3f31e8058d8237b6ab80ec1f866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202907, "uuid": "e4e1c5c9-665b-45f8-b004-3e6efa988f58", "value": "T1BFD5331AF76877E9E06F413A8492295AE37778360BB0834E131842F21F175E49D2EF76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202907, "uuid": "48fafffb-5b31-4f8b-b78f-32d48926af6f", "value": "2c2757df8a2692a65005732a640ffc95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202907, "uuid": "cb8b2690-73e1-4159-898b-0c1d507913e3", "value": "49152:1cL7XgF/L4vNq6b7sP38iH6YKfBIxucrQQsyKlZDDeZ1X3zwjrSGnz+uC+Mh0eWJ:1M7XsWy3p6YKfBTc0QsLDeZkKQMhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202907, "uuid": "cf34b16d-40e7-4ab3-8c9e-4700a682bc59", "value": 2927616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202907, "uuid": "d910db65-8a94-46b5-b8d4-5ad43b8bec8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202907, "uuid": "183c847d-8f26-438f-8861-112821b35a5f", "value": "2026\u4e2d\u56fd\u516c\u5b89\u53d1\u5e03\u6700\u65b0\u4e00\u6279\u7f51\u9003\u4eba\u5458\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849c44e5-2f66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775225278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225278, "uuid": "a63f97f8-5dec-4691-923d-3d2d8e787fd5", "comment": "Malware payload", "value": "fa4d25ea52590f6ec9c91157eebe76f2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225278, "uuid": "dbe920a7-1683-4ada-bfc4-7f5ab2209b55", "comment": "Malware payload", "value": "39f753b15006c92bbd0392098518cd1c00615b9a80af75a077867046e5ecf218", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225278, "uuid": "d26c318a-2660-4998-bbcc-c9aff44012d9", "comment": "Malware payload", "value": "48c80a1e0b65389cbf8556981eb23571a99ee283", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225278, "uuid": "0e89dd8d-b758-4247-9428-2444931db7b7", "comment": "Malware payload", "value": "00277125d355a6a6931c47db41f502f948d65a8c4889df885ac341f12701e0d38d665151316970c5214298abd9a90ca4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225278, "uuid": "d018a4b0-aa12-4127-9b92-8984c5663dce", "value": "T1BE947C22E3D401F9E072C234C9A65702EB767C4A5378D68F22D855953FA73B09E3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225278, "uuid": "adb11fd1-2ea0-4015-bc42-2791f0f3fd17", "value": "f0a6fef5b0d4eda39beb706b0730f0fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225278, "uuid": "a0247cd5-ad27-4160-9845-5b21daca537f", "value": "12288:VPbEfLLf1HbTUJ/oj4VhPfiAv15STebkaxom:V4fLLdH8JrVUmfce/xom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775225278, "uuid": "592ae697-60e5-4af7-8ecc-b4987c9d5c55", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775225278, "uuid": "4d2b0c21-aa06-4309-bc84-5ab3a307c21a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225278, "uuid": "fafe3488-5889-4286-9ba3-50f14703cac4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19564c0b-2f32-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775202764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202764, "uuid": "6df1a061-e155-43c2-b05e-cc9a6d940a89", "comment": "Malware payload (AgentTesla)", "value": "1c8817839912487530e71359f465550f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202764, "uuid": "da22a074-cf81-4b7c-a148-24b1a2022c86", "comment": "Malware payload (AgentTesla)", "value": "3a139ac630e5af279e0d286171b50dfc24a02191d9b8ffb19cf426adbcc6320d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202764, "uuid": "5986d281-c945-4197-955a-a00f506794b8", "comment": "Malware payload (AgentTesla)", "value": "6e5a4788b88dbbadc27dbbbf069d1571cb25d93e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202764, "uuid": "1a85df62-f32b-408c-93e2-b80c3407bf8b", "comment": "Malware payload (AgentTesla)", "value": "d72153c82f1afb9ecc571139ffa78cf1943dfb8507338bdc1bacb95c1af499d080ed06508c026cdb4d83429443113ef7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202764, "uuid": "4a103d32-40fa-4890-b126-701dd539ca99", "value": "T1846501414AC43FB9CFA8562990FE151EF3B00D8E501AA98AFB73BD4ABFF76041117199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202764, "uuid": "bf1ef951-ea3c-4e43-b68b-93f25a632ea5", "value": "24576:Ny7Ldg5HyqcCeNAtz9KT7KluY0ipI24nTzs0HhnUIvlIEgCvP50XqP:NUpgNyfGwKluY62v+nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202764, "uuid": "4f342e00-dde7-4726-b53f-312506da6442", "value": 1493051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202764, "uuid": "56ca0ba4-ce27-4a66-83e2-c6a5b7606727", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202764, "uuid": "161cd6f4-8bd5-4e2b-83d0-a95698694184", "value": "Purchase Request_2026-04-02_FIN_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05060e8f-2f88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775239667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239667, "uuid": "b50b4d96-e73f-4557-8925-bf774c26a980", "comment": "Malware payload", "value": "11b625b87827db7eaed78f22adf72e93", "object_relation": "md5", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239667, "uuid": "fe144a2e-1f6b-4ff6-bd85-0eed0fe0d76d", "comment": "Malware payload", "value": "3a36197052dff82fd2c6a42d234e0482325f3f610136d58587cf466a569a6a96", "object_relation": "sha256", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239667, "uuid": "d6eb061f-6823-49ef-a6d8-00b296d6b824", "comment": "Malware payload", "value": "dba179344c353f0c99594fc281e431e55325f32e", "object_relation": "sha1", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239667, "uuid": "f9b6434d-6116-4b20-abc4-51a125b46d93", "comment": "Malware payload", "value": "c68a45f34d8305931750df9508dbb700dc2f2971fd976547db211a98cfc4fd9f8f05ac8396157d2d68f6aa8857a32820", "object_relation": "sha3-384", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239667, "uuid": "a1d56bfa-863b-408d-8c2b-417cf4354a2a", "value": "T1C8B01233C0E44AEEAF5FC82580151C5839000398C6548FD133E1924D3D4CC88C32240C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239667, "uuid": "eef23543-231d-428b-b5a9-1c52f82a937c", "value": "3:VSJJFISnMcXR/JJNLNNQXLzEfOWM1OJbYATyyN1shwdn:s8SMOBd+qbJsATVm8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775239667, "uuid": "1b2cc8e1-410f-4f48-b1d7-47a61a1edd53", "value": 100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775239667, "uuid": "66181f9a-7393-4789-8f65-2b55e329c4d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239667, "uuid": "d7251832-7b5d-45ad-a1e2-c0078133283e", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1589cf71-2f78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775232822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775232822, "uuid": "51c549c9-4831-4ae7-9a94-15ecb60ed277", "comment": "Malware payload", "value": "89dc84143fa123bbdb7b1e0001de52f8", "object_relation": "md5", "Tag": [ { "name": "c2-client", "colour": "#AD6396", "exportable": true, "hide_tag": false }, { "name": "casino-redirect", "colour": "#0DC1C6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775232822, "uuid": "b92ef928-c5f5-412f-88f5-67420322f136", "comment": "Malware payload", "value": "3a72983b2e794cb07417a16d2a7bd77210d7cff3840c183578c8318e91e933c5", "object_relation": "sha256", "Tag": [ { "name": "c2-client", "colour": "#AD6396", "exportable": true, "hide_tag": false }, { "name": "casino-redirect", "colour": "#0DC1C6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775232822, "uuid": "efb21306-670f-4399-97da-40e10507670f", "comment": "Malware payload", "value": "4d4dc680d3efa1ec733174849ea1d520ee4a5e2e", "object_relation": "sha1", "Tag": [ { "name": "c2-client", "colour": "#AD6396", "exportable": true, "hide_tag": false }, { "name": "casino-redirect", "colour": "#0DC1C6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775232822, "uuid": "8bb93d02-858a-4583-87ba-67d447d41a88", "comment": "Malware payload", "value": "4eb3d795e03fb8d16be1582943c12f8e7f23087f2803132c9d418f6eb578fe161a712285ac8b946984ba3ceff2813e92", "object_relation": "sha3-384", "Tag": [ { "name": "c2-client", "colour": "#AD6396", "exportable": true, "hide_tag": false }, { "name": "casino-redirect", "colour": "#0DC1C6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775232822, "uuid": "d9f8c9fd-8b54-48ba-862f-b9796d009b2a", "value": "T1152253CB32CFA8FF56B2765817399454D8BDD0B21209806DFEED16880EA412C9375F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775232822, "uuid": "2df39434-4834-4b25-bf65-96107b45255e", "value": "96:LTmPLK/RqNaEmqW0iaDz5JZIPDCSF/2gZ3CJaKSjtZkpbK3pJqQb5AX2wFuOEvCI:vFfs2ug1CJaKqGrX7vSxLYKarALZPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775232822, "uuid": "d7f46a57-16a2-4e03-b2e2-e323c3e0d168", "value": 10110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775232822, "uuid": "feaa0711-4180-4158-be97-c2509d002bde", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775232822, "uuid": "7e8d797f-e39f-4d7b-ad8c-8028d94f5533", "value": "woocommerce_TAG.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38121e18-2f29-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775198950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775198950, "uuid": "b74d01da-867b-45ef-bbce-24c9a0367bb7", "comment": "Malware payload", "value": "4200b46a93c6ab059e2b34ce200c4a5b", "object_relation": "md5", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GENTLEMEN", "colour": "#F2CB96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775198950, "uuid": "39ceb9d8-c9af-44b4-afd6-3937b994ce73", "comment": "Malware payload", "value": "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235", "object_relation": "sha256", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GENTLEMEN", "colour": "#F2CB96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775198950, "uuid": "21f50b2f-c4bf-4030-ad25-efeb0101c8d0", "comment": "Malware payload", "value": "42bcc743c71a9ea083c1c750a398110582796762", "object_relation": "sha1", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GENTLEMEN", "colour": "#F2CB96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775198950, "uuid": "680c3f0f-df0d-4744-9079-e12dcd65a0fc", "comment": "Malware payload", "value": "e85adf3d3b647d25833b1f9b3e4cf7bced175218885082ea57b8df1f090d5d9e800a2fceb98e3521a4584cf77a09fb13", "object_relation": "sha3-384", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GENTLEMEN", "colour": "#F2CB96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775198950, "uuid": "9dea1f88-3f16-49b2-bd15-e36e97283961", "value": "T170D56C97FCA225A7C0AAA331896251927A317C847F3123D33A50BB7C2F73BD06979754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775198950, "uuid": "4f504bf4-9249-4266-923f-4fcd00d40098", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775198950, "uuid": "8d01ea97-1d32-45ac-8348-c0a32ff8f0b1", "value": "49152:Dl5LxQaoySboC9C5ZtPzKgv5bQgZ3tA5m25ElcY:DHS3EX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775198950, "uuid": "2f37ac81-3543-4b2d-a37d-50f8aeadea1a", "value": 2962944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775198950, "uuid": "99dcb76e-0118-404f-8172-dd612764085d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775198950, "uuid": "e3c7dac9-444c-4f1a-8b7b-b7a544692be1", "value": "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beeba76b-2f1a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775192734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192734, "uuid": "a643c0e1-a5dd-4666-9e5f-b5887e96b670", "comment": "Malware payload", "value": "e540e9797e3b814bfe0a82155dfe135d", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192734, "uuid": "9c712b26-d048-4262-bf80-c10579f7268b", "comment": "Malware payload", "value": "3b85ecfe621924eba4d16d5993b2beece2a07fbedc7ef15850bcfdd44c4f39f9", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192734, "uuid": "5a213653-db98-482c-89f8-ab3b7e4c8eaf", "comment": "Malware payload", "value": "d823e0895acd88ad00ce46ff40ccac6b12bf35d0", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192734, "uuid": "186bc40f-06fd-4664-8781-12aa638962c3", "comment": "Malware payload", "value": "ee75c7f10ccef73386a7fe5b0d7b93cd10c40223cd118853d6184b70b3b8b29324769cc363c17c427cf50e0e6b5e5b8b", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192734, "uuid": "9831832f-4a26-4f05-8d9e-b4eda4bb12eb", "value": "T18D966B47FCA144E9C0AEE5348667A113BA717C885B3123D32B90F7682F76BE06E75B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192734, "uuid": "54b7f2eb-0659-4782-aa45-053da0689bec", "value": "49152:Q91mhz7QC8zeUDQBzTt3erZKEp3X26L9LrVWHuJvlCFvnxwy99Ahvbmjef9fX92k:QMZWTprYuFlaAhf9FVuFSEQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775192734, "uuid": "c32dd61b-c0e6-4e68-a506-dba7b068f2b2", "value": 8888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775192734, "uuid": "f3b4e064-a532-4a05-9420-2ebc31d3b53f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192734, "uuid": "4233f215-f1d8-4478-b495-2589ec1fd4fd", "value": "3b85ecfe621924eba4d16d5993b2beece2a07fbedc7ef15850bcfdd44c4f39f9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069b6b2c-2f50-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775215617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775215617, "uuid": "3ff56d42-1d3e-4cac-845b-2c47d1b31f9d", "comment": "Malware payload", "value": "d1e0557c3f84e657b2bc62ea2a43af01", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775215617, "uuid": "754195c0-ca1f-4020-83c5-29e294bb4c7a", "comment": "Malware payload", "value": "3d9cf30c5e02300cb05c27dd3f1b5cac4acf6fa0a550cf384ff09647b73c0381", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775215617, "uuid": "dabe4c02-3342-4e7e-b49e-f6c4184b1947", "comment": "Malware payload", "value": "2a681a1cd8712a55dd9e4a8d9292db9e17ae03b2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775215617, "uuid": "ae8cb759-93ff-4986-bf88-56f2329f45af", "comment": "Malware payload", "value": "bdd1e539c3a133dff30c11f812f96b503b9ab662aa82ba586698039e1d6dc10a1e5abcb8a9cc555045fb9ed05055f84a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775215617, "uuid": "771b11a9-74c8-41bf-bddf-d8001cc25b4e", "value": "T11847F107FC9515E9C4AAD234CA629253BA717C492B3173D72BA0F7282F73BD06A79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775215617, "uuid": "9eb113a8-9446-404d-b10b-144abc581e0b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775215617, "uuid": "6cf6e6c7-b658-43f3-b7e8-de19f865d692", "value": "393216:XeNSr1g9SVn8up0ZECpJcDtcut0EqbVHpXyIVaeaVGLp/Pr+WU8WSPI:XuU178up0ZkLtpqJHMIVDokFPaLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775215617, "uuid": "6c7ab97c-eeb3-4e0e-ad27-02f38b39f0d0", "value": 26740224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775215617, "uuid": "7052f1f1-0cca-4079-bbf6-c7f8b3290e5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775215617, "uuid": "e112d472-e92b-437f-9f62-fd45eb58e847", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81cdbcf-2f44-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775210761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210761, "uuid": "c4da33bf-3a39-4687-8b8c-594ee515f21a", "comment": "Malware payload (ValleyRAT)", "value": "6b583ec2cf04da5e7ab266435db154f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210761, "uuid": "62eeabde-113d-429b-bf2a-885ddf6b58db", "comment": "Malware payload (ValleyRAT)", "value": "3f96d585497d116fb57e304be408f5f14504a90b4b956b1c4017908274db9d53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210761, "uuid": "89234944-de81-4165-8d2a-d0e4930c7ef9", "comment": "Malware payload (ValleyRAT)", "value": "f7eff81bea148a01bd8ef7d612e44732ed84a6bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775210761, "uuid": "fdeb1ae1-d617-421a-973c-e0b8fbf84736", "comment": "Malware payload (ValleyRAT)", "value": "70df9c8009804a4660dae7aa60daccc1d6e3fd75dd1a6e0e872008de4927dc08d967be7f4ec1b1a5b8b0ca95fb855baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210761, "uuid": "903a9a9a-1b1b-4555-8006-e4b7cbacf664", "value": "T102E6E1F4A0398A13D787D539A115F63445AA60F1D74A90BBB017EEB9FB76320242EC1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210761, "uuid": "9a0e1520-8856-4bc6-9b37-3b1ba36ed5f6", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210761, "uuid": "89cf20ad-e3cc-4f62-88be-277ab26c2be0", "value": "393216:I9rV/jU0xPTll571hwnrRdrhsDxYs1NEDDwn/pWwYTIZJ:gV7L571hwnXdsDOsXaE/pWpMZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775210761, "uuid": "3669f373-c27e-4870-b9c1-3930fd171307", "value": 14551408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775210761, "uuid": "fde98276-b281-4fde-9913-35db082e3777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775210761, "uuid": "3b7bcc37-6d8b-4930-b2b9-37d4b7f293e2", "value": "6B583EC2CF04DA5E7AB266435DB154F5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2ff272-2f25-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775197373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775197373, "uuid": "0da5234e-ef8a-4111-a41b-cfdc2c0230f8", "comment": "Malware payload (Gafgyt)", "value": "fb8f457c669efd2a3d72d4e2ea2265f4", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ens", "colour": "#D5F6A4", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775197373, "uuid": "b5d37399-04ea-41e1-a4ff-a21233623486", "comment": "Malware payload (Gafgyt)", "value": "3fafbee7a3b7259db3cb16b1ea7ebf7c12a61ced08e8f71c5e85258090d8b6cf", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ens", "colour": "#D5F6A4", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775197373, "uuid": "3f052940-ed59-478a-9322-42ba804550f4", "comment": "Malware payload (Gafgyt)", "value": "c4e92014702abe420fcaa162610cb089729d0fea", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ens", "colour": "#D5F6A4", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775197373, "uuid": "76168618-0d11-4f1f-b1a8-571adbc561b2", "comment": "Malware payload (Gafgyt)", "value": "7309ab3baa05fd9e88f54976bf8c7bfe61d163f8154b49605a82ee44cd7fbd5f7cec53d44c166b41c7a67fa434ed1173", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ens", "colour": "#D5F6A4", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775197373, "uuid": "7e4ff5b8-9759-4ebe-a8aa-0a3164d45640", "value": "T19CC44A59A8419791D1D02BBFFF1E934873131B38E2EFB1069D196B246BABC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775197373, "uuid": "d34427f3-5e2c-40f6-8849-49e371f9111a", "value": "12288:XxHis09cGk4HCbMLoEwKFRH33tjutf3/KhE/WlaqO8qz6l9s6W0peiRW:Fis09I4HCC933tuKpjOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775197373, "uuid": "db051a8a-391f-4a4e-bcc8-c0c2e09d765d", "value": 573032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775197373, "uuid": "09aa56b7-f566-46fd-bb80-a8917044d210", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775197373, "uuid": "11ee758a-9f55-43d1-97d3-bcae89acbfa6", "value": "3fafbee7_richy_176.65.139.72_3924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfed4d6-2f1a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775192756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192756, "uuid": "0d27a384-c0f6-4d2c-a7b9-2a34e683ae66", "comment": "Malware payload", "value": "88c60df2a1414cbf24430a74ae9836e0", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192756, "uuid": "28a28edb-5798-428d-8ed1-ac3b02ffe12a", "comment": "Malware payload", "value": "4049b11974d4b950885ae93bc9af3c9352b70a064b373fab60f4c99542f71b20", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192756, "uuid": "92220432-033f-4ebf-b2e6-e970b964243b", "comment": "Malware payload", "value": "0c79011beaa07e60f956ff8df95be4b503662c8e", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192756, "uuid": "47650796-791b-4380-8aed-0dea000bac7c", "comment": "Malware payload", "value": "17ce9be9cc223b997a0015c575edd30a237664d5ef175e2ff5d7de37e7d528499c67a1c56f8ca5e939684088160f7c53", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192756, "uuid": "303fba85-7333-404f-b317-3651f60ef0c8", "value": "T15D867C07FCA145E9C0AEE53586239253BA717C485B3127D32B90F7682F36BE0AE79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192756, "uuid": "b8ca2ce5-83ef-433e-84f1-173c85a6ac88", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192756, "uuid": "bd8e7dc5-9d9d-4a5f-acbf-a8cb534ddd5f", "value": "49152:QtAttpS/T58Hn+sFzsinMYBB8fyRNOnFiSxi0mlOPDL94jLef9fX921wJbBguofo:QmIeD7OFiaYNsxE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775192756, "uuid": "12d5f05e-89b7-4fd6-90f8-c87048a03436", "value": 8459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775192756, "uuid": "007f6ad1-436f-477f-aec6-26fded5567f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192756, "uuid": "128f053f-3dd6-458e-9b85-102ae7e845fc", "value": "4049b11974d4b950885ae93bc9af3c9352b70a064b373fab60f4c99542f71b20.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ce1b9e-2f78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775233138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233138, "uuid": "fe19b5a8-4dab-4ba3-8aff-ec5ddba786d5", "comment": "Malware payload", "value": "1c57cdfd80196afc724ec34b6738709d", "object_relation": "md5", "Tag": [ { "name": "linkerboss", "colour": "#D69E98", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "seo-spam", "colour": "#BB796B", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233138, "uuid": "c51a9598-64ef-43cd-b136-7ae8864bb0f5", "comment": "Malware payload", "value": "428213518a401592645e0bb0217584d8785424a33111ef1e4c7350259a315571", "object_relation": "sha256", "Tag": [ { "name": "linkerboss", "colour": "#D69E98", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "seo-spam", "colour": "#BB796B", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233138, "uuid": "12645315-92c9-4579-a97f-9ab85477c8c6", "comment": "Malware payload", "value": "10149fa93fc4c158345787cdcb8a3b53ff3ce415", "object_relation": "sha1", "Tag": [ { "name": "linkerboss", "colour": "#D69E98", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "seo-spam", "colour": "#BB796B", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233138, "uuid": "e34e4517-0fdb-4eb5-9d70-cf1819b96ff1", "comment": "Malware payload", "value": "c273801860329b0dd026989638801acc95834628184da22c4d86f301b2cc5c6abd392b497ce7c6dfdbce0469f6f9c431", "object_relation": "sha3-384", "Tag": [ { "name": "linkerboss", "colour": "#D69E98", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "seo-spam", "colour": "#BB796B", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233138, "uuid": "1e6bf2be-2d56-46ea-a555-373d87676934", "value": "T1A9A222997447A8668673A33DDF97A41DEF6A492714444340FEBC80C86FF0229D2E9F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233138, "uuid": "fea8c204-e31e-4859-a373-983a7f09b908", "value": "384:Ur9EcYKnvqpQDNQC7y2J/TTfc0HVeP3edU0nKab3TId3IKnX2tg:Ur9gKcCQC7b/TTffVeHGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233138, "uuid": "bdc1d50c-fc4c-40c4-8481-f92baa8a2135", "value": 22816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233138, "uuid": "82deb239-fb8d-46b3-95d0-6f1bbedd5139", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233138, "uuid": "c1301c03-38a4-490d-bd23-59fcc2f6faeb", "value": "fhelpers.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f4a506-2f08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775184719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184719, "uuid": "6604a286-3a42-42ac-9d14-a70798cea4b8", "comment": "Malware payload", "value": "345b798c2156b78883f40b5d5b72d67d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184719, "uuid": "a7de6c44-bb10-4c7a-9fbd-d0657702f17f", "comment": "Malware payload", "value": "437816447dd69f712003ef332ff71e1a23e7ead9d5b7eff39c547159cfb60697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184719, "uuid": "f3fa1d8b-9c8e-4c27-be9a-0945b5acc5a7", "comment": "Malware payload", "value": "c1d2b7d4767a62ca31adf50e83d1ae5206dc73f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184719, "uuid": "6d04d235-661f-402a-9745-a651d7229da8", "comment": "Malware payload", "value": "5518fdb89984e9ea806a44b8ca307569239049953df8cf51962d31510cb34890f2dca0586e8bef73d4185808e6e777b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184719, "uuid": "3035c014-7b73-4164-b7e6-392d40c25618", "value": "T1D4E57C47B69B01A4E1B2C23CC9A7955BE6763C02DB2049CF129C770A5BB77F0193BB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184719, "uuid": "7680c4b0-3347-4b5e-a5eb-bee87f5f9ac6", "value": "232bf1b432d5e12ef0ca641600bc333f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184719, "uuid": "53b8bb12-5fcb-43eb-97a3-d9a0c0844360", "value": "49152:z1GMb3ZprtTrhFP7/bMA2RyF8A3QKO+i3KlU+UboQMwJsv6tWKFdu9CePTvG7X3c:J3b5PbM5RWzOo0Jsv6tWKFdu9Cei0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775184719, "uuid": "9bcf7864-3f86-4864-a9fd-225e1c180ba3", "value": 3317760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775184719, "uuid": "7f23e03a-aa6a-4f7a-91fb-1c870897b2ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184719, "uuid": "5bf1838c-baa4-4241-9d07-eff2ada2bd87", "value": "2026\u5e7404.01\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426d7562-2f79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775233327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233327, "uuid": "80cdd9e4-d93f-4546-a279-3880861de673", "comment": "Malware payload", "value": "3ec07983eaa2f833b53b0cab2a038b0d", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233327, "uuid": "69f65889-91a4-4f07-b3a0-eb7f75f32d76", "comment": "Malware payload", "value": "43b95f486c2b33c46164bfecff67648f033ef5451b304fd4806ed1e37e6d2390", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233327, "uuid": "ef5a1c3b-9c0e-4c67-b1d1-3d319f76b46a", "comment": "Malware payload", "value": "0c3daa2b1fd30cc8f82bb3975b76148191f36771", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233327, "uuid": "3ff25342-07c1-43df-bec5-d4a9efc8660c", "comment": "Malware payload", "value": "cf9b4fe39cd89e20c0f46775838ee02717dade89e8f7b8b4e60e8178e1cfa8d9d9c34b4cd2ed0658e6f9fec9f176cad8", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233327, "uuid": "eb21a41c-a52a-4ea2-aa70-687cfc476b85", "value": "T1AE13A616A08101625133E7A5BBA2AE0EFF918257C505421D3EED73CA5FF4B08C9B7F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233327, "uuid": "fa607bb8-dfba-4731-83fc-0d17bdeb0f2e", "value": "384:+qxyvbeGBOYVhXXAFhSfAhkfho00zBoAMzi2/osIUL1qdEH8C2ziJ5u6GRQXW2:sjrHV/oq1qQSoZ3W2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233327, "uuid": "6fe77fc0-65e2-4629-8d73-cfa755904bf3", "value": 42244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233327, "uuid": "3cc0c8dc-e244-4e38-96d1-959b380119b2", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233327, "uuid": "7654bd01-94f0-4b5e-b0e3-461687abf14b", "value": "webshell-42k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66073960-2f16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775190867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775190867, "uuid": "f08c47b8-44d3-479e-a148-b0346875e6df", "comment": "Malware payload", "value": "0eab14dcf7350531acc409be8bc70def", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775190867, "uuid": "a6d546be-ad0b-4f01-98d7-c2b47780e80d", "comment": "Malware payload", "value": "459c5374a9c6b6109a19bda99e4ab4b81239a53fbd0b9915cb1a51b34e2ccb4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775190867, "uuid": "749a76e6-1bbd-4bc3-b17d-77cb7dc7f24f", "comment": "Malware payload", "value": "3f64b7ce830187d018e9d37c2f2a99bb220c1a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775190867, "uuid": "5e1f04be-2348-45da-bfe8-8d5829d696c1", "comment": "Malware payload", "value": "5daa96e4827f38524959cefc1735d22edf01d18f76f5b59066b1e8ce7d26aa17bc6f5b6472dab1900f059b2645074c70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775190867, "uuid": "70f97df5-634d-4700-912d-355294736afa", "value": "T128F34D3E274A9E77CA6C86F0C0DB512017F2968B5B33C7492DC016DD1E42786BE5768E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775190867, "uuid": "ce9b127b-4cf7-4fa0-8060-7538447dab1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775190867, "uuid": "3034c70d-4ec6-49ae-a6c6-ca5ee176086a", "value": "3072:WgHfu812B4gcFxxPxE9ZS797Bwze2iIcevlEX4dTlpB0DNohSqs+DgZZOHVxJEii:Wm2HcFPxE9K976zeFlevIkT0DNoBs+Dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775190867, "uuid": "9a8e80b0-6767-4c4d-ac43-0cefa6a38375", "value": 164160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775190867, "uuid": "dfdcafbb-80fe-43ec-81b6-26da904c0ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775190867, "uuid": "3ac5d32b-a136-479f-b107-524b7204be90", "value": "DiagnosticDriver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2c5ef1-2f75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775231622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775231622, "uuid": "97cd5ca6-4bd9-4747-b4dc-f97ddf6c73ff", "comment": "Malware payload", "value": "9940299fe94f8d633d90662b95ffb0de", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775231622, "uuid": "3a7cc5eb-7889-499d-88b7-9c6e662c04ce", "comment": "Malware payload", "value": "462758bbe01916452f127d1c937f42819ed1676d490bb9d1cdd3070537ae191f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775231622, "uuid": "2479a610-5fbf-4438-9891-271abb4e5910", "comment": "Malware payload", "value": "40aed28a7b23f023064d40429b429a463649d6a5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775231622, "uuid": "1dfe1f1b-da9e-4f7e-b5db-81648eaf3872", "comment": "Malware payload", "value": "e207e5a68cb3bb4d21689ac382e70bfc57e22d1490a8fff87a2da4f433a858d8648a00b61c0910d7e44131512a5a81b5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775231622, "uuid": "90c8ccea-83e5-46e0-95a7-2d0f0d581d30", "value": "T1C3155E24F24E588BEC5B6DBDD5493A758DA8FEEB8808376FA85D79103CE7080775B090", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775231622, "uuid": "4301e3d9-1039-4159-8623-21ad767f632a", "value": "12288:jUVIQ050IKX9oxSMD3INgghmtVLEmqtlTt011Wb5JXGlAS:jVQ0zKXiIS3wBh4YmclTt01MFlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775231622, "uuid": "b7faf786-83a3-41c1-a399-64319d38b102", "value": 924972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775231622, "uuid": "e9768d8d-1e39-421a-a9f4-f7c820b0254f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775231622, "uuid": "9696d7d1-2cdc-4c59-8aa7-5994b1a601a9", "value": "Prestige Client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e9ad83-2f82-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775237163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237163, "uuid": "a8fdd729-346f-43a2-b50c-149cae902d7e", "comment": "Malware payload (SpyNote)", "value": "c83ecadfcd30d1ce91f49cac6c725e59", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237163, "uuid": "be7656a5-4406-4f64-a402-af5daf2926a0", "comment": "Malware payload (SpyNote)", "value": "46326534553b3c5307d4c0347c12919b93b2699f9670593885cf52182a28180f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237163, "uuid": "efa77515-049d-4635-b9dc-032457be3d3f", "comment": "Malware payload (SpyNote)", "value": "31240de5131030e526e6f543adb3fbb88bd62a21", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237163, "uuid": "acf2863b-8676-43f1-81e7-02fbb599dbd9", "comment": "Malware payload (SpyNote)", "value": "777e311602491d95705242f20bacd3adb186c34a2139f790ac97490569e363a1960b7ce2845c004630a46c93085c2278", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237163, "uuid": "3385c7ea-1d0d-49f5-8587-2d850022e595", "value": "T1F826F103EB58D68BDAAE83F26F270C9915175F15C692B6D744147A3E2EB72C10DC2ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237163, "uuid": "f83e772e-c984-42bb-af97-951c6dcb8816", "value": "98304:sIT8OFRGW75+bJ8UvBVMyLb2mztzB2TK0toUuuI:szExQZVMyLdzWp3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237163, "uuid": "e9c62a9a-fc33-4fac-baa0-cd428272c8d1", "value": 4578771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237163, "uuid": "7fe2bec8-e31c-4e9d-bdac-1962faebeaef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237163, "uuid": "fad30f75-e9db-49cc-9cfb-2c0d94222067", "value": "google.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5f3e76-2ef9-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1775178427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775178427, "uuid": "c72a7ec5-245b-4463-9673-bd63bec73b3d", "comment": "Malware payload (OffLoader)", "value": "514ca3e05b2daa8e2f4f179c8083c19e", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775178427, "uuid": "0cdc02b9-612f-4320-96e4-d2d6c37efc7b", "comment": "Malware payload (OffLoader)", "value": "47f92d2b9a3091d80834f06dd54880f99936aa1337590d640478e23067ef6bff", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775178427, "uuid": "1464373d-a09f-474e-9f01-49d4f00e1dd4", "comment": "Malware payload (OffLoader)", "value": "68e7b400b878091b41974c1d8b2d68538c72eb35", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775178427, "uuid": "1ccbc87d-02f8-4c3c-a7e0-a9022d1affa7", "comment": "Malware payload (OffLoader)", "value": "42d70c7329ccf7203a3df90d30c95275142e1ce9f67f25b122375a2ac1b4b695ce37ab4717c36602ed22ad22eeca1ebf", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775178427, "uuid": "aad96e59-4b1c-4e1b-9f79-2c5c14841cc7", "value": "T11766F123B65A633EF0EE563749B29232583B6E61B40F9C0696E41C4CCF790603E7E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775178427, "uuid": "9cdd4a7f-ed49-405f-a8ba-e89b8621260f", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775178427, "uuid": "1a0279c8-4223-4476-8003-6470cc53a256", "value": "49152:gN61T1mEOsMH70u2t4OMJmnGqZ3WZXBW/VbGQpy+EOXhJoVxVtOV6I/RwApNZSt:gN66MMH7utpMqZ3W5ORGQp1srkYS/f8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775178427, "uuid": "994753fa-3b79-47ae-b895-3a7713ae4628", "value": 6731604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775178427, "uuid": "fc4f7c67-69a3-4175-8d18-aea0c6c2d3ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775178427, "uuid": "9ae1cc4a-129d-4aca-891d-45efa98a0cd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16002761-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775237977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237977, "uuid": "672caf2e-a710-4b35-a03f-75edf601d606", "comment": "Malware payload (Mirai)", "value": "fb4dc02f89538f6151534b0ea462acbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237977, "uuid": "4e8f289d-fb6d-40bc-ac8e-fdd0f715046a", "comment": "Malware payload (Mirai)", "value": "48515854a0b948442e97d8bbbe26bcab9aa095c71fff2b3ad2424368945cbf91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237977, "uuid": "ffd1c2a9-14c5-4245-887d-7fd70d6ca3db", "comment": "Malware payload (Mirai)", "value": "893c3076fb388ea6ac6aa75c37a58f4364188dd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237977, "uuid": "d96820ad-b1d7-4acc-8ab0-b060540b5f8f", "comment": "Malware payload (Mirai)", "value": "31e96b90ea1a8528912e796bef3f0f2f81b8bfb07314420f339aa709ecf68bdf079fd6266998f267ddbc6e36faab01a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237977, "uuid": "d0ac05eb-5b59-4aed-8914-920b02abe81f", "value": "T14AD2E128224A94F5F92A64FD05FE1B4025F64FF3A503AC0EBA5DFA278E510B418763F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237977, "uuid": "5cb0fcaa-6a9c-477b-8f84-a186550411b9", "value": "768:NmQZwJRtaXuEAwmTmTohlEP0ytY5eGLLCBJgGlzDpUYs5:VZwfUuljcohbyioGCTVqYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237977, "uuid": "5601638f-f759-431f-b309-268f39da0ef1", "value": 28660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237977, "uuid": "a19e5810-dce7-4eed-b9b4-ac46ed5b4970", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237977, "uuid": "84eab485-6b9d-40bf-a3d7-1f325bf5ad23", "value": "yakuza.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b434335d-2f9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775248980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248980, "uuid": "8b736961-a46a-41f0-b7f0-896694261108", "comment": "Malware payload", "value": "0aaa7cacbee9e64b709e7f3885ae915f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248980, "uuid": "5a71123d-925a-4097-af4a-7e5b271e59d9", "comment": "Malware payload", "value": "4a24649eec01af56d826ae375fc7ccea839ba2c7f1c89207e3f6a2e83153ab81", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248980, "uuid": "1434a3be-e549-45ec-8b95-808e25653a07", "comment": "Malware payload", "value": "47cfb4f795794558a7e7d6ac766b3894dc684295", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248980, "uuid": "3c61bef0-9e3d-48a1-9909-55304e185597", "comment": "Malware payload", "value": "bcbf4d3d889744baf2246406c680d49317cae86b2147f71a902ff8e11b9c44cc632eccbac29cb7a5587219e63caecacd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248980, "uuid": "068a7370-d2b8-4400-a575-dda4c9c8ba74", "value": "T1EA155C1BD39646FAC56BC17083979772AA31F45A1238B70E2EA9D7023E21E60DF1F354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248980, "uuid": "20ddc27e-1306-4ecd-af28-9843873c31e2", "value": "63b1364889694f034465d9cb77b44bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248980, "uuid": "d6d43fe2-2d81-44e3-8015-98bf9f619231", "value": "12288:SRNe2elUKxWnu3UPAqAoN0tudEVYfFjpBRQMAC1NU3ctYhSmwm7rP0:8E2WdxWeUjj7RLmFNr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775248980, "uuid": "3d5c901c-2673-4a72-b605-045b2e55f930", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775248980, "uuid": "da6f97c2-6959-42ad-b8cb-f467395bbd27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248980, "uuid": "a0900e85-1383-4ecb-ba4f-48c0bc2d38d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660dd3c0-2f9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775247560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247560, "uuid": "029ea8c6-398e-4a28-a6b9-6a2d7868343c", "comment": "Malware payload", "value": "4b127b2482ddde09f34ddd13ec5208c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247560, "uuid": "3f58e5d1-97b0-4232-ac31-5d5e41f2cb3c", "comment": "Malware payload", "value": "4a7064202e47848c09c0261f4b6c9a69487408c54ed7f5942cbcd775489aa00b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247560, "uuid": "3464522b-7dd4-4727-8b78-f683e79c2d34", "comment": "Malware payload", "value": "d37964e21c322b4f34b6ed01b4afe52184188e09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247560, "uuid": "3d7396c5-06ef-4066-964f-aa083a5acf86", "comment": "Malware payload", "value": "f012f39437ad7bd91d66a59d524e148b34f76caddbf2347788050f7bb100f4f1bae2d3f729ca54c4a645e2070ebcd54b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247560, "uuid": "b9557db1-0d56-4f69-9526-a001e5234934", "value": "T156464C07F8A244A5C5BEF1308255B22EBAB13C6447397BD31FC4AA6A1A75FD47A3D340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247560, "uuid": "fccd9680-d620-47e0-96a2-0879ce80af0b", "value": "c7b9fabb19991d383f5951f5915bf283", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247560, "uuid": "3d5f8395-f1f2-458f-b245-a5168f245cd6", "value": "49152:J0ge4ItIwZOphsDIu5hVuxjju/0jacbLu4+M+RcVX/5fA1JTmMc7TtepBX1NB:7ItPZghsDIurVS2c2cHb+M+RMUBXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775247560, "uuid": "7f5dfdfe-6f01-42b1-bc64-ded2b93ab04e", "value": 5706880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775247560, "uuid": "7b4e1913-e928-4052-b7d9-8726930681d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247560, "uuid": "2f91d2b8-8407-448c-b98b-316a94abd05e", "value": "tntybj7p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926e1f36-2f67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775225731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225731, "uuid": "0aab6cc6-f108-4472-bf9a-54fb82d90557", "comment": "Malware payload (Mirai)", "value": "154245e2a15fa97f29a41ef0ede83bc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225731, "uuid": "bdc15e1d-9673-4c97-8bd5-4cec7d7c256e", "comment": "Malware payload (Mirai)", "value": "4c651b8bfa5c28f1c0236e53ff9037a2738a40902e765464abbbd96cae6a131e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225731, "uuid": "8ef980af-5512-4258-b643-3851f010ae0a", "comment": "Malware payload (Mirai)", "value": "6648342a2c6395ecff6631e395cd622762a41858", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225731, "uuid": "03d49796-7754-4cbd-8b6f-c7f5bdb6ce5b", "comment": "Malware payload (Mirai)", "value": "95056d2fe6789316339d1ec1ff53af6722fbd80e4a08877fe47f70305bc79658092bf2963a82ac4de8fd89b97f4971d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225731, "uuid": "2b9962c9-2260-4e48-a5b9-4207c98abf0d", "value": "T1D2D35B17B4C180FDC4DAC1744B9BF53AED72B5A91238B26B27D4AF221E89E305F1DA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225731, "uuid": "978c44e2-9bf3-4d9c-aea4-51f41d5629ef", "value": "3072:l9yPSZCG2lTFpQ6TE7SBpZDaQ8dEoBjgQy03DcA8mrFn7:l9yPSZCG2lTFpQ6TE7Q8D4Gn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775225731, "uuid": "a4bb8a46-a775-471e-b58e-7fe707c13592", "value": 139736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775225731, "uuid": "1742c7f1-f411-4b59-8153-88a9d376f76a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225731, "uuid": "14f2cc1a-dfcf-48b0-8847-ef4ae22facd5", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cb3e4e-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775237973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237973, "uuid": "dd375446-b68d-4f47-827a-32a0d467a05e", "comment": "Malware payload (Mirai)", "value": "366c878a160137ed36678981bab4105d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237973, "uuid": "0fea66a1-dca7-43d8-b926-cfe241bd606d", "comment": "Malware payload (Mirai)", "value": "4e3b462c48cd70da96ff71ccbc477e51dfdf6c2c9caccc88af24f8ffc3022832", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237973, "uuid": "0b83b03e-9a1f-4b33-9e34-b1442d60e622", "comment": "Malware payload (Mirai)", "value": "587371fdc743de07851174758a44b79d2118229c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237973, "uuid": "1c1b6e07-2547-42e5-b79a-4bef7d06a7c7", "comment": "Malware payload (Mirai)", "value": "a5a4bb13259c0d69f96517303d786012f6ed47e8e60e94838030d2bb0ef3ff5a3ad52472e8e34d606852a9e2d61f0899", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237973, "uuid": "66493d88-a9cf-4433-ac74-a3c133cfbdae", "value": "T19D533AC4E583E9F5DC0505B06167AF328A77F1BA2229FE97D3EA65337C42602D107A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237973, "uuid": "5cfc6d34-d5a2-4a3f-a24d-725d2bae8c8f", "value": "1536:pHqzrpmPj837s38tIP5Xsc+qwI+P6641Rat2yYBkH1vp:yAPj837s38tIP5XsiwBi6410t2XKVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237973, "uuid": "ca4baaca-9465-443f-a9cf-adc4d7c6385d", "value": 62560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237973, "uuid": "ddeda26e-3666-4bbe-87ad-ade2c0659cda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237973, "uuid": "a7e55191-dcc5-492e-90c9-2744adb3dd29", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2727138e-2f35-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775204076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775204076, "uuid": "5120b7cc-e55f-4157-8d58-18fd2d82df27", "comment": "Malware payload (PhantomStealer)", "value": "f110cca2d728b0f3f013c8fa934c70f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775204076, "uuid": "3c5af891-d944-4751-ac56-badc0a434b2e", "comment": "Malware payload (PhantomStealer)", "value": "4e5777574f81eadada40188796507da424f5d32cba7ac6c00e13a9f55fd2da66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775204076, "uuid": "2d57fe69-e348-4cfa-80bc-4e1973c91d37", "comment": "Malware payload (PhantomStealer)", "value": "6e6662b07def0650488b9861e69f6dc9805fb697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775204076, "uuid": "e0bfbaf9-6bcb-4790-b7a5-757eb9972218", "comment": "Malware payload (PhantomStealer)", "value": "43da838c7a636fdd3f2eb26831ae08aee53a933b8bccbec8a92e397224230321e9a9bd410bc693e12261494e6e26777e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775204076, "uuid": "30b35ad9-e948-4d39-885d-339e46350f56", "value": "T1037512802715DF03C5969BF01D30E2B10BF66E946422D253CEE77EEFBA29705AD44A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775204076, "uuid": "ddb84ccd-9215-4014-9109-dd307e08de7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775204076, "uuid": "0fdab5f5-7a06-4636-8088-39aa0a630ba8", "value": "24576:uuFSJJSHw15FijkTC5oNN7MFByc+N3glvWIRzYjmm+HFi9g/nrWetxrBDqo6SDCV:uwqUw1mjpoIooTzk+HFi9g/rTVWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775204076, "uuid": "0c9a56e5-6458-4206-965d-a5f2052ab591", "value": 1673728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775204076, "uuid": "019612ee-0ab3-49cc-b176-e7d3dd3d302f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775204076, "uuid": "a26cf589-64d0-4556-9775-ae714cdac200", "value": "RFI No6000078322.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c572c0-2f37-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775205260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205260, "uuid": "3f5c0ba9-1e97-4b9e-b1d4-f8845ca68806", "comment": "Malware payload (ValleyRAT)", "value": "6c2f22571504315799964af7828e4586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205260, "uuid": "859b727a-e54a-4101-9868-b742aa05f7ac", "comment": "Malware payload (ValleyRAT)", "value": "4fe1a58eba35e2e861aa508d45ea5d572e0529587bb1a9000875dbddf7f59bf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205260, "uuid": "f75e1dd2-b7cb-4ea4-8306-99fececdb766", "comment": "Malware payload (ValleyRAT)", "value": "572ebbff9c26f5004be06f657eb20a0333743640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205260, "uuid": "29a7b985-de08-4fc5-8dcf-d16558425fb7", "comment": "Malware payload (ValleyRAT)", "value": "d338a90664bee2545335b66e4400a9c261279cfabbf9d8a99149be5305da1e3e863293e0c0b047aa7ff891ecdaa78593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205260, "uuid": "14a2187e-35c2-4cd1-9165-4f0793a210fb", "value": "T1A146E107F79545E8D47AC2348693CF71AA34BC564320AA5F39DCEB173F31AA09A3A714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205260, "uuid": "80e957dc-1041-4f82-9202-048549d04d2f", "value": "68bad715f1c4b0e4fcb2fcf08cd90d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205260, "uuid": "3aed8343-de5d-491d-a69e-c43c5d73bce1", "value": "98304:wCYd9uXpuQXnhclmmCNbDXql4dkiTzIHdYz8T71t1AaKkFIUgfEs:bYMpu27N6l47TzIHd9X1AaZFIUgfEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775205260, "uuid": "9f86b722-4e0f-46c6-a1e1-316cd214a3e9", "value": 5460528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775205260, "uuid": "0a191d55-597d-4901-89c7-eeb0d836667f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205260, "uuid": "620eecb2-ba6b-49e2-8198-92033e104599", "value": "64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fcdd9d-2f95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775245327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775245327, "uuid": "295760c9-a4a5-46e4-92a7-45879e07192d", "comment": "Malware payload", "value": "1b86b2a36f859d7d099db6bb4e5b1ca6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775245327, "uuid": "45ef41b6-f4f9-43aa-8f10-d86f24108d88", "comment": "Malware payload", "value": "52e68fa2bb9568bb3039f0b0e820022e8aa02d46ac2c000ebf0deb49d2b3be1a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775245327, "uuid": "f2c0574d-9e84-415b-b69a-9bef7e450708", "comment": "Malware payload", "value": "13a8b49ea33144322c636ac99aaf443d0195d9c8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775245327, "uuid": "6f5173c4-dbc1-45bb-a79f-aa5fbad259e5", "comment": "Malware payload", "value": "2f0f1e876770c4808fbc96e319464dafd40f5f76288ce95df271f469f57d41f27a75a8e2b1a24e67153e1ef747e6469c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775245327, "uuid": "865dcc0d-589a-4f1f-8a79-4f64e5bd21fe", "value": "T153910E517C1684349598C9D2AC9B9F52F72EA28B50021FB0308FA0213B68EE86E7D6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775245327, "uuid": "de6fecd0-79f9-488c-b375-6a1c9aee65b3", "value": "96:rE6ipJxOU81k1Wocsjm9xeJwNc6eYyiEy0nD:roOX1kAocsjKxekc6eYfE7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775245327, "uuid": "f418f35e-b854-4e7c-96d1-a34a21d42b90", "value": 4411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775245327, "uuid": "d581d8a8-5b44-4155-8687-04ddc5533213", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775245327, "uuid": "75ef08c1-3cbf-48ea-bc7b-0712bbd6bd7d", "value": "Petya Bat Remake.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45aea80c-2f8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775242782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242782, "uuid": "cf655143-b783-43e4-8605-7587e307e196", "comment": "Malware payload", "value": "648dd84315d56f582399568d97536ddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242782, "uuid": "9537b2d2-58ed-4a71-97fb-9762766f0e7d", "comment": "Malware payload", "value": "5328d99bad0b89076b0028784010330e88ec4dbbcaa8bb365d8805c59f1e05f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242782, "uuid": "0e7e547a-d3f9-4db0-a811-6f8e88475221", "comment": "Malware payload", "value": "0e4841e4c8cc2902dba797f51b187eb1db017e97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242782, "uuid": "5477de60-1dcf-44a2-8c16-c66e56feda08", "comment": "Malware payload", "value": "9e1bee1fb31ac125503ebf923f1f6e0c4a3655d121b935c2fce88dd89ee48e4a775fe9b4608d32f70d5e2fa3f5fd214b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242782, "uuid": "477577e8-1922-46f3-9370-a45a35c54ca4", "value": "T1D9E37C57B3A130F9D0B78638C8610A45F772787657205BEF13A8437A2F276D19E3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242782, "uuid": "56e6310c-5580-47cd-abfa-23023cbc3c42", "value": "4b9389ed4ab1f26eadecb1876891b644", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242782, "uuid": "9ce7aa84-944a-4bc5-87bc-51a2bbc93ddb", "value": "3072:tomx2fCR1lHsqtlPInwnQNaHXDdYXbTl:xMfI1lXAwnQID6bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775242782, "uuid": "833a968f-2df1-4f42-86ae-f040a29a3c8b", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775242782, "uuid": "1a0970db-408b-4b86-8fd5-5d27a9894ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242782, "uuid": "5492ef06-6c2a-4e1f-8fa4-6c222074ea95", "value": "rickroll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f8a0b8-2fb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775260452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260452, "uuid": "44f4f92d-1a00-45e8-8cb2-edf98d733e82", "comment": "Malware payload", "value": "0702d0c09f62c659f41f6e951abfd849", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260452, "uuid": "4409f9cd-7eef-4b1e-a99b-9e868d2da0a3", "comment": "Malware payload", "value": "537b8edfffa12b7efb388308c057b44558accaac0545d5322a4a1b6ca8a35f3b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260452, "uuid": "d932d654-caec-401d-899b-d7043720a5e6", "comment": "Malware payload", "value": "a8e27e8d7022f0e0bdd7808b782f7c52a772e424", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260452, "uuid": "f56413b8-a84a-42e4-a0f6-92e8f9a134b2", "comment": "Malware payload", "value": "b6e39a804332f9a0bdd58abaf12bdc5870a2f88eb86e7b827143e75cccd9ab3e2a9ba64736ebd8492281144ca2af6e3d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260452, "uuid": "25171019-9b90-480e-b777-3220fffe89e2", "value": "T1EA073396B7CC4A7CDE5A6C3D8CE2FD095B2A5806B49609F7E94DC1EA893331306EDD10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260452, "uuid": "255e9f59-be08-4dd6-bc58-84f8d13457a9", "value": "393216:eUdvXpjK83HTmB4hwBiL3JE8Y0yoaZE54g8j9h8h:ecXpX3TmB4h+0DaZwX8hqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775260452, "uuid": "84e88737-1aa5-4134-a37b-6cc5667651ad", "value": 17816012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775260452, "uuid": "c5743954-d9f8-48ce-97d4-a42c8c17e27f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260452, "uuid": "ab8d0083-2f5b-41fb-947e-9bd2d79711f0", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0a02e8-2f47-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1775212055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212055, "uuid": "3b934cf1-c1b0-43fd-8c36-5dd391e4ad16", "comment": "Malware payload (XWorm)", "value": "f62df8c560fee15f1ab42a6a2ad1994b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212055, "uuid": "88031f84-9333-4fb5-b417-e698925eb464", "comment": "Malware payload (XWorm)", "value": "582a625083229573709b5df4f3d71b701759873df3eaff7ffe8ceec84c5828ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212055, "uuid": "8a0af47f-1919-4705-a1ca-0eabc1a9449b", "comment": "Malware payload (XWorm)", "value": "3a4beaffc7a72e82db59b276532f01fc24c8ed07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212055, "uuid": "6d32a425-5caf-4eb3-80f5-eb53c9bb3a2f", "comment": "Malware payload (XWorm)", "value": "c70a71c5c922c83a27b4a4e6d24ecba3ef61d51f6d1541d4c3b10d038ee9dab6020e01b5c30e9c593dca74008388dafc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775212055, "uuid": "206ca938-57c8-4389-a2da-8da399704082", "value": "T1EA15AE0123E81F99F4BFAB38597115214BF5F982EB32EA4E3D9951DE1C61F81CA12723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775212055, "uuid": "565f49b2-1b63-4ab4-951d-803bb6353fe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775212055, "uuid": "fe0aa44b-ca7a-4b03-9d2d-26a3e0a87f7d", "value": "12288:vmbxnqLJzUnxYMBzGIE8QyZAWvtMr7it+poRXdnEdfL1t0n:ObxnqVz78GIEJ68sXi7in", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775212055, "uuid": "f2d45d2c-80dd-47e4-9bbe-6a5d2e426d3b", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775212055, "uuid": "623c32de-cf66-49d2-b3d1-e058e1c97f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775212055, "uuid": "fd2db825-05d1-4c16-b12b-7a7af95013f8", "value": "Order Request..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a343e2-2f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775213180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213180, "uuid": "d470d5c2-a4c4-4e25-9b07-a2c55bcac8f4", "comment": "Malware payload (Mirai)", "value": "7e41196b969dd5d75a07126e0c1ad1dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213180, "uuid": "d86d22d5-e90a-4f22-8f1b-d8dfc7f45d6e", "comment": "Malware payload (Mirai)", "value": "5940e5fbcb9f26a53b3ce07017f14152166a172d80123454bc59af5b245d320e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213180, "uuid": "563be508-eb9d-4329-b78d-99d4c392cc85", "comment": "Malware payload (Mirai)", "value": "405c596580ffd100c36b65b7be9c557c1464737a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213180, "uuid": "8ccc19ce-2c98-44dc-a24b-109d53e90608", "comment": "Malware payload (Mirai)", "value": "cec1aba508e1440c3868f06d241de0213679a50e116f44f814a59ae23d193e8df8e140f772d8f391b4c1de9405edeedc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775213180, "uuid": "7413e0aa-3073-4c0c-b37d-4450db6ae190", "value": "T13433011E3F4B7781E1FC38613AB74B5B7B512C168B3C69631948220E99D146A52A83BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775213180, "uuid": "b4bd4f25-4aa9-4f02-9984-1858e61ab70c", "value": "1536:OKK4x2j64QXHj6asyIg+tBjjZ5O9/c9jpR7:OKK4x2+hOasY+TrOtOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775213180, "uuid": "9762bc47-1b9b-42d1-92a1-82ef4d8ca4e0", "value": 52788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775213180, "uuid": "f37eb71d-4888-49dc-9988-124d3c7432ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775213180, "uuid": "f807f5ce-cac4-499f-b506-3e9172e42c2b", "value": "b7576d8652cd115fea15f43cc86c544030324c8a627a452b56cd5a5c770fe3d1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619ae56b-2f97-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775246264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246264, "uuid": "0c9643c7-578a-4004-9658-61b278477be3", "comment": "Malware payload (ValleyRAT)", "value": "87c32afec3d29682d2722c714a3bb4f9", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/Win32.Farfli[Backdoor]", "colour": "#5BCC06", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246264, "uuid": "77bc6aef-1ab5-429a-808c-98ae22f6c30e", "comment": "Malware payload (ValleyRAT)", "value": "59b65b4f5058e38b42ec3fe79c5f05b4c29a61d00ddc6052bbbf074c99f75fef", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/Win32.Farfli[Backdoor]", "colour": "#5BCC06", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246264, "uuid": "bbf237b3-8a41-45c4-b636-de9a555beb16", "comment": "Malware payload (ValleyRAT)", "value": "d7f8b7cc9edd175d578522fe11e50a4279857fc4", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/Win32.Farfli[Backdoor]", "colour": "#5BCC06", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246264, "uuid": "f6cd6a93-8545-41aa-87ac-44a3e572d9af", "comment": "Malware payload (ValleyRAT)", "value": "5086a012d4e2f0628f13f765692993eb89cb087a8321e206ae2b990492d0203f22a286289eff8b053da46c2c2ea58e06", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/Win32.Farfli[Backdoor]", "colour": "#5BCC06", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775246264, "uuid": "f210aa2f-2a07-4788-b5c2-7eb00dbbb9ab", "value": "T11BE4233B7AACA4F2D5B8FCB0143D1201443DEDF2511635CE6A2AB8905D7BB5D1B892CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775246264, "uuid": "a99c571d-2953-4573-9eea-6175e6b4c723", "value": "14f8e4dca31086cd0498de53fcba2af3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775246264, "uuid": "2ca50b60-dbfa-43be-9d84-5771e953d960", "value": "12288:k8P2d1ogmGSkfm9fwT+2WNFxT/mukbJFyFrFGOilTNbLP+LtoSn:K4BpCOxT+7bJFMrFvi9NbCLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775246264, "uuid": "af3437e5-5ef5-4670-a75e-b82fd89ed025", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775246264, "uuid": "b3533d5d-a8ba-4bd7-8559-6fccb69b7b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775246264, "uuid": "d099c48c-4f41-43a5-b296-713e60dc4e2b", "value": "\u4e09\u89d2\u6d32\u548c\u5e73op.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679889e1-2fa9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775254005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254005, "uuid": "29a86813-4f08-4945-ba64-425f21e355c0", "comment": "Malware payload", "value": "8f41b95ea6b13a198e895fcb2070a29c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254005, "uuid": "1096c765-b2da-43a0-bc4e-40c21e6c8662", "comment": "Malware payload", "value": "5c2d6c1df40a89776f6f28869249214d6f4d6e0ef4708b0eff1671bb1ce77933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254005, "uuid": "3f8c0808-0ecf-462f-8cc2-eeb5aeffc629", "comment": "Malware payload", "value": "c2a0c2c3a4f4d20a0f4913ddbb4b52f708400ad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254005, "uuid": "ec35945a-01ae-4803-866f-d5601358c61f", "comment": "Malware payload", "value": "e3d07ce1c1afef8a4a2c586c0031395ba206b2f5b0493031e51758924661c1b0c59479f6118d846a6d7ab7667be76d46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775254005, "uuid": "d7f05869-80b8-43ce-9456-d7f9dc5a3bf2", "value": "T11403AF4BBB0189F5EC1B5138806B965FE7B378252722E7EB63C242151E633E93C37891", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775254005, "uuid": "495a86d2-df20-47ef-9164-d398c293c77d", "value": "dff7a19212a817dee427932e86f694d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775254005, "uuid": "edea8e31-2288-49f0-8ec5-63ad462033c8", "value": "768:CDtAVg+ZwZ/sCKfor1MdS4o8BWPKbKqB+HuATdvrHGV:dCpitpS4oqib+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775254005, "uuid": "3c27b293-24da-4094-850a-8396eb0afd1f", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775254005, "uuid": "24d77092-06e5-43c5-9a3b-a8ce7306a214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775254005, "uuid": "9cbd8564-84b6-426e-a2ef-e6bad7d09a37", "value": "8f41b95ea6b13a198e895fcb2070a29c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d0afdb-2f37-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775205221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205221, "uuid": "be29caf3-42db-4ae8-a454-c06634a59d00", "comment": "Malware payload (ValleyRAT)", "value": "7aef8ede083417478087a61be8d5c63b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205221, "uuid": "0e73f2ce-0249-43ba-bd78-82e7f06b63ec", "comment": "Malware payload (ValleyRAT)", "value": "5c5ec5d6dfd71e58caea479080fa48b5cfa8aba80cb35c7f0418f5006d7076ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205221, "uuid": "d76846ec-7ebd-4636-8e17-9ad04087b383", "comment": "Malware payload (ValleyRAT)", "value": "13e0b5cd59f203d971de5d21936c9c545638192b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205221, "uuid": "21ff4617-621b-4877-b7d4-ffa3923ac226", "comment": "Malware payload (ValleyRAT)", "value": "767ed3ef2986a2024e6fb7a981491162dcc8ee7412b3c6e2930b0a162a6113bc2d3e0bc73870d6a7f18973c161f89670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205221, "uuid": "fe3162d3-aa46-4b3b-a8d5-e7d35af50129", "value": "T1FE36E107F79645E8D47AC23086A3CF71AA34BD5642246A1E39DCFB173F31E609A2A714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205221, "uuid": "e5fad5a3-aa68-48b3-a26a-20865990f54f", "value": "0363771cd8e21bfd79dd31ee715ff57c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205221, "uuid": "14cf214e-b530-4708-abe5-44df21af3df4", "value": "98304:YFYd9DXpuQXnhclmmCNbDXql4dkiTzIHdYz8T71t1AaKFFIUgfEf:YFYnpu27N6l47TzIHd9X1AaQFIUgfEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775205221, "uuid": "887476e3-a23c-446d-939c-740bf53be6dc", "value": 5316656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775205221, "uuid": "861ab0a9-34db-428d-876b-ed1e99e373fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205221, "uuid": "740f0ff9-eec0-4d3f-a937-e20b2f7a7d35", "value": "64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20202cc7-2f7d-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775234988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775234988, "uuid": "5af0a7d1-00d4-4e8a-a43b-11251355174d", "comment": "Malware payload (SpyNote)", "value": "2a4c3f5762557b23edfae7be6edbe2d6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775234988, "uuid": "f3ee7adb-954f-4d72-af1f-3f511dc585e3", "comment": "Malware payload (SpyNote)", "value": "5d4972e846d795b495d70fa054821c53678d2335b6879b4bf9a9116e101a8826", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775234988, "uuid": "75fb52f5-de19-4eef-a7a2-daa24709256e", "comment": "Malware payload (SpyNote)", "value": "a32d50ec358f0eee9aee3d8cc9caf845ce19013d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775234988, "uuid": "5b1e0df0-54c4-42f0-b2b6-aa33c121de51", "comment": "Malware payload (SpyNote)", "value": "13bd6bb3514906b9bc47cad337ed354e26e34141de444165e0d965eafef5e67ae41d470c7c7d0590ed3c19c3e72e9f33", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775234988, "uuid": "450e8267-5fbb-4573-b00b-45270b61502e", "value": "T1CB26F103FB54D68BDAAE83F26F270C9916175F14C692A6D340107A7E2EB76C10DC6ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775234988, "uuid": "7e672b3c-8f0d-452d-ac79-65c8b74e9458", "value": "98304:AT8OFRGW75+bJ8UvBVMyLbGmzozBXTE0t4g98BB:LExQZVMyL9zM33UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775234988, "uuid": "5fb78db0-8a72-4aec-a345-7433b6feaf04", "value": 4591067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775234988, "uuid": "b2ff559f-c3a7-40a6-9ca4-b1fa3ac5ce80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775234988, "uuid": "b2e3e8ad-aa37-4b99-89cb-3cda37163d77", "value": "childapp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b1e325-2f55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775217767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775217767, "uuid": "4ca92fb9-511b-41d4-8a24-1aab1c370740", "comment": "Malware payload", "value": "c6469c9ff76bfd88e09aca1a44fdb1e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775217767, "uuid": "8dc68818-6518-46b0-9381-cb5f2b433b6f", "comment": "Malware payload", "value": "604697c8a05c31f1135e03c625fead61c11e3a1d4c03a7c721b292a196b26a89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775217767, "uuid": "c35f9a3e-da3e-479f-b06d-4f6a1b5aea27", "comment": "Malware payload", "value": "b8eff11b310fa901094581cb040f559fbfca8913", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775217767, "uuid": "8f98637c-f787-404a-8a29-cb2e3a725cf1", "comment": "Malware payload", "value": "6db31f32a483eb9124948c4290c0918bed5a66e3def74ef4260164d81d5de283f60c6c85f28b55ec6c1911dbdba717bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775217767, "uuid": "af317450-b8b2-4700-b918-d625f4c2df19", "value": "T1A1341283F050585EC5EBF1FD667F8233FA30B846923A679F1B02E9701F065656607B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775217767, "uuid": "c620fa4e-0b37-4ff8-837c-294f89247c13", "value": "6144:lnRawWnTQGTVwzg3BTVWPAjwRtRI1GttMyA5kXfrsAJ:qnTXTVKg3BTXwjm1GttMycUfr1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775217767, "uuid": "97045c46-c107-449e-a9ef-ec8a3e6c53a9", "value": 237214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775217767, "uuid": "b0ba4346-8d88-4931-b419-4f8b896466e3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775217767, "uuid": "5278a0e2-cf81-426a-97ba-04a058407530", "value": "ln8cw1ox1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87623b63-2f67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775225712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225712, "uuid": "60a645df-331f-426f-b1c4-555209a2d4ae", "comment": "Malware payload (Mirai)", "value": "e8960c79797069d6e06beee223fe887a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225712, "uuid": "ca52146e-66c1-4994-bffd-e2b5ea30942a", "comment": "Malware payload (Mirai)", "value": "608ae3e738ea063633ebcc68822aad47b57eee8f5b83b6a7300e41c93511288f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225712, "uuid": "959750e7-edea-435d-975b-5cc6abef0250", "comment": "Malware payload (Mirai)", "value": "ddb39ef59b75896c8759c7a123e58246ccc2c7ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225712, "uuid": "e6ec3a43-afe1-4fef-a1d5-1ba4996b3016", "comment": "Malware payload (Mirai)", "value": "c50cf1d39cf4451c409e939bbe40c728a5b10fa8398d70f37aeeb966e02ef9c08e5bb78077f5143a64fafb42a9ef8998", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225712, "uuid": "56250b8f-2829-497e-956e-bd949e7b3d65", "value": "T1DA936AC0F683D4F5EC8705716076E7375B32E0B9202EFA43C3699A72EC91551EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225712, "uuid": "11d3f175-076b-4fc0-84c7-9bf068fda747", "value": "1536:z1QVZayYlK7a0c8mkxgMQez3Pk2mQMwn645hlDOrS8/LHE:zCVZarK79cJkGMQez3Pfewnf5zamQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775225712, "uuid": "4edad58a-00d9-4a5c-97be-f3acb9a30023", "value": 89896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775225712, "uuid": "de3d7b53-7c6a-4d33-bf03-6b03841f7286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225712, "uuid": "24bad9af-9905-4cf7-a3ce-5711de701052", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06df7ee8-2f5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775219913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775219913, "uuid": "90b90280-fdf3-4108-9162-e6945e10a13a", "comment": "Malware payload", "value": "ec60eb2dc0858ce4bd616903cc0f967d", "object_relation": "md5", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775219913, "uuid": "ec4dd9a0-970a-4a66-832f-f29c7d796c25", "comment": "Malware payload", "value": "61cab707c0869212b0ee594da70e668821803db6e9fcb3a3ec8a414dbe80c63e", "object_relation": "sha256", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775219913, "uuid": "69e15691-8e22-4857-8744-02151d507b95", "comment": "Malware payload", "value": "08c31a34fb0a11bf854e46c7e63b206c6925111e", "object_relation": "sha1", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775219913, "uuid": "d54d2cc0-c561-461c-b380-dfdb50b82454", "comment": "Malware payload", "value": "2d21474e6eca441441c368d9ee6cc7f3a0dcd28bded766868784f5d16ab2f95240d5bec45d02cfad0802a33ee8bad62c", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775219913, "uuid": "74adc58d-de4a-4f21-94e4-4f56a22dfd79", "value": "T1C8764807EDA458E9C0AD92348A639553BB617C480B3163D72F90F6283F77BE4ADB9344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775219913, "uuid": "c57931ec-1d76-4abc-b8a0-1c1eb66429dd", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775219913, "uuid": "7993d8d2-27d6-4fa0-9d18-b672bdeaa7c3", "value": "49152:fs92BTUzMQ9VojKVWVw0Cb+rssM2pX1itrOBnPqyCsTmboXkTcrEV5DDXxmKaK18:fsoR2maorQ0R/UTXbpumvBh8huTxEM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775219913, "uuid": "a63071a3-6cb2-4bdb-8fa2-412004d337b5", "value": 7300331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775219913, "uuid": "8c3e7d34-7d14-4a65-883b-bf7bc12db208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775219913, "uuid": "ad9b99b8-ca38-4435-b590-9120e534723e", "value": "AccessWinRAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4872dcf-2f20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775195347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775195347, "uuid": "59fe9161-1e33-4672-8ab3-76557ea4ac80", "comment": "Malware payload", "value": "0e1d5c472c2398902a3313aa6e7d997e", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775195347, "uuid": "d9af4fb1-8cb1-4383-b511-fb3724dbc891", "comment": "Malware payload", "value": "62eb5f17ab59b57daf4270d5bb25ab109f23f13ce8a62f45bc2ee2bb84d5507f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775195347, "uuid": "020ed67e-c696-4e95-9f4f-c2f01721b9d2", "comment": "Malware payload", "value": "942bfefc48a83cac9374c2f7059f171de02fc7e0", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775195347, "uuid": "6d689a72-358a-472b-bef1-3719499b11f2", "comment": "Malware payload", "value": "5fb2749eb0cebb1e260b5b5c0111dbdb045013fb8cb1f276e7f58c4b14a9bd08b82379a3065c609b4267aa300e48ebac", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775195347, "uuid": "ac620e49-3825-4554-9ac8-d54a5b9e2bf2", "value": "T1DC66AFF435586CE7B62F43BBD5662CDD93763633578798C96064B2C20A93235FE2AC08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775195347, "uuid": "4fd28162-443c-4dce-aad0-007fe7999c5c", "value": "7f23935b956b0956d7c547122f9481dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775195347, "uuid": "9892b5b3-a3b1-40c5-a8bf-2b2c1f435df3", "value": "24576:EO352YSXFjHAFu/OUdwqT8TyOaGhVDcCjewj+NwNPEpa3Rh6wckqFe+sjpV2giaz:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775195347, "uuid": "65b2723d-7d5d-4b5d-ae6e-04653c20574d", "value": 6792704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775195347, "uuid": "c3b0466b-3332-42ff-857d-d6ae0251feb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775195347, "uuid": "a3507b08-102e-40d8-af73-ba6ddd12f939", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b370ec36-2faa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775254562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254562, "uuid": "93a5525c-5a03-4afa-bc45-4d800d7fefce", "comment": "Malware payload", "value": "81a0932b5965b1228907d3d4bba6659d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254562, "uuid": "b4644503-071f-4c26-b052-9a40d706dc5f", "comment": "Malware payload", "value": "63d0255437c890a4b13a8e8fb02c3b3edf8f8af3bb08293026076bfe626ef4df", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254562, "uuid": "ffe38e53-e4ae-4351-ac00-c13df0685f61", "comment": "Malware payload", "value": "afc07471fd811b2369f80e23c55746ceaf3f9fd7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254562, "uuid": "cf826dad-0416-4152-9565-b27aa0c5cadb", "comment": "Malware payload", "value": "003556f01dcbc8b08ff977e676ca9a68437f9a420e24e8274a3ec1763aea3111ee260693570dc68136b094a5d8ed3295", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775254562, "uuid": "c27ef2b3-b6d5-463f-a8d8-b5f7c29100dc", "value": "T196E0266485841B96D90625B626C25B318B1BA0D5D9A5D2B72C101EC86E0FB960F47BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775254562, "uuid": "86442351-b3c1-4d74-ac32-287b459bd01f", "value": "6:5jHzD6S/6MKDXu5jtSNH/Wx2jLs/3bwzS9XxIMnJqcUR2bnFHzyv/6MKD0t+lj:5jd/K7Uswxsq3Uz6XxPAR2bn8/Kotaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775254562, "uuid": "37511363-5f7e-4f54-91fc-d5740a2e10a7", "value": 347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775254562, "uuid": "124e335d-7aa1-4ce9-9a71-c4dbae4c74f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775254562, "uuid": "0d8f062d-5531-4266-9a4a-b02762b2c759", "value": "Embarkation_Information.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe87f7ba-2f38-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775205726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205726, "uuid": "d5f5aefb-8886-47b9-ab25-dd9c752e664a", "comment": "Malware payload", "value": "f8e5a1b2cdb2d5a2036a602249ad0934", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205726, "uuid": "32f8ed8a-0755-4eb3-a0ff-169b9b7dbca0", "comment": "Malware payload", "value": "63fa8cd20986bc21a1a54ecb9db2dfe0db9618a3f0917e46d44f64317e7213b8", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205726, "uuid": "ea20d0de-57d2-4cb6-842b-a7ea9c93b3bb", "comment": "Malware payload", "value": "7d27beb658b2b3f347bb55df274ecefd5e485dfd", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205726, "uuid": "8dc376ca-643b-46c6-a335-cd2724a19a27", "comment": "Malware payload", "value": "6197309b040bb6fa150cd3aa5ceaaa05851e412ae61fbacedf462f01664e92c81869ba583a7880da5bf9b2512f1b9371", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205726, "uuid": "6a00aa6e-3009-4eba-8961-419b5e494edd", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205726, "uuid": "6fa63f1c-5f76-4106-ac2a-3115f2e3928d", "value": "3:VSJJFIqF1F65IFbXLdx:s8qF1FZZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775205726, "uuid": "0de9cac1-3ae0-448a-b257-e60f71e82d20", "value": 46, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775205726, "uuid": "87a21295-a9d3-4b81-a2da-8ec5e439e5f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205726, "uuid": "28363e7e-acbb-45c2-900d-02978531c286", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329f9437-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775238025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238025, "uuid": "e0d387f9-88c8-4e26-8f6f-c5e675fed4da", "comment": "Malware payload (Mirai)", "value": "8ae94f118db02016ce07af65dc47e3fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238025, "uuid": "f3be43a7-4196-4c0c-b6c0-31cd3d3cb5ca", "comment": "Malware payload (Mirai)", "value": "64f756e9ec3b4ef50dd9f844a3ecd3fd0ac834eeb29778f702c29f64b50127e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238025, "uuid": "3b690e22-4794-4083-89bd-c53a54310d00", "comment": "Malware payload (Mirai)", "value": "0f6f00a2127cc4f604634da31e8c87fc0495825e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238025, "uuid": "e1788cc6-fbda-451a-9028-30f98fb85ea1", "comment": "Malware payload (Mirai)", "value": "ac89a48e396176f33a0550127bf04538375b2f6db9f0d30f4d0b2a44f2a84777b8c433335c5ea606f199bb7dce2f8965", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238025, "uuid": "5406bb97-7e17-4c63-aeee-9f48f1a05636", "value": "T19773E756BC828E11C5D912BAFA2E118D331267F8E3DFB223DD205B243BC652B0E77955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238025, "uuid": "40c8bfdb-c777-4123-9c23-76a526251011", "value": "1536:bZne60eNg5ZiyUYG3yGi7IbgqlfrchVkjgJFYr93PsbewzrIhiPTb++mKbo:bNAZNUb3y7egwIhVkE4UTb++mKbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775238025, "uuid": "3ab21ddb-e97b-49a4-9a54-67726c2b1d82", "value": 79172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775238025, "uuid": "18a62699-7a6b-489e-8237-ec3057404d52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238025, "uuid": "c9be1119-d154-4a78-836e-45c17f83e462", "value": "yakuza.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f628e2c-2f64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775224410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224410, "uuid": "ca04cf0e-ba14-4409-9937-1c949e304cbf", "comment": "Malware payload", "value": "928d64aecf9a208120259d1ead45a355", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224410, "uuid": "5679c5ab-ff1b-4cf4-ac00-42ea98370b44", "comment": "Malware payload", "value": "65c13bf969ae825fe3ca65cd72a4165d187146a8f9ebbde88e1c15bf0d48c513", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224410, "uuid": "5d966172-caf2-45a1-acc9-bdfa36b57632", "comment": "Malware payload", "value": "6d2d1e6aa3a8cab67132889dafbcbd9178e7240b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224410, "uuid": "6f7f8842-adef-46f8-b6fc-cbb2215e3473", "comment": "Malware payload", "value": "c617a159712a3e7550818ffa24e6050697a59d331c2c2b99c90a6819a8c13f622696fa79733460e1cf1f5b8e6009e4ee", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224410, "uuid": "84f8d534-d6e7-4c56-8b11-27d2cbe28a89", "value": "T14127339FE2D759C87B492685F00812F59422C054AD262D9DB93E41DAA3EB8D9FCC3CD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224410, "uuid": "17b613ba-f683-4abc-912a-39ee34bb4eb0", "value": "393216:bmv1/kWbbuUkzEplQHf6A4wDXkV1nuQfnoStzi0d2AwTNFhUnBxUe5Cw:bM18mplE94qX0tocziohwhvUBxUe55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775224410, "uuid": "95376882-5a9f-41fc-ae2a-5c44ffca40d8", "value": 20825980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775224410, "uuid": "cd03e43a-4eb3-4107-95f1-8183e1655795", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224410, "uuid": "bc8e9a08-b342-4ce4-a6dd-7a1b00497772", "value": "Galaxy.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09db1bdc-2f88-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775239675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239675, "uuid": "c53e8abe-5211-4b81-94b4-64a404e9d4e3", "comment": "Malware payload (SpyNote)", "value": "462acfc29036bd8586f555eadf5754bf", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239675, "uuid": "4577306f-48d6-4823-a2b5-cf2cdf33d471", "comment": "Malware payload (SpyNote)", "value": "678ee44afb89903d3199378f2e6d9de0b4167c23e548bf4d7f863e1545ef912e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239675, "uuid": "f226673c-ea72-4f99-bd79-3e66665fc918", "comment": "Malware payload (SpyNote)", "value": "4304aa6c80e734de710969d001d7d73bc26d67b2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239675, "uuid": "30e90cf4-30b8-4912-96f3-d4dd0da003d8", "comment": "Malware payload (SpyNote)", "value": "657dad0dc5da12bbda7e4afa335bee8e96f86d694bc691c47214432c8622e4e0f4a7ca90b33c1cfe29aa79623a35edda", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239675, "uuid": "275ce87c-848c-4615-b45e-73bf1ef955d9", "value": "T16A36F117FB48CA97D8B983F66B230DA85A170F29C7426BE30464766E3E771D14DC1A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239675, "uuid": "bec9811b-6c5c-411f-9b67-55bf2d7f071d", "value": "98304:ZaBvWjq0ZIfyQMAbIonOtPxPmzQ1zBdTC0tQ+qMwRjK:4dWjq0KqeaezQ1BKNjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775239675, "uuid": "e1efef26-6f17-4eb6-910f-f576b463d90e", "value": 5054398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775239675, "uuid": "94cbeeba-73f1-40f9-b9b1-4989b3875889", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239675, "uuid": "2a32ff7a-384c-43d9-9527-54e73db737a1", "value": "Facebook.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a5dc08-2f5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775220265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775220265, "uuid": "b222f60a-8204-45b2-9f29-cd8b7b585140", "comment": "Malware payload", "value": "c2e55a9a7bace204f133314830d46dcb", "object_relation": "md5", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775220265, "uuid": "e5eff861-e149-4711-bac7-1978c90491e9", "comment": "Malware payload", "value": "69b641635a37fd961410402f8c7e66bd072d51e26f9a6be7d03f185eb344f746", "object_relation": "sha256", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775220265, "uuid": "6b7bd111-3945-42d0-8fa0-626bd56fe068", "comment": "Malware payload", "value": "7a6160dfe6a3913bbabe41a128d896d92bf8b2bb", "object_relation": "sha1", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775220265, "uuid": "4bfe9cc4-697f-4bd9-b1f8-03cbeb6087cc", "comment": "Malware payload", "value": "37753863ff96fc681282b14d7eb54237030c41a8acbdc24096c502cf76297945ef3d9a8c977aaf51442951440216cb8b", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-151-3", "colour": "#A2217F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775220265, "uuid": "df3b1c07-7d57-4b67-87ec-533f5e4528a7", "value": "T10981A657FD012E316A9892A9677D642458A3F03348434C36BACCD85E5F0677CF1E09EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775220265, "uuid": "63355fd0-0ef1-47f8-a867-281ed1b5db64", "value": "96:ckhhFiuC3RWAb8O4jrMT+AOsouzCgTC1AE8oEdC8ey6wTqSbZmQQFM:TmuCg0T4jrKosouhuaVoEbekZmQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775220265, "uuid": "1a803989-6213-4626-92d4-3df404316364", "value": 3987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775220265, "uuid": "1001f447-6179-4f08-bb80-36731890f7af", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775220265, "uuid": "8b5075c1-01ad-42fe-b13e-cb4e8d748ae3", "value": "AccessWinRAR.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176267ea-2fb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775260743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260743, "uuid": "f1051026-b6c9-43ba-b788-fe39bc848e3e", "comment": "Malware payload", "value": "f32ee131937df07cf1b85e5892be8519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260743, "uuid": "2a9ec44f-82aa-43b3-af50-a51175208a04", "comment": "Malware payload", "value": "6b1b90e3b13e160021b61339770c5133fc0403431e173e7d8ed0c98c01638391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260743, "uuid": "4325371d-f844-46a3-aee3-c189c0c5115f", "comment": "Malware payload", "value": "726b491100d610a8368532ec16d6cf54c5dd3327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260743, "uuid": "42a0a31a-83b0-4f82-8326-23ee711e1891", "comment": "Malware payload", "value": "89884ea334414537f2f8c55730daa67bd35aea32762d6fec8f7e7b92cfa4eea2a5dbfeecf313d0fe91140d27fe8bc1c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260743, "uuid": "4af4c6c5-e20d-43d5-85f4-df62c8508e12", "value": "T196E73386B3144318EC2786F1CE9C6ED65F2E714DABF025BEA27AE59DEC00416E7C4631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260743, "uuid": "e3885270-a6e5-49f0-be27-b16e88309380", "value": "7a5e2524b66da5177b4ec46d305a3dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260743, "uuid": "b003b8c4-9bfd-43fd-87e1-6a3e1433245b", "value": "1572864:RLdkKjR/Y0GxK5pOyDjJrnpXI5Dn+rTWzJvf70doe67:R2KVY0dWyDj/X+DncOV70r67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775260743, "uuid": "ac44e542-c34f-4241-8384-b1410fd51f23", "value": 67431210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775260743, "uuid": "a032c6d6-c13d-493f-8f5b-f11739072d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260743, "uuid": "9b477172-8452-495c-b383-b9f373c35a57", "value": "Github_lnstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586a3e8f-2f90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775243243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775243243, "uuid": "6fcf134c-5a32-4f1f-aaba-02cf72496825", "comment": "Malware payload", "value": "a410bc124dc47ee82650d2db6a2f24d9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775243243, "uuid": "16edf884-535f-49aa-a093-953c55ed6fd6", "comment": "Malware payload", "value": "6d06806ccee64d3baa5b9da63019c3ac7a23dfe210747fbdbc048a84196325c5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775243243, "uuid": "531d2ba4-07ec-42b2-aff8-f9d70249474d", "comment": "Malware payload", "value": "1306a4c9fe96e320473c805d8c984b2a08ecf47a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775243243, "uuid": "8ff6a4b2-1246-4931-884d-f205336b1157", "comment": "Malware payload", "value": "51e91ed6814013054233218cc627ed15490e0b223cf78c20e521cbfdd0dc13b745b71a0400eabf85def834a77530e71c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775243243, "uuid": "d91d2bdd-d9fd-460b-b77c-f018793bd554", "value": "T16664235AED08D916D8E61CFD9CB9E40EDEA0336325E9DB0B0F2785152EA71750A3037B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775243243, "uuid": "eca5234c-312b-45e5-b371-7fb66cd11238", "value": "6144:GEwH8ncOF0cRkU/aD2hOF9wTLLTnjfPGJl8FV5QDKhN9CK/SRRh:G/8ncs0g69wTL7uloV5Q+hN4aW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775243243, "uuid": "c1463747-8491-4cbb-b846-07a635aa030a", "value": 307971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775243243, "uuid": "2fd26881-0f73-4ed7-a8f7-d5cf826885d5", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775243243, "uuid": "240d22e9-d440-4170-83d6-af3d262a54bb", "value": "PAZUZU\ud83d\ude4f\ud83d\ude4f\ud83d\ude4f\ud83d\ude4f.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41de68f5-2f9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775247500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247500, "uuid": "efc62cbc-5cc7-4c31-b87c-bb390eca1cb7", "comment": "Malware payload", "value": "47f65650ad1a22539c33dd6605fdac45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247500, "uuid": "ede0b3d7-6f8a-4c43-a617-a0adcd2dfe18", "comment": "Malware payload", "value": "6ef76a6dae246d7956eb401f621034f1ec14ac7721cbd6175e50f2b715ab789d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247500, "uuid": "2991209a-1ec3-445c-9e9b-edfef0621c8a", "comment": "Malware payload", "value": "e045e3dcf545f58bb1b063f04365525355b6a0c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247500, "uuid": "6cdb40b1-c4ec-42e8-a099-e885d63bcabf", "comment": "Malware payload", "value": "571a1c69419c3e02b02b3e62cd69d5f8e8c211a64be8e926b354b0c01b4ab5b2fd5944588cfd98e128372b02f2414441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247500, "uuid": "b83a5b80-9b8b-4c2f-90d8-ef12b1578449", "value": "T1897533E99C5AE1B0EE62E2BC74BA322046C024235912DEF553D8D53B0F7E745E82DF91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247500, "uuid": "d8dabae0-fa03-47f8-b790-db7aad7d3b26", "value": "5866281e215e3423206a9a3f2dd81b7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247500, "uuid": "86aff2a4-7385-4eea-911d-cfa3643f29e2", "value": "24576:ItnDqJk/7SWplFZtQs8TfQD5RqJojuc7sIZMAmSRNB4AmXx1WMc99zyKZiGuwj:wV/+WpQ9fQDPitcoIZMAmWvbAQM2zyro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775247500, "uuid": "c61dd4f2-3791-4a2d-866f-744ff88ccec6", "value": 1659008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775247500, "uuid": "c6cff123-d88d-4af3-a27d-9f77e4787221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247500, "uuid": "32e0db14-12a7-48d6-8422-6c5c9a67ad78", "value": "tntybj7p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60303b3b-2f64-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1775224358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224358, "uuid": "9f1e73ee-0e97-43a5-a74f-79f798fabb11", "comment": "Malware payload (ScarfaceStealer)", "value": "03e539cd0206dc751d143bf2ed806295", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224358, "uuid": "48045a62-ad32-47a5-8985-65a948a7fe77", "comment": "Malware payload (ScarfaceStealer)", "value": "706f044dae810939a637a2144c2714f2899affe4649e8297ffb66d808e54ae76", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224358, "uuid": "ac055102-e688-468a-aa2e-19fc5c71e62b", "comment": "Malware payload (ScarfaceStealer)", "value": "65e7852ca147d2901afe15e0d5a5b6e1ec3f58b6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224358, "uuid": "264332c2-ecd3-49ef-988c-f48b6f9cc6ea", "comment": "Malware payload (ScarfaceStealer)", "value": "00a29f151f7f531f49313d6be19a72f946e7ad720c19304ed9fbc0fa984dcb5d3769597687e6fdb480587e1d263a9e7d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224358, "uuid": "53eba0bc-4f2f-4061-b44d-8e4438ffa8e1", "value": "T1104733278647B60FC8A45771B8AC42F854A7DFC53870D234D2BBEE1426A23597670E3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224358, "uuid": "5ed62f88-fdf5-46fc-ba7d-8456153abbbd", "value": "393216:aUIzPjpJlhyzWSsbP3J+jCNBngkpE2LsAjTzebaiPXZp9DJdvjy2PHjAT1OWFq9E:aUIzP/lhz7bP3cqtE2QAnk9FRjy8A4Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775224358, "uuid": "fca1b6d0-3b1f-482e-9175-7b2db5527485", "value": 24690392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775224358, "uuid": "3a54dc7a-a9fa-41e8-9654-b258ce563d9f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224358, "uuid": "96cbf9ef-5157-41ab-a452-ca59769373ce", "value": "s\u0435t.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a813d398-2f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775226626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226626, "uuid": "f98a5c77-ed37-4f63-9f72-ce5d2c1b42c0", "comment": "Malware payload", "value": "d132e79a070fdca45de15cc502edbc6f", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226626, "uuid": "21acc6ff-86ad-4c3b-b0d3-68c149e4dc5e", "comment": "Malware payload", "value": "70ec84b5e252557f7f7ee7fb362d0d1f40569385185ac48b6adbce81a2d58a3e", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226626, "uuid": "669372f7-cd23-4ce6-afd5-0b0c0788a0f0", "comment": "Malware payload", "value": "2d18e4bff51eedc291595ea36d5f5e53f97ba297", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226626, "uuid": "f5a33d9b-60d7-4caf-b86a-eda278f63078", "comment": "Malware payload", "value": "0e0ca9294821d826ebc440b028825ee9970d5b7060b5a1ad481d916ae8e41d456af50dea77272bd9736302f06db178a1", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226626, "uuid": "71aa0305-f220-46b9-b7ce-62e655b7b42c", "value": "T14E25232E4EB1AC770BCB5D1AE9215945A3947E5FABE10639933FF4C0ACEC6235301789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226626, "uuid": "d3cba45f-fbe1-4181-9d57-56a5b6f73938", "value": "24576:zEsPIpGQj1plkPRNgNMJs/onjvBUtogJphVmp521ApxvdFKWGi7jg:upFj1iRNgNMJs/iVUtNJph0a1Ivd0WGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775226626, "uuid": "dd04ead0-819e-4cd5-b350-dfb31f283ff4", "value": 1053543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775226626, "uuid": "7e9e40d7-3893-4eee-b255-bb6375e439e1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226626, "uuid": "954ef571-b19c-4055-a4fd-5c5786ca9252", "value": "nNew_PO__28_14377.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65179d9-2f78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775233173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233173, "uuid": "2a13bbec-0170-4f63-a16c-7849ee1eeebb", "comment": "Malware payload", "value": "e9bec2b2ced826df2b294d18f50fcbf4", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233173, "uuid": "d8e85878-f8b5-478b-9981-55d882cfe94a", "comment": "Malware payload", "value": "72ccec2734d6dfc44ae0937c1fbefea6b7b41027f5e5184e843bb8b6e6e3970f", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233173, "uuid": "8de6b116-68e8-491b-9f0a-b681688cb9f1", "comment": "Malware payload", "value": "89cb943bf417c0d90a02ca1d2290ec80280e48a6", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233173, "uuid": "5f71c60b-0b38-4f9d-97fd-81857354dc0f", "comment": "Malware payload", "value": "0be82f5be64554a64e5f7d2ae17a8cbbd4fc545bb8e8582599a6dbb2e3903a24dae8e601e22afab02e056e59e0ebcdc9", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233173, "uuid": "ed115752-e703-4ffc-9656-6df0f1cf25bf", "value": "T1DF3384F06A51D5C1B1BD5B6AF3E8B908A1343637EACD1E4A0178665C2EF6A01FD0DCC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233173, "uuid": "b2380b22-4a13-4ed7-b7dc-8cba0216240e", "value": "1536:SvuRp56S1yOie5vIyGUb8FdFv7WQ3WUBy/4Kxk/H:SRzTWeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233173, "uuid": "66fa3883-ab97-4fbd-bb8f-f186f04ac505", "value": 53174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233173, "uuid": "f7a9c38f-9d44-451d-9c86-cc7e2a637850", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233173, "uuid": "ab97ae5c-1aa0-4ac2-9aa2-8d2b33292953", "value": "webshell-wpvivid.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193d8757-2f8c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775241419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241419, "uuid": "cc263e23-c217-40b6-a8b3-196d5a9c4bfa", "comment": "Malware payload (AsyncRAT)", "value": "3c917ae51b7fc6b4ba771e898ff0da1b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241419, "uuid": "b06983ff-2c08-4401-9731-dd91d08a58eb", "comment": "Malware payload (AsyncRAT)", "value": "741508351f8b822d9ce3ecd6d380ac5a37b598b7114c3db5e77a2bacd709c7c8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241419, "uuid": "17066086-5f4f-4afe-ba82-24e040e311e5", "comment": "Malware payload (AsyncRAT)", "value": "91ce5241fe59e90647c080e0480dcdb69767e405", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241419, "uuid": "2fd30363-70c1-4dec-a52d-caccd70033bf", "comment": "Malware payload (AsyncRAT)", "value": "b5a57619d5b6c6d81130d2d69895091f3f1c43f358ab10b85bc3a743bde36309f0e8214bdac9e63f10799e207c4fa95c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241419, "uuid": "79595963-b424-4c94-871c-c590d45f42a3", "value": "T192F23A09F7904355D9EEAFF169B361090235E60BC913EB5E0CE885DA2F27AC0CD127E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241419, "uuid": "9775ea28-2baa-498b-ba6c-b6ffe481714e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241419, "uuid": "4070a4c6-a7a1-4fff-affe-5fe217ffacb4", "value": "768:JCi+xDG2sVXxiU7g8V9Fp9jpRRXOjh//Wx:J1+xDG2qJ1zFp9jpbXOjRex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775241419, "uuid": "8f7474c6-e7c6-42ff-9a4f-02cc1cb51176", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775241419, "uuid": "4c39ea3a-097d-4df6-8911-cd6a1ca895a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241419, "uuid": "4fdc9788-31ea-482f-b404-231a1a259d96", "value": "XWormClientddddddd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c7a1cc-2f40-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1775208910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775208910, "uuid": "4d928d27-72b7-42bf-8ccf-29e2e84dabfe", "comment": "Malware payload (DarkTortilla)", "value": "3b9ed3e8ff3d78eb830a0b1b1ddce8c6", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775208910, "uuid": "d16fe6be-f9a1-4470-b37e-8de82dba1a76", "comment": "Malware payload (DarkTortilla)", "value": "7754fc3ae79dd10fdb5f3a04251eb2e87ecf281597c058b27ae852083cf71ab4", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775208910, "uuid": "e5059b50-bbad-4c68-9f84-e195b4fa1906", "comment": "Malware payload (DarkTortilla)", "value": "6cdd5534239367863740c493e219129208c8ea63", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775208910, "uuid": "87d2ee79-c0fb-43dc-b0b4-6f485d37581f", "comment": "Malware payload (DarkTortilla)", "value": "9b40b5a707710673b872a0525ed4c9e3dcbfe9758a16fbd1cedc131d861b1f7e8ba476b799b6181c1652987c85664054", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775208910, "uuid": "df116f61-d587-4737-8ec2-120b414cf8cf", "value": "T1E285F1055F462F89E1AE0F7DC0522855B3F4C44372E6D29A3FF9A0B62E93FC5DA16290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775208910, "uuid": "7a1d4b1f-de83-4658-88dd-f6062732f2c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775208910, "uuid": "cd9d4596-e073-4a96-ab38-805606bba4fb", "value": "24576:Em/bxnqVz78GIEJ68eR0/eS9BrVXqI+aRb:EmTxnqVzINS/pVaI/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775208910, "uuid": "2c87bdaa-694e-4389-9a86-71098e4c6d41", "value": 1855488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775208910, "uuid": "2fc0dada-aeea-43e7-b046-53565152cf0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775208910, "uuid": "64b09186-667f-44a2-af3c-f8905719824f", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9937626e-2f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775245928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775245928, "uuid": "62947361-3092-4abc-b400-51116eb23c9c", "comment": "Malware payload", "value": "2c46d9feeb80a3e03281a754ae2eca51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775245928, "uuid": "2a5ccc7d-a6ec-4abb-b513-79e8f6e72419", "comment": "Malware payload", "value": "777879027fbff0c83199938c8701e8553a0ead748b9c4a7687e06a6bd654817e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775245928, "uuid": "c95188ce-51c3-4f0a-a6af-363efdbe7e31", "comment": "Malware payload", "value": "83819b840ae7989f91491a5f53c5281a45b1dbaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775245928, "uuid": "4a360d8f-b21c-4a92-a152-9b50ea495945", "comment": "Malware payload", "value": "c7ffc320f84e860e7b3aba727afc2689ad85aa824dbb774320609c76078e00b8afd4ce0d8b3344f74b62e7338765cb2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775245928, "uuid": "8dd6e0fb-cc5b-4e87-992a-8a4d9390f1d9", "value": "T17AA4384EEAC418B3EC41807F8D334652A7B16C5B3360C25971A8B069BF7FB844A7D56E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775245928, "uuid": "ab8fcb91-18a3-4961-b4b9-7b3986103a90", "value": "e113244a5e3463d8dc4096b5bad9f067", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775245928, "uuid": "57aad81a-720c-493d-92f6-88e59a5af24b", "value": "6144:xv1SU6FxF1TOtImcfW2uG3yTMwdAoCXT2s6PltfYp3XJn5pI/ZM5B9SI7r:xtR6bF1T2cmPVxtfUNAI7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775245928, "uuid": "33a09371-d871-4a41-94ea-247386bb5a94", "value": 472984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775245928, "uuid": "bfd567d5-457e-4ca5-82f6-2f92936f1790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775245928, "uuid": "b0bbfcf1-c6af-42e1-a1f8-b675a040810b", "value": "cmdres.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d91b176-2fb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775259894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259894, "uuid": "53b4f2f7-73b0-4ffd-befc-353db06b3ee8", "comment": "Malware payload", "value": "c843abd26a223765dd8ed99d4b677520", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-6018", "colour": "#020EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259894, "uuid": "a51de7e2-e174-4f79-ab11-6d0751f55827", "comment": "Malware payload", "value": "77c723bd33028739522fc2cffa5b1c2cdf9c08993fd09810907577c28714c712", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-6018", "colour": "#020EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259894, "uuid": "6298055a-3bf1-482a-a89b-28ba904cea2f", "comment": "Malware payload", "value": "3948c7694841147a26b8d029a5651db6f96d44b2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-6018", "colour": "#020EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259894, "uuid": "fe776a5c-6a68-47eb-b191-b123373f7c58", "comment": "Malware payload", "value": "5bb06a024315827a0c34bb6b07ef6b495e6e55b11bcc71871701833e5d5eecc1a010261657045e3c470a2e2d0c987daf", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-6018", "colour": "#020EF9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259894, "uuid": "e5bca7c5-dbe5-4e1e-80d3-4a99f2d793d3", "value": "T112073310ECB0C6DA6BCB5432AC77C5C7A731A59B8409E6A5BF60F4A900DC65250DBFF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259894, "uuid": "1e93133a-d0c9-4352-acc5-c99b2d663313", "value": "393216:Nf4RzSeFyH2fm1xD4CO5qWdhTpyLshOaTUOlB0tWVonSxdbAgkeHolz:Nf4ReeFyWfm1JO5bpmsdIOktWVzbXkEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775259894, "uuid": "f4d49eeb-4b17-4f56-aa7c-20b4a07b0535", "value": 17084339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775259894, "uuid": "2e6b3242-a507-4e6c-b654-bead8d9ea6d8", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259894, "uuid": "bbbe7c94-f87c-4c64-993e-38234ae25dfb", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621df226-2f8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775241111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241111, "uuid": "bcb01837-2cd6-4b3f-8ef4-ed2e806296b9", "comment": "Malware payload", "value": "672f783d7b81a0337160630593c145f2", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241111, "uuid": "67eb543f-edc5-4818-a9a4-bf94f7ca200a", "comment": "Malware payload", "value": "78bce4dbf9353aa8ae56ca337525186d17c39b59baba1e0b5589dd5466aaa2b4", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241111, "uuid": "64fcdd14-a4bb-4e41-b5f0-8255abcf098b", "comment": "Malware payload", "value": "ebcf46b911c0472abea3f09c7f7e9c2a1278bbdc", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241111, "uuid": "c35a6a41-eaba-47ae-b9d3-d4c4cbeab436", "comment": "Malware payload", "value": "79e7ceb1e82ae3937f3ec1cf701348e47503c8ec1c9c4895d18aae7b8edb60d9e809f3fbd82c6bd2c4e6bd70bc17d125", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241111, "uuid": "a1a9e747-5eee-4731-816f-3ee8e4ca9f8c", "value": "T1FF85494BBC9409FAC4AA92318D7661927B71BC490F3123D73A90B33D2F726E06DB9754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241111, "uuid": "f983d532-1db0-4a81-825f-5d124cf89b6d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241111, "uuid": "7cc26ab7-5e99-4d47-acca-bf789627408f", "value": "24576:O0o8uVD5CDGCS8H/6+uwsUUFcBzlBeleX7KDg77VbIWjZun:O0H25Ci8Hzuws3cHX4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775241111, "uuid": "b662c177-3075-4e23-8c60-59e96fcf0ceb", "value": 1820160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775241111, "uuid": "cfc3c8d1-104f-4048-a35d-23deef84b0ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241111, "uuid": "a6748046-ccf1-4d6d-99d2-fbd9429a6029", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef33b1d3-2ef0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775174776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174776, "uuid": "ff593881-c399-4a01-ba96-cc6a151dd3ec", "comment": "Malware payload", "value": "4e81fc0f295c744300f7ba0880e778e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174776, "uuid": "e85496c9-a78b-49f4-baaf-9142d77828a8", "comment": "Malware payload", "value": "798dbfdbdd49ed89de9ee9d5a2e336fc89b331cd79cf6a2f244bdd629b8e7415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174776, "uuid": "221cf713-77ef-4220-ade2-25dd370342f1", "comment": "Malware payload", "value": "a893ae2dd80ad20f392ea706c6ea12d7a02d8c91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174776, "uuid": "afb2d3b3-bb3d-451c-9b72-b4119ce3d8d0", "comment": "Malware payload", "value": "2bc95fc3890e69f7c32f305301fe2e78763989a115e8b6f29b964bd9875bba7a0aaff5af39195858562f4b45a9b25a2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174776, "uuid": "cd08b190-d15b-4291-87b8-cc7d88e9c1f4", "value": "T1F8069D03B29501DCC476D138CA479767E3723858273297EB23D49A66AF63AF41E3BB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174776, "uuid": "1fc27139-0520-418c-a3fc-2fb21fc77e8d", "value": "80760d641cafadf08b0328d3759ae3a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174776, "uuid": "59ffeac5-3bd1-440d-818c-8de028e4edee", "value": "49152:bPNXQONaEcRFxmDgKLTq1PmBUuwqR2u4esBeKYBuqCsbHgRMzxSKSIOmd4TNTSN2:bE89ATSuLGx4mlcEghpQ3TY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775174776, "uuid": "c88eccfe-f829-4f1e-84e7-0b63b54759e9", "value": 3910656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775174776, "uuid": "bc14bfd9-a55a-4cf0-89d2-b1b195f0a42d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174776, "uuid": "cbc43c8b-a687-4833-a6fe-5dc9884f26cb", "value": "Valex_External (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ba0421-2f79-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775233489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233489, "uuid": "2d11f029-48ad-4ac1-91a4-4460c6dde974", "comment": "Malware payload (SpyNote)", "value": "20419474effd507ba2dc44b97d961d01", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233489, "uuid": "fb246532-dfae-4eb6-bdb1-5ffbe86cd10e", "comment": "Malware payload (SpyNote)", "value": "79f56edc1bb111c0323762dc0c25d9c50c9a62ec4dedc2cf2e0c2010e518b6b4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233489, "uuid": "525ac952-82f9-4569-acea-25e8441dbed2", "comment": "Malware payload (SpyNote)", "value": "a6d4c72b0b8571e7727c3aab676c01bc19f6e1e8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233489, "uuid": "731e6980-26e5-45d8-a99f-e0c22ecb97fa", "comment": "Malware payload (SpyNote)", "value": "ad2018cc7a689083c5449f479474d8c4073999296e9be7de2a50c9284bd64cc9760ce0640ddd2a56c7caf3040e9e261c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233489, "uuid": "e75bb4bd-eb0f-4788-9250-579d74cb0b2d", "value": "T19236F103FB89CA8BD8AE83F26F670DE919175F14CA42A6D74444366E2E771C10ED5E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233489, "uuid": "f6ef150f-b315-4d2e-8abc-a2f1c6d07484", "value": "98304:twP3fPqQYlrOp1YPK8NjIjVASsv4mzMIzBVTN0tQpkhPq93:taq/SgVYSvHzMOCskhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233489, "uuid": "e9b94cbc-2a3c-4402-9024-5a13df913dd4", "value": 5050025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233489, "uuid": "b6a9ae37-8c46-4c69-bdcf-e3728569cb57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233489, "uuid": "88689f6f-f16f-4602-bfb2-7fef0b01bfb3", "value": "MY GOGOGO 70.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed12413-2f69-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775226771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226771, "uuid": "578885a6-4665-4587-9d4b-bd6b91de24f5", "comment": "Malware payload (Smoke Loader)", "value": "a3c9b09adda67d1abd8b1b51b85a6e0b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226771, "uuid": "02fce31b-0d97-42f7-a6fa-a39b9fe86066", "comment": "Malware payload (Smoke Loader)", "value": "7b56f314650a2b9042ad6cad383b71ba9d2a9cddb5edfc73d2100bb47c809786", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226771, "uuid": "e788c26d-ce67-4348-b8e4-7a6dfe504c3c", "comment": "Malware payload (Smoke Loader)", "value": "21f0988bc8bc8c4c0c712844eb18776600fc11a2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226771, "uuid": "84fc2c26-eff2-4b18-b14d-0cedddd1b048", "comment": "Malware payload (Smoke Loader)", "value": "89ae4a52cf974c9bc45ca6fdb99a2ea7512e44b021f3f83ca08bd48099c5bab3b30da2884465afbea2785cdf833d0c68", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226771, "uuid": "8bdff2d8-d2d5-4ac3-a04a-16f7267911b6", "value": "T16C95124226B78CA7E1BD13B0C492C67413B1FD985276C79B23E56C2BB952F43383A749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226771, "uuid": "6e9330c8-5a8b-4d87-8729-464254df715d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226771, "uuid": "1e3a3278-8f0b-46de-99f3-6dd559abf031", "value": "24576:zrbH5VAFcx6bH5VAFcxxfLfhcafYYA9F49oEhbPOnJQ2AZeCf0AIbkLqkw:bZVGcqZVGc7Dx5AFIBCJmf0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775226771, "uuid": "d4cf1ae4-3133-46d2-84c5-ea9c08fa57f2", "value": 1993216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775226771, "uuid": "1188f5d7-e93a-412a-a7e9-8e3e17b06240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226771, "uuid": "d3a5b29f-5d63-4fb1-b62c-a67a5287c843", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e759d1-2ef4-11f1-a769-42010a9c0008", "comment": "Malware payload (MillenuimRAT)", "timestamp": 1775176376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176376, "uuid": "2a0b74cb-0b76-4080-b633-7f28a34ffa7d", "comment": "Malware payload (MillenuimRAT)", "value": "0d561984c1f7358adaedf9ddb661f07e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176376, "uuid": "6e27bd45-e0f6-4334-a667-85dda82396a5", "comment": "Malware payload (MillenuimRAT)", "value": "7c52867f025f47deb82cc3eb92588e0081e2bf7a2d463f1406a92f93286d6a3f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176376, "uuid": "834756d7-010b-459c-9d3b-dc0de1641614", "comment": "Malware payload (MillenuimRAT)", "value": "e00910f63213658674baed1d2061f5095e1e88e2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176376, "uuid": "9efd0c9a-4a5e-449f-aa03-66783ea01593", "comment": "Malware payload (MillenuimRAT)", "value": "5b3ace754f031dcaf645beac9cdb160507ff997bd5c8531873f23731866a01cdc48bb27f30f0e6f6a374a4d44d845165", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775176376, "uuid": "0e0bca66-15bc-4842-b16a-fce2db90256f", "value": "T146753373DEDD4E4CEBA5F07E1270E86EF213A9860F26D9560BEE112CF51F219470A606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775176376, "uuid": "d9b7b930-b4dd-435b-b112-f6dbba18acf5", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775176376, "uuid": "0d1abe0f-cf3a-4018-ad46-f38539e825f3", "value": "49152:jWrMrM6W0LM4NuWPjqSzEphGr46HfI+gHncSbh:js1754N1PTzAQdHfI+g8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775176376, "uuid": "b5dd1c6c-679a-46bb-875d-175dad647b32", "value": 1652224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775176376, "uuid": "5f285deb-3cbc-4087-9fc3-82a6acb32211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775176376, "uuid": "85c81a27-d6c5-44b9-a0b9-9850c4627d09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8d7dea-2f13-11f1-a769-42010a9c0008", "comment": "Malware payload (GenesisStealer)", "timestamp": 1775189702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775189702, "uuid": "7c557855-98f1-4ff3-b777-6b92eb22521c", "comment": "Malware payload (GenesisStealer)", "value": "043d508322eb1140a339474999e8bf74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775189702, "uuid": "e7803aa6-5750-4e66-a792-8ad4aa3253f8", "comment": "Malware payload (GenesisStealer)", "value": "7d979e19ebb28eb9e3c473dc130288526f950afea202b4ecaaaa74683c8c4758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775189702, "uuid": "3506f59d-86b4-480c-8a40-f21f8656fd49", "comment": "Malware payload (GenesisStealer)", "value": "a094ccf00d569fcec678f5536f51f53de2fe4ed8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775189702, "uuid": "13754eba-a0c0-4605-b169-259f5099f3fb", "comment": "Malware payload (GenesisStealer)", "value": "07c5b053b66b089620c663fd56b402b0c36e974ee2c543e84ffd9da3f73445373ad867c670ab10917027aff58567b9d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775189702, "uuid": "21f39542-e802-4668-a937-16d9d05d0003", "value": "T1B218332A1FA8DA2BE45EB1B741F907B84D1268832D51FB3F133DD05DB1E87609539A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775189702, "uuid": "0d48c201-c558-4195-a806-b6a864cfd60f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775189702, "uuid": "d3262615-c3e8-4465-8d69-399a0936fe74", "value": "1572864:VC+BWMFDe45ktnNCca6hDRVOHsmwNxjUKxjpW3e63DO2KlK2XqP7B7x:VDBFle45UhDRVqwNFUwpW3bDO2K0dVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775189702, "uuid": "f24822d0-de15-4af5-9c57-876bb13fe200", "value": 88077250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775189702, "uuid": "424a0588-9546-4569-ac3b-86652a3d2fca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775189702, "uuid": "7932aeff-df77-4112-bf50-64075ee3c80b", "value": "MClient-Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b73757a-2f29-11f1-a769-42010a9c0008", "comment": "Malware payload (Hydra)", "timestamp": 1775198983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775198983, "uuid": "76a58e57-6f1a-42a4-ad34-0b5dcfbcecac", "comment": "Malware payload (Hydra)", "value": "fe30b3542e7220a71945d7cc18bfe820", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775198983, "uuid": "f8ee8aaa-039c-436f-b8dd-61d82bd93bf8", "comment": "Malware payload (Hydra)", "value": "810926f89430144fd258ed4a95f1d77215f657a4e7dac2ce0c410bcffbdca99e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775198983, "uuid": "8b3f91d9-f1e1-4733-ab06-03d102275528", "comment": "Malware payload (Hydra)", "value": "77c0e6b91ea6488bd88aad145363f57115f69e4a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775198983, "uuid": "43383934-dd65-4f15-8172-cce99266cc90", "comment": "Malware payload (Hydra)", "value": "deb50e169674fb1cf13eebe57d928ce5cace8f4d1bc5e0b1f5163d6f3c06c8ff56902644b1d86ed56a5f65b6039ffad2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775198983, "uuid": "29fb0fdb-068a-4544-81ca-104ca3adae34", "value": "T1A6562387E385A827E8F6C33D927A42A789069C268B03D743199173BD4CB76CC4E55F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775198983, "uuid": "9020bf2a-dc61-4f4c-9e5f-c30082238eb0", "value": "196608:c48ZHR5wquT2+2QnK5iyZ1D6o+KpJuDBTJiX5c2:b8RRyqQnKJZQTEJAt0G2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775198983, "uuid": "8ad34da5-1a11-4f97-8d85-a83167a4dff4", "value": 6453112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775198983, "uuid": "3361c7ff-a5ba-4dbf-93b3-6f3c9ff33043", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775198983, "uuid": "f9af8cb2-c163-4861-a83d-07c4f5ca8590", "value": "Play_Store.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ccf9e7-2f65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775224686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224686, "uuid": "66b16155-e7d1-49c9-9648-dbe0a89b9ba3", "comment": "Malware payload (Mirai)", "value": "40d7f5480d1462f331cfe9a3c50cc41f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224686, "uuid": "58bfb501-6fb3-44ac-8e2b-b9ee6ca47d74", "comment": "Malware payload (Mirai)", "value": "826536353e28abcbbb992cfd874830dee6f9ffe94ccbb1c65ea4d57800710458", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224686, "uuid": "8f2a186d-a3ff-4505-9a32-df1c5a9aebbe", "comment": "Malware payload (Mirai)", "value": "0940ed5f7d821c7951504d20ac70131ba14bed61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224686, "uuid": "1e1b5712-16f8-4e76-ac5c-52ca1b0cc12b", "comment": "Malware payload (Mirai)", "value": "56857a744d8ae01e6fb7d5b311a439b1045d23527a560478752ef24966f6eff95fdb91911e388fd795e9e0ea4acc0ac9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224686, "uuid": "ba29be0c-7f1f-4778-a8d2-ac1ea4c0a031", "value": "T1D8440A0ABB510FF7D8ABCF3702EA0711248DE81727662B367638E978B64A54F15D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224686, "uuid": "4fad0aae-7e89-4efb-8c86-b88a128618bd", "value": "6144:3lvLz7b70YnnOKiDGi/W/wMqtZgOnxGh4nWmfrvZDmBAVp9QZr:tn/gWLCZgOxGh4nWmfrvZDmBAVp9QZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775224686, "uuid": "da977772-beeb-44cc-9b43-0458fc4917f9", "value": 274546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775224686, "uuid": "a1c10512-53c7-4e96-a8c9-13b62ef3b77b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224686, "uuid": "ed0aa6c8-6176-427b-ac6a-6b9e3f6fd2e9", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0a81d8-2f82-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775237152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237152, "uuid": "bcb9eb48-d060-455f-a81c-b09ffe4e7041", "comment": "Malware payload (SpyNote)", "value": "b4f7cb0debaa4f5d735b883956f9e19f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237152, "uuid": "eea3a46f-f47e-4ed1-b675-7f46f664add6", "comment": "Malware payload (SpyNote)", "value": "828a8180829f047507ad1052f14633cd9d4908037cf49c1d8b3c9799acce170d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237152, "uuid": "bb5cc867-09c3-49c9-aaa0-f96c30e857f8", "comment": "Malware payload (SpyNote)", "value": "6760c2a2cd647b5a9619815f8981444c3d50752a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237152, "uuid": "62300671-d2bf-4499-84c5-33d36d962a05", "comment": "Malware payload (SpyNote)", "value": "31281791955e712c48c89c2525856fbc52277b3a9a1fec0e86039deb2859a53e5e70d51441df52269f6b71d2bf48c729", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237152, "uuid": "ed0408f6-941d-4665-afa5-5463ab8ca954", "value": "T1F726F103EB58D68BDAAE83F26F270C9915175F15C692B6D744147A3E2EB72C10DC2ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237152, "uuid": "73a706af-e99f-427d-9648-7dbc876363e6", "value": "98304:UIT8OFRGW75+bJ8UvBVMyLb2mztzB2TK0toUuWo:UzExQZVMyLdzWp3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237152, "uuid": "4772758e-bee7-40ae-af0d-6a3553859820", "value": 4578771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237152, "uuid": "a583773a-b3d6-4bf5-9083-b5456a104b26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237152, "uuid": "6558e39f-103a-484f-ae6c-bc12a1f24058", "value": "childapp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc30cad-2f8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1775242852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242852, "uuid": "b1969650-08d9-48a9-a749-c7af9c9aac60", "comment": "Malware payload (Amadey)", "value": "e86aa80887267b908c3ce38f8ccfaf3a", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242852, "uuid": "32319215-7724-4636-aa30-db3bbcddde62", "comment": "Malware payload (Amadey)", "value": "8336adc553a0125327261148e748e1143d1d82a185046949fcc5a153eb8ba925", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242852, "uuid": "d93df3b1-beca-47f4-82f3-1b3a0deb1482", "comment": "Malware payload (Amadey)", "value": "1d5d2989a8e60ba0ae1d4a97d67de48257c41733", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242852, "uuid": "f8b1d6e4-9f66-4c21-af82-884daee5ec49", "comment": "Malware payload (Amadey)", "value": "edd9d777e0d409995216c2a2747e3876e526373b71378dcc719e3c76d0bc2dc1e16f4140b858f9fb4d047f841334a391", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242852, "uuid": "6a2ad382-bb87-4211-98ff-be30fdf5b028", "value": "T124358D16B941C071D49411706269BBF2593CAA35672144DBFBD02EF2AD305F3BE3AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242852, "uuid": "0904e35a-04da-481a-b703-394206a2d8e6", "value": "a252cd53ebc44617e8418747345d10c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242852, "uuid": "5ed0f034-c1c5-4b9b-aa70-d72e32810d2c", "value": "24576:fLCrua2InCFeiwzFJEUoBmeQSM8FSUjzHJI+v:f+ruaRnC0iwzFXSFDJI+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775242852, "uuid": "f67dec1c-1d21-4933-b239-26820a84fc3f", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775242852, "uuid": "19444c03-f2ae-4f14-9e31-559bf7a62a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242852, "uuid": "3ecea49b-95aa-4fb4-b9ff-5e3d2b740900", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbc6e5d-2f67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775225723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225723, "uuid": "dda12e96-c48f-4eeb-b1aa-5573c42a52c8", "comment": "Malware payload (Mirai)", "value": "af4dd17c89ab04633e04ba531cccfb38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225723, "uuid": "2a703322-d11e-4a94-ae5b-a7c95fe2a7ef", "comment": "Malware payload (Mirai)", "value": "83e7e3e8a8d8514ea24c9083df68acb5b7e6be3ca259c95d33bb31f9d5aaec2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225723, "uuid": "a50c73b0-ff83-403d-aba0-46a401f2d00d", "comment": "Malware payload (Mirai)", "value": "5a25f5f30db57b85ae6f9e737c5448ea31c3fb8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225723, "uuid": "a282a04f-d596-421d-8c13-ef3b183322a3", "comment": "Malware payload (Mirai)", "value": "243e2cfe0229bab1355523b3d0a7d53701ac0f299b894bbe4bd82b2bbdc3dc9a892848ded9920fd1166fdcf6308e0cf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225723, "uuid": "170d2890-0a3a-4b99-a4cd-7fce1df51cb5", "value": "T1FBE32AD7F800DEBEF80AE33748530905B630B7E115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225723, "uuid": "356b53c5-7f48-4a0b-8874-a39c90c4a3a2", "value": "3072:/agHpXTZH+XIajAHknidpWcZEEVvjbiQLKXrjyqKUXV:/JMbjAHkid/ZEMLK/yqZXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775225723, "uuid": "5db62fcf-827b-4fe0-8427-aa964be7a3e3", "value": 150400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775225723, "uuid": "ea7dcd40-8d23-4d09-9920-cc101e1dda1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225723, "uuid": "a81b7a21-2049-4a47-825e-0714d313885f", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb72b9bd-2f78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775233181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233181, "uuid": "78e6516f-b1d3-4c76-9ada-0f3f75d51a47", "comment": "Malware payload", "value": "bc49826703dd9cbddaf72706565c606f", "object_relation": "md5", "Tag": [ { "name": "japanese-seo", "colour": "#1E2C8E", "exportable": true, "hide_tag": false }, { "name": "seo-cloaker", "colour": "#A08CC1", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip-stream", "colour": "#722007", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233181, "uuid": "328febb9-2673-4ad9-8aca-62a7e288d1d0", "comment": "Malware payload", "value": "8707fd8e92ef45148e0494c8ca7f85b47cecc765f171834c95114dbfe4d95d5d", "object_relation": "sha256", "Tag": [ { "name": "japanese-seo", "colour": "#1E2C8E", "exportable": true, "hide_tag": false }, { "name": "seo-cloaker", "colour": "#A08CC1", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip-stream", "colour": "#722007", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233181, "uuid": "cfb8bc50-6690-47ad-aca0-1903ae3347d4", "comment": "Malware payload", "value": "ef704288d1dc80bc7cc8addfbb2519d2125a7482", "object_relation": "sha1", "Tag": [ { "name": "japanese-seo", "colour": "#1E2C8E", "exportable": true, "hide_tag": false }, { "name": "seo-cloaker", "colour": "#A08CC1", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip-stream", "colour": "#722007", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233181, "uuid": "c163fba1-2b42-4d1f-adb1-aab8a6dc2b3a", "comment": "Malware payload", "value": "b7958678c388f0a461f0125a088615020a7a2ef0e7aadba4715a4ec3139208fa5915705de69278a1dc826eeed35bbf0f", "object_relation": "sha3-384", "Tag": [ { "name": "japanese-seo", "colour": "#1E2C8E", "exportable": true, "hide_tag": false }, { "name": "seo-cloaker", "colour": "#A08CC1", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip-stream", "colour": "#722007", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233181, "uuid": "9219724c-2745-4136-9318-75255e95c54a", "value": "T19B412BD94007002BF01DD6374427C55A66E2C24920B4EA23CB2378E8B50D63F4E99F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233181, "uuid": "119f36f6-8164-416b-ac9b-26812e173b25", "value": "48:9u9ED572Tkn8/JDbDb4kVnBGp9694AUo7EyhctZnj9DarKw:2i24n8/dXckpBGp9wRf7EtZx6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233181, "uuid": "8faeb1eb-1a04-4c40-9617-dc0635f3144d", "value": 1889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233181, "uuid": "c5ecb297-810a-4dad-9aff-112a0f794202", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233181, "uuid": "4a3bb5f5-191e-44c0-8d1b-e74f66040975", "value": "readme.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150546ce-2ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775174839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174839, "uuid": "7602b7ea-854b-4ec5-96ac-e9df7207564d", "comment": "Malware payload", "value": "008174e5ee9546205fbe4c5ee2b32540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174839, "uuid": "3ed16f10-676c-49dd-8dde-71be2a988266", "comment": "Malware payload", "value": "87db3765294c73cd1f3d7bf5292e20a152b0edbcc0318dd14d7105d3a4ee2592", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174839, "uuid": "39c47e8b-9676-4f4a-af64-a1e604f5d030", "comment": "Malware payload", "value": "03c4766fc7685fc2877660e2da63f7b7c11d6c90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174839, "uuid": "367711af-fffe-4988-af3f-348ee35995e3", "comment": "Malware payload", "value": "8fd51d878bd1877b0920c7088cf12cd8fa34b53976a91bece491b490e138255c852b1df43005d57e40344a402cc7cb5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174839, "uuid": "1dac6c44-d9b6-455c-bbf7-5beadf6b2d10", "value": "T1BF069D07B39501E8C476D138CA479663E3723848173297EB27D49A56AF63AF42E3BF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174839, "uuid": "7c345b20-7995-4057-b1d9-13f08359a9a7", "value": "80760d641cafadf08b0328d3759ae3a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174839, "uuid": "332ffc4d-d85e-423d-99b2-258f43597fbe", "value": "49152:W/6O2El4b3gkgdJdSQkzM1a5GYldZqMGNeg8y9CE7zpC/LfNnASzjwx13TYWqr:HTyP1aTZfGvpC/L2d3TY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775174839, "uuid": "1be4664f-8e67-47db-96be-4aae9b5fdac8", "value": 3921920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775174839, "uuid": "67d1ccc0-ee49-46c9-8951-4f5f069c53a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174839, "uuid": "b6e20eee-f42f-43b7-a6f7-ccb3e07bc14f", "value": "Valex_External.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ee09e4-2f47-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775212152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212152, "uuid": "4a1eb32f-9414-4a2b-a04b-5e0b12ca89c1", "comment": "Malware payload", "value": "00eb58706cfdad2994e873cebc4715ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212152, "uuid": "9168a439-7cac-41f2-98ef-ece70ed12098", "comment": "Malware payload", "value": "882f861200690ffc956dad07f185a088de7a480fc141bc03e7e7d1164d126624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212152, "uuid": "4dd13939-7722-445b-a91c-50e1222bd302", "comment": "Malware payload", "value": "c6af5e40db4e0c571e12b7cc10e6bd917f5f90a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212152, "uuid": "1582b428-456d-4962-9850-9047925b0338", "comment": "Malware payload", "value": "8e4c58608d67f03f3addddd39ae6a7d9de0dcf0607b63c07ffcde6c9b575bb94545ad27201c217676c1f85c1c8205d47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775212152, "uuid": "c855a74c-b2ed-44db-9368-5b29d815a379", "value": "T1F1A30A96F8A28B56C4C557B7FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775212152, "uuid": "b2263b14-750e-47dc-bc48-e19d6c1e143a", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPj5zzy:FOuhPHCKsqZ9YfM6g23ZJLhzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775212152, "uuid": "6a0a3626-a54c-456c-8c6c-f01af8e30e22", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775212152, "uuid": "7e5c8589-5f22-4ccb-908e-cd6b5a555111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775212152, "uuid": "830e3778-5b8e-463e-ad62-ad6868bb1d29", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29828c31-2f8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775241446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241446, "uuid": "27968d61-1813-44cf-8208-6677ddcae494", "comment": "Malware payload", "value": "6f9dcd25f767075ef196af51368333dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241446, "uuid": "2686dc68-4483-4bba-8ed2-34a9c82c3203", "comment": "Malware payload", "value": "88b5390aee059fb8c0d521bdba9cf870f77d197ee25765747c61c4f3c1ae7bb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241446, "uuid": "17f63b7c-1722-4889-8d8f-1f3bfdc7571b", "comment": "Malware payload", "value": "79ee6662520434b7a4f24b862433e7ef5831c6aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775241446, "uuid": "901eceff-fcf4-4a66-9427-c93ee4ec90d9", "comment": "Malware payload", "value": "c2f6d8e1de73c70bd6aeb147caf7c8610c53bd9dd8ad75a86d0de40d223210af3a2bb8d9c7e81524d0184ed33c0efbca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241446, "uuid": "6372dc6f-3acd-4160-a147-7e40e3e49a37", "value": "T1890723D26AEBA3ECC5D74F0055C3678A25D1B59DC1EDC92E3BCB1C033510E178A8AA76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241446, "uuid": "0c9b5de3-ed9b-4e97-81bf-095ef8a5ea88", "value": "b546f509d09c4a6897cbb43ea9c340ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241446, "uuid": "ca48820d-dacf-4909-a804-c292a500606a", "value": "393216:wm5ruLEpZ1e44VJZzdc1iFVh6OES9UsQVr0QVC7:b5r5Z844VPZ6m8tsQVr0QVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775241446, "uuid": "94e84176-d42d-4d7e-a5a7-81f98b27cb69", "value": 18378704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775241446, "uuid": "1ed33763-2523-42b6-9782-69f9bd659cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775241446, "uuid": "e0563115-b93c-4325-84ae-234e298e1d25", "value": "GaIa\u0445is.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b74c319-2f7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775235946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775235946, "uuid": "8e171f64-1ddc-4a99-ae72-e631482d8cb6", "comment": "Malware payload", "value": "86db0753ac4c4efae41653ae1d319492", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775235946, "uuid": "5bb29df9-58a0-4c5a-aac9-eedc4a1ea828", "comment": "Malware payload", "value": "89a2daf2e8712482207dbc2d62923d139446b0379aa8c5219b2937ada300c486", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775235946, "uuid": "2ca39d82-7386-46b7-b8e5-fd3b0ff690bd", "comment": "Malware payload", "value": "6307c66fd00bf06a2500e1a7fc8c7df7a1ccab6c", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775235946, "uuid": "aa8d257c-4442-4554-996a-d24d3fef5d10", "comment": "Malware payload", "value": "9a91ac821973feaec6a6e2dc63eb03b7a43b3ec92f89febaa420732ddf3a12d0bf782d1d34970c6b8e5b475ab7587acc", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775235946, "uuid": "4640f808-eb3f-4eef-829c-bd328f710e39", "value": "T13ED31FCB6E8E84ED475F6014451F9D02CA4F6627061CC9907BDEBEA03F35EA074EAAC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775235946, "uuid": "c60c6773-01b3-467c-9334-98c3c8eb6263", "value": "768:04+BC6775GSYiOcEEREcLp0K4ERYHpyJQLwT6TxTfTdTy+Z6LRCI0T8IYUEV4Lhg:j8C6775GlhRgtmqh04mCW/hxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775235946, "uuid": "df5c3d88-1d4a-4a78-a321-3a0c0e5bbfe1", "value": 139067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775235946, "uuid": "76ae25f8-d9c6-46f6-b73f-c998b50627fd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775235946, "uuid": "52c1f1e2-745d-4451-9052-78fdd1d2f494", "value": "Z_Document_Home_8046.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7123b3d5-2f86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775238989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238989, "uuid": "ea1949f7-bf6a-4794-86e1-942353f695e8", "comment": "Malware payload", "value": "8a06579d16bd5498316a4211f06910a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238989, "uuid": "9eb2ff5b-8638-4be6-834d-b42d8c0363dc", "comment": "Malware payload", "value": "89d8a5c61f78e93fb13f9aaf424161b02cc7f9508f69d8d2209cca2a5c2ed12e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238989, "uuid": "848600aa-7206-4821-9b63-7c661915692c", "comment": "Malware payload", "value": "e4cb99d59dae8f443550f9e2304b68f319e05a4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238989, "uuid": "bca57efa-25c8-44f3-bcc3-8e345acd03dc", "comment": "Malware payload", "value": "895fcb22d6d5ab7d89fd317fbf3f24e7580d086cf07d8afb9ea874a01d64e1447427c2b9c1935399e7c080c3a18f0602", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238989, "uuid": "6fddc512-5619-45ad-8b8e-fcfc08f8b580", "value": "T1FAE4CF18F666DF1FC79A8673C4D60858A3B29447E21BF32BE14312E979473E7CA01297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238989, "uuid": "99b118f2-ebf4-42b0-ab45-6aad19d7b24f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238989, "uuid": "95ff0043-3bff-4d2d-aacb-273a08f339fc", "value": "12288:YlsrE2FX/q2dG+3AKmafYSI1hz94GmLHYYYYYYVS8EP+f0xv6tRSwB:SbGrd/QzayXh4bLHYYYYYYVeyRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775238989, "uuid": "a9aff98c-7dbd-4eaa-a494-95cb1aa8e9d6", "value": 665601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775238989, "uuid": "c6df5714-dbf3-414a-8167-a1c8621c033b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238989, "uuid": "888e1a2f-9ab2-4bd5-96e1-5fe8aa8cf247", "value": "DriverFixPro.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f5fae1-2f98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775246627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246627, "uuid": "cece4e1e-9f1c-4049-87e0-1ba8632c9269", "comment": "Malware payload", "value": "a750e81ffcdd95b98ea07e0d8be062ed", "object_relation": "md5", "Tag": [ { "name": "Trojan-Ransom.Win32.Encoder.agyb", "colour": "#BE3C6E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246627, "uuid": "0acdf7f2-cb0c-4dab-9f28-72b4896f7dd2", "comment": "Malware payload", "value": "89e61df4394e3c3dc11cdb293aeb00155f371b0f1c2ade5f07fbc8732d86ba17", "object_relation": "sha256", "Tag": [ { "name": "Trojan-Ransom.Win32.Encoder.agyb", "colour": "#BE3C6E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246627, "uuid": "5af4bb38-e777-448e-8902-a0115beedeee", "comment": "Malware payload", "value": "cd8ff1b285c5c145d02f39f256309bfcea77bc9d", "object_relation": "sha1", "Tag": [ { "name": "Trojan-Ransom.Win32.Encoder.agyb", "colour": "#BE3C6E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246627, "uuid": "0c80f968-2446-445e-9a53-181982d82ade", "comment": "Malware payload", "value": "0f6075cad309b2cf74c04383d527da8679b89ec2691348f9f209a1addc1cfeb7db5a9237b47df992307da6d987324a65", "object_relation": "sha3-384", "Tag": [ { "name": "Trojan-Ransom.Win32.Encoder.agyb", "colour": "#BE3C6E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775246627, "uuid": "16b20c58-749e-4bbd-8eb2-5221359b356e", "value": "T11C453381F88B2EB3CD7984975BD9EF205B4BE664433FECC56998633F942EDA44358024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775246627, "uuid": "900c6526-2888-42a4-9adf-6ed511988de7", "value": "24576:Yr3VgxiSEYnttcOAYGfaXoYlbHylaxyx5mC9AOt:Ypgr3fmYE69bylaJaA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775246627, "uuid": "1a24c5ad-bd15-4d14-9f7a-6197289f75f1", "value": 1169737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775246627, "uuid": "8136d522-d43e-4c05-ad8b-bcb71efb4584", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775246627, "uuid": "0c1dd682-48d1-43db-9d39-e8faddea8b16", "value": "7z.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad35f34e-2f86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775239090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239090, "uuid": "c618025a-59ef-4708-bc3d-75d263a3bfc1", "comment": "Malware payload", "value": "33df7d89869d121fdb1dadf75909ba8d", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239090, "uuid": "7f9ae861-03f1-41ce-8b00-34fe618fd584", "comment": "Malware payload", "value": "8b7ab7f5a37f55fa529ca5b1470b9bccf219b0f3b62928c85eb140d7d4d805d2", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239090, "uuid": "f2fcd8d7-00ba-4bad-bf1e-f229a288da08", "comment": "Malware payload", "value": "82ccb8270a6112d4958f8997c5a5624d3d4027eb", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239090, "uuid": "c24801bc-d2a0-4b01-9fb2-8584622f12d5", "comment": "Malware payload", "value": "fea44d9dfb460f20e217bffafe17c91fdeede3ac13b91e063d08f56f8bebfcba6245ac4ec0d6f5d60965ea1392667be2", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239090, "uuid": "556a896b-7bd6-45e3-9722-076373485a4f", "value": "T117959D4B7CD044BAD4AAA3328CB651927B76F8190B3233D32E50A6383FBABD05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239090, "uuid": "ccd01364-5055-494a-9791-046a109fd174", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239090, "uuid": "38ee3e8f-1854-4bda-adbc-b6f959ec1c2d", "value": "49152:9Aw9n8wQW2oNo76CU9O0aA/gMfF0OaLpRI:9l2oGlHA/HeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775239090, "uuid": "14505b4e-bdb9-4e45-9c12-219be903ddcf", "value": 1901200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775239090, "uuid": "48d1382c-b2b2-495e-9b90-abb245a03bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239090, "uuid": "7233bf9e-f68f-4efc-aeed-ee7bdfb23b50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149ea571-2f6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775226808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226808, "uuid": "38f68c62-a14a-455e-8132-51a4ffbbe4cb", "comment": "Malware payload", "value": "e9c0fcaf04370e0e692669a1936b7e46", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226808, "uuid": "e2a54850-1f5b-473d-898f-770e489d4bd3", "comment": "Malware payload", "value": "8bd46e4d069be47dddc1c267ac5c5eee52766f7c81675108c80c47bd8d947d06", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226808, "uuid": "d8cdad5e-aacb-4a8b-8181-c5464c7d5264", "comment": "Malware payload", "value": "5e6748fdcab787f2d392a873354e162e9d2b6327", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226808, "uuid": "b4970db4-ad9c-43c9-a079-b3838d5d1928", "comment": "Malware payload", "value": "e92e89ed53afe882c7f6722b44ee569b06c72cac6ae9d947864ed5afc6fe9be93b982ed2d38969121eb4d83d66413ab5", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226808, "uuid": "4265f393-d891-4cfa-8de5-aa853cd03e10", "value": "T120320921BAF8C165DA562A318CDAF252A424BCA58ECA592F3584F32EB4307D0C51D31E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226808, "uuid": "fe1d0e0b-89e3-4fb4-b998-de313460e103", "value": "96:fmQpR/M468VtUZwLDKuom91cdQzaBs7QaXFSmkL4414G4m/krG4F82Z4FQ/7I6if:dp9gfZm70yuBskaXFSxs414G4xj946", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775226808, "uuid": "f9b1aff6-9185-4687-85c2-d50cd528cbb4", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775226808, "uuid": "35644ae4-f65d-4265-9aa2-ef05b49a8ed6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226808, "uuid": "add34331-9b8e-47ac-814a-ba331cfbb17d", "value": "NEW ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd4f523-2f31-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775202610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202610, "uuid": "15fc785b-a612-471e-b248-b49454f8448e", "comment": "Malware payload", "value": "e9c95808d1ba835f5f8ee21da19fba11", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202610, "uuid": "b1ad79fa-a2cf-42f3-9e41-20c5939e3037", "comment": "Malware payload", "value": "8c6d0728e65864923a9dd9cf1cb512ab65c3d80b69505818a52563a1efe4b59f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202610, "uuid": "0da04592-c3ce-41c0-8917-a3ed97e2c7a6", "comment": "Malware payload", "value": "a2d08e3b00e7e77eee5b387a0e03728e9a06070b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202610, "uuid": "999cf804-1a13-48aa-b1ec-92dae3e4f08d", "comment": "Malware payload", "value": "8dd0471d75222d50236e37f479e00e421ddb8a059a7fdbf582aa64022a6112a298e98fe004bca11eb7b3b477e0382bfd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202610, "uuid": "43dd34b6-384b-41ab-ad1e-ea8270dd5d06", "value": "T1A834BE63A4BCAA9FDDD82F379C4E880713B66FE4D890603E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202610, "uuid": "9eaee0c6-d9a1-4380-ae33-689611e3dcfd", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202610, "uuid": "3de4a317-dca3-473d-a40b-3e2c5dbf45de", "value": "6144:iGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdO:iG60BpL8jk1FGjDc8GVdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202610, "uuid": "9ac46bbd-cad1-4ba1-912e-32c0df6c9a3b", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202610, "uuid": "b1521aec-b741-427f-b5e6-743e674d0343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202610, "uuid": "e539c8ba-e707-4753-bf6a-bf2867110e50", "value": "8c6d0728e65864923a9dd9cf1cb512ab65c3d80b69505818a52563a1efe4b59f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09896796-2f39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775205744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205744, "uuid": "cf77652f-3852-4e0b-9953-363e8010b816", "comment": "Malware payload", "value": "75abe13761c408b962424b8938611fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205744, "uuid": "66700d82-15cd-4bd1-86f5-9696b0e4d6d5", "comment": "Malware payload", "value": "8d76a3dbb53c4750cd0c699011ddad9c5f595ab2ebb2d6d70fbb6b061bcdcb02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205744, "uuid": "1bef07d7-dcce-4666-bb74-97bb1fb646e0", "comment": "Malware payload", "value": "a707170a11521faad861b4c6e8246c4e68d2c1ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205744, "uuid": "1056c9ba-6a0d-4090-ad94-0b6630733027", "comment": "Malware payload", "value": "fc924c6b62bbd06c3fd5587e833155acde7caacc8239ba20b2a002fc9db7058eeed803347044e0ee286b9ea1d5c0f43a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205744, "uuid": "e218d663-2ec9-4c8a-821b-8177f82c96ea", "value": "T12026C08173C4FF86C05489BA9623576543E3AD214BE3E2DA3456374B9E777C34E30A8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205744, "uuid": "c3b70c10-c5fe-4da2-a5b8-8f053cd0363f", "value": "b1f988d5896a26eb61c6b08bd20209e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205744, "uuid": "2d5ae1bf-d0a1-4dea-8b62-f3c4f487be73", "value": "98304:1+CUJ2JAiPoCY7DzWiR2wRBLFkmvGxUFLLJCwCOO4tWh4tXbBT+Feib0WhkkR16L:1vPoCY7Sw3FkAGxUFLQwzO9hUbBT/ib4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775205744, "uuid": "c1c2b234-52d6-42ae-8508-508f10e8d1f3", "value": 4713472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775205744, "uuid": "669ae1a5-c70a-4069-935f-2fdf38eb6c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205744, "uuid": "07cab642-32af-4e4f-9c85-2a44d71dc394", "value": "libfzclient-commonui-private-3-69-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9a1c98-2f69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775226612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226612, "uuid": "19d8f432-96ea-46da-a47b-2d259eaf360c", "comment": "Malware payload", "value": "f3a978645560c54f208e91e2038a7873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226612, "uuid": "a750cf5e-c26a-4b12-8b80-1bf9251bc94d", "comment": "Malware payload", "value": "8f98052bcf23cf01f22be1a52297c20d1b3db3e98867757008eead3dbe504ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226612, "uuid": "c93596bf-7671-4132-a042-f0635d7731ba", "comment": "Malware payload", "value": "069cb1a99cf94fcbc6d2b0fc7fb1f174c3dcb525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775226612, "uuid": "c6eda268-09e1-4e42-87ea-379da68c7b75", "comment": "Malware payload", "value": "08706918eb01b7bca3b3893bd354fb5bd8a0ef4809ea474806aa31ce62369325d5eb77032ed1e1ce866d4b78adce4a42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226612, "uuid": "f3e82a36-3a44-41e5-84e7-c5751e722e0a", "value": "T1C5450145335ADF02C5A29BF41D30E3B50BF56D956421C313CEE67DEBBA39B14AA00A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226612, "uuid": "ed84f7af-d275-470d-b0ba-f579cdb4555c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226612, "uuid": "4decc8b6-243b-4024-bab7-807db0bb4189", "value": "24576:VumSJJSHwIhuDTWH42qBNXOP9N/5QXJT/CS1Vz6yLPJ:VvqUweuPWH42qBtOP/50xFVJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775226612, "uuid": "6dd14de0-7b0d-4826-bf72-41e7d24f388a", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775226612, "uuid": "996489a9-cc8f-40d0-8fd2-adcd335dc304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775226612, "uuid": "5a6d6c36-2c67-4c08-8749-bfaabbab4b38", "value": "rNewPO_14377_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124c05fa-2f12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775189008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775189008, "uuid": "127f504e-9e8c-41f8-8816-14a3247ce3b5", "comment": "Malware payload", "value": "5c38641814eaf858f45080f8d3bb0a0a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775189008, "uuid": "6685741f-ed04-4ef9-9c4a-29dbfcee6c9c", "comment": "Malware payload", "value": "90fd9b7f029dd2968c69a03d98fd8f86dd529b0c507898e687abf39807eaed2e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775189008, "uuid": "a058565e-0f6d-4663-b441-859e9da68277", "comment": "Malware payload", "value": "f11cd28229415a4f868832abc57ab276bdb5e561", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775189008, "uuid": "1914e21b-7120-4165-8f03-22e33cf2711a", "comment": "Malware payload", "value": "435a805192c022060c581fd490e057a8fc13d1afc152873ed8c93bcd3db6ca9823431498e8213864cf4abb0d0fbc8475", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775189008, "uuid": "9aff1671-d77d-4a76-9d4d-3f0a8e9837e7", "value": "T1F7E0C23F59675A344E2301867531E6D43D7A10261163E61E688CE81D9F18FC50C28D90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775189008, "uuid": "a90fb20c-2254-4b54-911c-9980fb64772c", "value": "6:oMEAADEYIvFyGi8mgO9l3CscVwieCq74scVwNAqOcWmicVwWZz7ALxRhBcGfw:oMvANIvFyG1u3Cs8eCqEsHqDAmRhB3fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775189008, "uuid": "fd48f0dc-0e7d-46b0-82c3-a54dba48d53b", "value": 296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775189008, "uuid": "a3308acc-e661-45b2-8ff8-a93f89a15e84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775189008, "uuid": "0a373569-4efe-4265-9168-49a8280e0179", "value": "script.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad45b433-2f1a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775192704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192704, "uuid": "43b212de-f9ae-4ee4-be4e-398aad062208", "comment": "Malware payload", "value": "1a68ae614fb2d8875cb0573e6a721b46", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192704, "uuid": "66433ebc-3f27-4e19-8db8-d91ee72b73ab", "comment": "Malware payload", "value": "912fcd1ba138a8af6ada02a5d62a5a918ff06d4618c041dbf075a60ea37d4d09", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192704, "uuid": "eb7c0f3c-615a-4cc1-8800-412a582c9f35", "comment": "Malware payload", "value": "c67344e14af1560bf820375d144ea4ea7a21333b", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192704, "uuid": "efe3ac88-0e32-4600-ab51-e7e45369141e", "comment": "Malware payload", "value": "a616a0770daf8259ed6eacbe5339f13e9a3869397690f2adb7959bd8754fab1ddf6145cde1ce6dc9c8d116d01fbec2ca", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192704, "uuid": "5359fa6c-8188-4553-a73e-a1ccd085d915", "value": "T1FB967B07FCA545E9C0AEE13486239623BA717C885B3523D32B90F7682F76BE06D79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192704, "uuid": "0ce6365b-5e73-4e06-b770-ef7e543b2f21", "value": "49152:VcHeoH9Ptt5mG+IDbuUtlylOgU41pZVTnBJNXbPiM5onZYi9QJAj6f9fX921wJb0:VNSNeAEPNrPi7URKW0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775192704, "uuid": "3994c3a6-9926-47e0-a7c4-0b2af981c2e6", "value": 8893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775192704, "uuid": "4639a04f-a6bd-4ea8-99f9-4849c744e9b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192704, "uuid": "27bf5fe5-5b4d-4042-b78d-62007a66f6f5", "value": "912fcd1ba138a8af6ada02a5d62a5a918ff06d4618c041dbf075a60ea37d4d09.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5471608e-2f90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775243236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775243236, "uuid": "22f213de-e211-45a7-911f-dd776e866907", "comment": "Malware payload", "value": "48417e64b1f21f21d5b35aaaf39d9371", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775243236, "uuid": "bd7e36e6-1e6a-4c75-bcba-4dd9a1bd31af", "comment": "Malware payload", "value": "917cde4f5dfde864c07a412e586e218f65826b71810083bffb086c3518dec645", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775243236, "uuid": "e4251934-328a-4109-9c5d-230bb319ad69", "comment": "Malware payload", "value": "2daeba91034a34409fa55ac3dbc0af902a52e3df", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775243236, "uuid": "cda959aa-dab6-441f-be1c-b8f4bcd3c041", "comment": "Malware payload", "value": "78c924c9e2407c432e5494363d565415a5fb6cfd94a0f596a08958528c20deec91be5bd7dd8196db401faa13b410efbd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775243236, "uuid": "7b64a7cb-144d-4fdb-b212-78dfefd27265", "value": "T1825423AAED48D956D9E618BD9CBDF40DDEA0332326E5C70B0B26C5152E5B2B04E30377", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775243236, "uuid": "8c86be24-d8dc-409b-8289-97e0002f7612", "value": "6144:uEwH8ncOF0cRkU/aD2hOF9wTLLTnjfPGJl8FV5QDrhN9CK/4OkFXx:u/8ncs0g69wTL7uloV5QHhN4a4OYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775243236, "uuid": "64fc770b-6d04-4e1e-8fd7-48ce6966e45d", "value": 303878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775243236, "uuid": "0f39f8bd-9619-4e55-b1ee-9188b3afee68", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775243236, "uuid": "710ad664-0a5d-46a7-b39c-d8673dfee572", "value": "PAZUZU.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42475d5-2f78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775233169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233169, "uuid": "1b2f4272-72f9-420b-8792-a98bf1fe79b5", "comment": "Malware payload", "value": "02a0864d39433dc86c53864651347bc7", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233169, "uuid": "d3eea8f8-17a6-4a5e-9252-2da4814bfdc2", "comment": "Malware payload", "value": "918c3bc3c730d9d75adad76d38951beca4f940bc223562098165d743d6159527", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233169, "uuid": "83a814fe-ca7c-461e-ba98-952c8de8c299", "comment": "Malware payload", "value": "1ed2c4398829d77a2a797813033c5494b77b59c4", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233169, "uuid": "5b4b911a-d197-4b35-a24c-a2eeb178628f", "comment": "Malware payload", "value": "76c689a3ecd393b787ae96421e28b0b5b21f4e089e47b3e38a83bcab68346d4969615d1e34d085d710cc9f86c4434afc", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233169, "uuid": "97fbd857-1fed-4a62-9813-d16436af593e", "value": "T11B13951864C46E730133D7A5AB9A0F0AFF968017C64646057EED33D72FF5C2086ABEA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233169, "uuid": "c65de851-3a2b-4bfb-bf69-83fb91b1dd69", "value": "384:d2qrkgjQppXAXVI2cMbHMgZYVgrSqgUPdkgZl1xM0mTi00V31bhzJRKFE:dDkg0+VfbHMgZYVgGUyiMFijHjKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233169, "uuid": "6f29e084-e2bb-412e-a10b-befb88bd9122", "value": 42827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233169, "uuid": "cbfa9135-7460-4d22-8da0-4765a17e09fb", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233169, "uuid": "89f2b268-fd01-4608-856a-50d91c707c7e", "value": "webshell-wpo-cache.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f765776-2f07-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775184521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184521, "uuid": "44112b06-e128-4fa3-8f57-4649748e25dd", "comment": "Malware payload (ValleyRAT)", "value": "0f778361e2abac4672f9d823e6714221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184521, "uuid": "2c4a6e9d-7a89-4b9f-9172-1fcef56ca4e7", "comment": "Malware payload (ValleyRAT)", "value": "91d15b3e6836b112cc7507af46553e95fcb40960c6d71494a20513ce3d552d94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184521, "uuid": "0fa266a9-4053-43b8-83a8-757cb99ecf8e", "comment": "Malware payload (ValleyRAT)", "value": "ac9c89931480b682ae3f958d30db7e889541accc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184521, "uuid": "121806e5-d339-4066-9a24-bd20b182d085", "comment": "Malware payload (ValleyRAT)", "value": "5c8677619b6e467c3b13344ffe8381403391a7317ff353cc388aa23cd70715907fc2dbc54b162463aedaf81371e6fe36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184521, "uuid": "18e7ae0d-bd59-42eb-9bf4-44dd19e5cbfd", "value": "T1B607335813558495FB6B783254E90ADB34B26F5F1CA08503CA5D3EECEAFD91B68A0F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184521, "uuid": "e3a8f4b9-1ff9-455a-adb1-9978da8db972", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184521, "uuid": "5aec6992-bb3e-491e-9c71-894b2889781f", "value": "393216:tzoeIr/X3ZPIlBSGv22a3ObLEDcyhbiygHJc13hj3NiSAs:tzAP8SGw3ObgQyhbilm3hZi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775184521, "uuid": "3fc5d41a-8b42-4825-b321-9adf8e5a5d23", "value": 17065321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775184521, "uuid": "0ddb8d2a-bc60-49ce-98b2-df027e3be818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184521, "uuid": "8d7d4690-7fdc-459e-8bfc-6ad5a20d8982", "value": "LetsVPN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ac9d5f-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775237948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237948, "uuid": "fc32bffb-a228-41f6-b439-a773ea6702e5", "comment": "Malware payload (Mirai)", "value": "648f9d02dd5e43e132c72ee18949ad88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237948, "uuid": "654d17a0-4be2-4cf9-8be8-9038810608f9", "comment": "Malware payload (Mirai)", "value": "9247f48ab49076166d113e0711fab7c7f421784ecf8e7a7f5639b717f2db357e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237948, "uuid": "3a83f205-98dd-4cbd-8434-cda7a4c42739", "comment": "Malware payload (Mirai)", "value": "589c06cc76a42725bfacd42b38219822c73b104a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237948, "uuid": "70244128-4012-444b-9c75-43fb7ffa191c", "comment": "Malware payload (Mirai)", "value": "aa917aa65482f109d213aabfd1acce19fc90eb48df3a78bf1769c72af903c95e1c14de0fb9ff7b9b13fa88c439b69750", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237948, "uuid": "c9ab90d5-4a0c-41e1-98fb-68d7fae58de9", "value": "T1DE33F176AE521366E4B208739C5D0F829343B7B0D397A23B0459915DCD93207DAECD67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237948, "uuid": "83574fd7-f115-4978-9800-904b43f69f76", "value": "1536:O3XPB91L394+PSflPekzOon256xLhRiuft:OVL394+qf9uWx9ouft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237948, "uuid": "75838d21-0016-4e01-a1ce-6144fd2f0083", "value": 51096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237948, "uuid": "23712861-99a3-4a40-a15e-dbaaa11ef695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237948, "uuid": "9a3e81bb-6f6d-4704-9cd8-8c45c5979235", "value": "yakuza.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74789cd6-2ef1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775175000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775175000, "uuid": "fcfbb91f-e032-4118-ba4c-3ef3cd7e2297", "comment": "Malware payload", "value": "0e5ee2704c10f00c45f6e7376da30094", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775175000, "uuid": "af061f34-93c4-44fc-a79f-ebc1279cd736", "comment": "Malware payload", "value": "94bb90c005e7b800f08fdb094e7880c0ebbc1b19b4f1cbcdac20d9227ab4d85e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775175000, "uuid": "289858eb-1e18-4d97-98ff-69cfa2a25153", "comment": "Malware payload", "value": "562d080219d82c27c42a4a6d7b5c4877a2ec67b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775175000, "uuid": "e60cebae-07c7-4ac7-bd66-c85ecca50f86", "comment": "Malware payload", "value": "164a62fb17d70f398030cc05dd3119e6055d3a630befe6ab2cec4c2d1e8bcfc4b74633a80d781af99c4f9672a597eaf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775175000, "uuid": "31ae36f8-4107-4431-81f7-92e4129c5f47", "value": "T11966E123F101C0B1D15801B119B95739667CAA321F748AD7EBE0EEB96D712F29B3670E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775175000, "uuid": "213a4315-789b-44b7-8c17-88187320d61d", "value": "725fbddc84ffa2662ce41549d5bb7adc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775175000, "uuid": "ce2cc4c1-88e4-465a-beb5-9c2e74e62dd4", "value": "98304:xyBt+9cyzo9vJglauyQfpjM/7ZbPZN13MpiRtrKieE5ZevkJpr3:xneDJR8pY/7ZBPVKpKevWpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775175000, "uuid": "1a654abf-afdb-4095-8d28-ce36aa5ea193", "value": 6483968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775175000, "uuid": "dfac21a8-ba8d-4adc-9202-8b03ca215a94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775175000, "uuid": "cce35907-448f-420a-b366-21a267d39b19", "value": "\u6613\u8bed\u8a00\u7a0b\u5e8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbb52d2-2f64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775224250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224250, "uuid": "9586c52f-6c44-4dee-9e3f-c8b7bf1ed029", "comment": "Malware payload", "value": "37768bcff0df2b97158cf952c25521cc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224250, "uuid": "c78a4e87-9066-4578-a5de-48576b45dca5", "comment": "Malware payload", "value": "9561aa5c7785d63596a71c468450ebbb78dca4958720af000e2f9f01093fbc08", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224250, "uuid": "2770de38-9f55-43e6-bf4d-b2d621d59981", "comment": "Malware payload", "value": "8dc7ccb050ac0b1a1123dd90ec3fa65d44488c44", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224250, "uuid": "1d8ebbd7-0165-4112-b08a-912aeb50d676", "comment": "Malware payload", "value": "59e1be4e5ff76454de9ee8b333bec05ab77a16671bbaeafd319600be254e89d4a580eaffc74cee5b8f25718cf5735413", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224250, "uuid": "cf750f8b-c774-4488-9ce8-1c2104d6b13d", "value": "T13D4733241BA064AC6FAFBBD115ADC4927B59EFC2FA34E46FE470A994607CD43D110B38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224250, "uuid": "6924da07-8a11-4f9c-862b-019174ef5d99", "value": "786432:DJ3aZm8ijXdJqwTLmkUrIvfyAIox6iFlJHlG:seNJqwTLmPrIvfyAVLlfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775224250, "uuid": "eca3339a-f4bd-476f-b5f1-0b60d0527a5c", "value": 25455167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775224250, "uuid": "39754938-ca39-4164-a523-f0ef56dac52e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224250, "uuid": "736bf34a-f62f-4f54-bf96-dbc4f6ffaa3a", "value": "ChilloutModSetup.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435332f3-2fa9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775253945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775253945, "uuid": "c426dedc-c714-49f9-9638-27020ee5f46b", "comment": "Malware payload (Mirai)", "value": "91b7e6d66cabf07ccb593f1e996de84a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775253945, "uuid": "9a7eb934-2bb2-43df-ab98-c0b7a8f5f9d7", "comment": "Malware payload (Mirai)", "value": "9af5f415cea6ce948b4829575b74c7ba1e8a003675deb73296807f25af0b419d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775253945, "uuid": "bcc5165c-1408-4db8-a745-012a4e0b452a", "comment": "Malware payload (Mirai)", "value": "a3770c578817f45132544cbd07d2b9d618968f36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775253945, "uuid": "64d0435c-7393-498f-afb6-ad27f21e90a0", "comment": "Malware payload (Mirai)", "value": "aee5dc5fbe39c92c997b462078f0581d4d4abebb850b0d136d74d0800c20679a2cb50cdfd07eec850d89e773d3e60341", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775253945, "uuid": "f1cd5d07-310e-4af0-b756-82da8fe2fb12", "value": "T1CD44D81A3E228F6EF26DC77047F38931976976D617E2D644E26CE6101F2038D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775253945, "uuid": "f856f3d2-c96d-4b8d-820e-5bf2e63fab49", "value": "6144:aGdYfty7JW9luKFpci8x0X/GOLGrT4nWmfrqZDpbAVpsQZr:afi5KxX/farT4nWmfrqZDpbAVpsQZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775253945, "uuid": "59bbee4b-75b9-4f11-9bda-4a93f6c46d06", "value": 270009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775253945, "uuid": "7266cd39-5218-4ee5-8b95-59ddcc71dce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775253945, "uuid": "2a92a15a-9c31-4d08-9a8a-1d455b75f76e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3f7831-2f93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775244700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775244700, "uuid": "90906f96-02d0-477b-b83f-51475d4d3535", "comment": "Malware payload", "value": "de5f970a05abd0f03f99b6d0802aadb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775244700, "uuid": "713ba890-784b-4477-8d95-0a616385bca8", "comment": "Malware payload", "value": "9d8373d9bccb3ba200e4c1aae48c083736298c4eb3a37feb17896bcf5cb02616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775244700, "uuid": "f45cfafb-8b17-4fbc-a3e1-168214dc3cd8", "comment": "Malware payload", "value": "1bec61036e97dd9386ab1f0f9aca42945df9442f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775244700, "uuid": "d04fda16-6496-4920-99b2-545c99e5ca98", "comment": "Malware payload", "value": "ea37ee5fd900bd1d073995ca665b277d8de1b99624e4c65c011f9e10f71e5d807d3ff0eff84eb5606612bbf712ce3094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775244700, "uuid": "d6e96161-0d18-4b95-82ed-ac2934a6766b", "value": "T1D7F3080CB3AAD4E5EA27613850710907AB71FC2A5B1657DF218CE27D3E326D15C3AE72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775244700, "uuid": "ee303afd-ca48-4c52-864e-f94160993f2a", "value": "75513610a189f950956f5109a96d84d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775244700, "uuid": "e1c4eb94-8d5f-4e53-a94c-3af401bbfc65", "value": "3072:BxkiFA7r4xKVVlhxxtJ72x3Dn/TcqHlGyBSaavd:Mi4aKVrhxxtJ72xTfG4fW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775244700, "uuid": "422ec847-301b-4b95-aca2-fa4edb6472e0", "value": 168160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775244700, "uuid": "97ac65be-2928-4c3e-8fec-9b84cfc30014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775244700, "uuid": "0d0a499e-c386-4e1b-978c-da966ce092e5", "value": "sethc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4c3683-2f17-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775191174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775191174, "uuid": "75a626db-6055-4dc2-8db9-53855fead832", "comment": "Malware payload", "value": "ad2416e7e2fefd4cfbffac0f6bfea9fa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775191174, "uuid": "5465c5b3-8b57-4a2b-9500-7c496811bae4", "comment": "Malware payload", "value": "9dc074e77be3d762879a3e447bf191892e917d876c3664a3581c42d33fb98893", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775191174, "uuid": "4cca220a-be45-497f-b2be-b9b6b8402409", "comment": "Malware payload", "value": "c107dcf03233efa42845dc1a33bf4bf00cee172b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775191174, "uuid": "66c0366e-5cc7-432e-945c-8ea793a9cedd", "comment": "Malware payload", "value": "74dc96c77bd59ca1d4e504976796cdaafc3bf51644321823b8490b8280c1b490717bddefd98aeab6b3284af39ffb9aca", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775191174, "uuid": "baf7b985-ce6d-407a-bc00-6d1a011f4e00", "value": "T138A62345B6C2F632C5F9013710FADE3DC2BA7D2059B1456B2A78750C2D333A86369B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775191174, "uuid": "51066f91-bd7a-4e9c-992f-e2e992edc572", "value": "196608:1TBxqTLAIsYGJwIlEJoqveIqC3nYtDByTLAINdSK:1Tq3APJwIMowDXyDE3AS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775191174, "uuid": "851dc99b-d886-4b98-8e37-066b3d8be1e4", "value": 10378240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775191174, "uuid": "c181bc07-8378-4969-943f-10e636230d7c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775191174, "uuid": "1b8eab29-aef7-4fad-b8bd-00146fe6cc1c", "value": "systemutilities.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f178717-2f78-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775232973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775232973, "uuid": "68a768dd-6c56-4803-be5d-33de939b007d", "comment": "Malware payload (DCRat)", "value": "058bcf40526454c01909ce441f8ed42d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775232973, "uuid": "7bcfffb9-8720-496e-8f56-55b0377dc0fe", "comment": "Malware payload (DCRat)", "value": "9f33efdeabd35154a3c3f6bba7955ffdf840e68f07cfae982e9fb4f04fb36750", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775232973, "uuid": "859fb6b2-1904-4fea-bab9-cdbca3ef7c1a", "comment": "Malware payload (DCRat)", "value": "ff43aefabbdca3638d5091feed6d636606c85faf", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775232973, "uuid": "22a4670f-bcdd-46c4-b986-806e661d0574", "comment": "Malware payload (DCRat)", "value": "b0f6bdaf7bebe6e673748dbfa420055fa5fddaeb14a28d6e968e8c7b01d99aa5b45f73588d532add1c6acf2f0b3a951f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775232973, "uuid": "f9f3472e-7155-410b-95b8-cb66d0cddfdd", "value": "T13D15F6027E44CE12F0192233C2EF454887B4A9516BA6F32B7DBA376E55123A77C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775232973, "uuid": "fbeacd03-ad5c-44f1-91d8-229b70098a1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775232973, "uuid": "bc9a3079-b2d8-4465-8d48-36b85b3e22bf", "value": "12288:hO15eTr6eyot/wFSJxDYG8NsMozZ1WHC4J73BhX8lfgaTfdlgr6Y2:aeTWey2wgJRYGeMZ18dxhMtFTHg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775232973, "uuid": "96ca3f78-f0cd-435f-9c7e-b0e545067754", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775232973, "uuid": "9a7ab460-1e71-46ff-9e6b-c31e17b24ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775232973, "uuid": "4dba25cb-0eb5-42de-bd69-5cb4f34866a8", "value": "058bcf40526454c01909ce441f8ed42d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43be38ba-2ef0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775174488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174488, "uuid": "99933a47-41f2-49b2-b85e-737a1ed75e90", "comment": "Malware payload", "value": "fc852feb2df68372afe171a2eb575da3", "object_relation": "md5", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174488, "uuid": "7e7054b1-98b5-453e-b6c1-17cf23d5cdc3", "comment": "Malware payload", "value": "9f4d29c8279dba9f147b7450e8f1000e0a96fa23bf99ed807d21248cf41df1d4", "object_relation": "sha256", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174488, "uuid": "754853c9-6a45-457e-beb7-a93f4680bd71", "comment": "Malware payload", "value": "0f0213cd6a27bf8e567d0d5b5af473192ba5503c", "object_relation": "sha1", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174488, "uuid": "21f15605-981e-475b-8bf5-1230355e9f42", "comment": "Malware payload", "value": "2d4eaa0d99eed24063464a3078975f9c8e7a9c97f7a4e34f464cf825d0cdb3582cae07b2f089c4df8e3fdb1b6875f0d7", "object_relation": "sha3-384", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174488, "uuid": "042768b7-f5c1-438b-90de-55916509620c", "value": "T17F96337C2BE448E9FDAA523C4DE3C16DEA603C0653A5E18707D18A932E976F02C7E715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174488, "uuid": "7069218d-85ac-4dd3-a5b1-05907137cdac", "value": "064967a99ade726316dc79a4a929fe96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174488, "uuid": "b1911d94-ea7e-452b-ac7e-3cb8044eb88a", "value": "196608:buGGLuAPneg2v1Nk2OtvydQmRgaycBIGpEosgALOV:dGuAPp2dNkL0dQE9NsD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775174488, "uuid": "7435bd03-2553-45d7-bac9-cf4754a7e0aa", "value": 9180575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775174488, "uuid": "0686bbaa-06aa-4bac-b186-ce7dc2bafc24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174488, "uuid": "c333785d-d5dd-4fd9-866c-080c87ac333c", "value": "trapstealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d100a4-2f75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775231635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775231635, "uuid": "0f333a64-4c61-4e1e-bfb5-8dfc51de65f0", "comment": "Malware payload", "value": "6ef0fa33ab9cc0bfa806a36d50eb6c23", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775231635, "uuid": "e0a485db-5263-489a-8965-737e7021e935", "comment": "Malware payload", "value": "a10d746078824c081e27887a5db174a58d7526c407b9b42221c601b231cfbd13", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775231635, "uuid": "476b38cc-e63c-4ca7-b2f3-96fdcd0e3094", "comment": "Malware payload", "value": "1ecd16308d63f8e9eb5d638e6335e61492684a40", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775231635, "uuid": "63eefdb0-3af8-463b-9aed-d314289fd350", "comment": "Malware payload", "value": "93b55ce839639038d0004f3e9787407d561b8dcbda2af7daaa6cdf2661c979ad583114677f321937d6e086c8332cbbce", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775231635, "uuid": "83997e44-8325-4507-909e-1927d7d3d4fc", "value": "T1B8042382520A0C14DB6E4B3153ED13F3DE3709748B10194E01E6B6A7AE85A9CFBDC5EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775231635, "uuid": "7887759d-b820-459e-8687-21eed285b072", "value": "3072:jZI+FKbYMvL0Nb+m2Dvmx4MJcGPgLNKHZUzv9uJNTr3ZggKlxBYn:jPcYiL0Ym26x71oBK6zvcRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775231635, "uuid": "546858f2-41e8-4da0-8953-4e3235aa8ebd", "value": 179458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775231635, "uuid": "6e1a70c3-e925-4c4f-bcbf-47699ab9f77f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775231635, "uuid": "9168cc65-e0cd-4ba7-a683-40b9b449a2e8", "value": "Krypton-Crack 1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1584a75d-2f88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775239694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239694, "uuid": "0346d593-3bf5-474d-bae3-e11cb404af8e", "comment": "Malware payload", "value": "cb0f24b5f7e2bb4f82c2312f589981c7", "object_relation": "md5", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239694, "uuid": "2be76ced-4bbe-402e-8c23-519bcf214fee", "comment": "Malware payload", "value": "a183418d37308ca42402a5557474f97a3bea299a1d7c0d9dd5b197727ab9b58d", "object_relation": "sha256", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239694, "uuid": "621983d1-e7e3-461b-a61d-b18402de5451", "comment": "Malware payload", "value": "206a48898398e6875affd843c14b601a9d8cd38a", "object_relation": "sha1", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239694, "uuid": "db09022a-e082-4a4d-84b5-95f20f998d42", "comment": "Malware payload", "value": "7a8f1f87aa5de8e79295b3b5bf2d192490a31053f060d1e389ef53ee4130ceaf457fbdd27e839914d5dc90aa748a7fca", "object_relation": "sha3-384", "Tag": [ { "name": "asfasfqwf-com", "colour": "#6DF39F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239694, "uuid": "596211df-bf7d-4bf3-bb36-8bfaf18b318c", "value": "T117129E1EC7C44C82D1ABE67517908255CD3ADBC44AD604091AFC62D9AB81FB7A632235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239694, "uuid": "c43e12d4-701d-491b-884d-a5a7010b5358", "value": "192:S0RRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+x:S0RRm/wksuQJ/g6dI+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775239694, "uuid": "db6b1619-7b72-4cc1-972d-8d80b512dad0", "value": 9032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775239694, "uuid": "4e69b1cf-3ecd-4d28-8f42-0555044b1355", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239694, "uuid": "a7d9c10e-8992-4de9-8405-4bf81cb12881", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab94347-2f23-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775196619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775196619, "uuid": "1d9584ae-1186-4b94-a0ab-f11618daa45e", "comment": "Malware payload (Mirai)", "value": "e657f7cdc77dd656cf8bdbd548139518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775196619, "uuid": "d368f239-a328-46a5-bd21-0962bd4630ad", "comment": "Malware payload (Mirai)", "value": "a231b7617c57c8d17d3552579e4cd14b82aa112c632ec830643a9bde2034a1f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775196619, "uuid": "dcb32d5b-642c-4c03-81b5-99f51493fa50", "comment": "Malware payload (Mirai)", "value": "7994a3d737cf00eaf91677e2c8c87d9ef34e041f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775196619, "uuid": "8f085935-5359-44bb-a2ee-342fe951cb3b", "comment": "Malware payload (Mirai)", "value": "a10998c2c005ef2ff1148633aaf8b3247c30a5eea3dbf37d90850e46b36cd9c0513bb26115eb127c8333fb8000b0705a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775196619, "uuid": "659e4064-1738-4c7a-885d-04b7c9e8273b", "value": "T191536BC4A543E8F4EC1611757077BB378B76F47A1029EA86D7A8F532AC52B11E24738C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775196619, "uuid": "721e2734-70c8-45b2-a0c2-a5eee956e6bc", "value": "1536:oGQFLedMzp7zk8+R985J28xmiefdXosVwRy8wlATZSugY:VQ1qMzpkhD8y8xmi24s6R7QAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775196619, "uuid": "3ecb5eb2-c5c2-4f1c-8b66-09360db8e268", "value": 65232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775196619, "uuid": "fdcb55f2-5e82-43fd-8dff-52b2276d8cd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775196619, "uuid": "fd1ad822-0067-4e52-a5c3-00c78c2aa738", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c756aa-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775238029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238029, "uuid": "f9573314-a23d-4448-8654-008486c8a043", "comment": "Malware payload (Mirai)", "value": "d86b42a98b3041884ee1ebe907654e98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238029, "uuid": "4f9cd309-f093-40d2-8c24-541ae0b14cfd", "comment": "Malware payload (Mirai)", "value": "a831f00feecaaca1e0b3c2f665fe181380b41f25bef875e96c18d4ba4e56c91f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238029, "uuid": "7b19976d-4dcc-4112-8245-4f33c3e2333b", "comment": "Malware payload (Mirai)", "value": "4601cdf08a2a2371fde549191a688e644ae1a263", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238029, "uuid": "9913e011-0e2e-467d-b59e-a284142d5ee7", "comment": "Malware payload (Mirai)", "value": "8fc61155c65273b1604901bb54dce39b7173a98c710079486dad22d727be69b597df627124ce07e01a3086db17286fee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238029, "uuid": "1c762c38-221c-44d6-b76f-f68d76eaf12c", "value": "T16C93D719BF610EF7ECABDC3345A92B022CDD552721A96B75B930C818F11B24B1AD3DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238029, "uuid": "b61f1d1e-2481-45e9-92bd-84c381320770", "value": "1536:9ztn824KYGMB1PZS0Rlrizm9423iB2ccOXzZIL5rLH:9ztn8fK1OXRl8KWXzMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775238029, "uuid": "9e43cd37-ab68-4662-ae3d-37f9a2c26749", "value": 93308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775238029, "uuid": "3e678a17-d3eb-4dc6-aaed-653516d69cd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238029, "uuid": "cf7e693f-58c6-464b-94d8-db78b86ace29", "value": "yakuza.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b98b541-2f67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775225719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225719, "uuid": "7c6b0519-4204-4881-926a-018972d601bf", "comment": "Malware payload (Mirai)", "value": "ffc8c33c70a1d6e4d3589265395514a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225719, "uuid": "ee54e7e1-a6e6-42b9-b3f2-b573e3a271e2", "comment": "Malware payload (Mirai)", "value": "a8a600d0fc39e006205b4e850fd54f342d2e0d22bd9ff2152cbbcc65849dde53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225719, "uuid": "9b7b16d3-d3e9-4f1b-a3c0-96031a3ad81c", "comment": "Malware payload (Mirai)", "value": "69d6ebe17ff585cc983aeb9c0805a22f31cd9e1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225719, "uuid": "c4cb6a5b-f0d1-4370-afe9-0b86956b04be", "comment": "Malware payload (Mirai)", "value": "d8583b5e2b4e0a73fe1ac98656278eb62af68c769861c0785201880b2a31406e30bb217dbea6f6bdcac9f97495f21703", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225719, "uuid": "cd217452-5f39-4d34-95ec-cf725d1a25c6", "value": "T174D33A06730C0A47D2632EB03A3F67E193AF9AC121E4F640355F9B8A95B1D335586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225719, "uuid": "f4e8947e-3bb2-47a7-a479-3785dc44bb02", "value": "1536:GEUuUwJzrscg3IBU8NxfytBteYEXejatwFF7l7AJvAhh5rp+2eIq3zi7Wf:z1U8NxityhwD7l/hnaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775225719, "uuid": "8c7539a5-7a7c-4dcd-9283-6b599b0be12e", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775225719, "uuid": "9d1edc71-402d-4091-8f79-3ed30a6c96fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225719, "uuid": "dc746cee-c213-4696-9bd4-2974c2ff6fa9", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078bbefc-2fa9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775253844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775253844, "uuid": "b085b6b9-a0a1-4c13-b4d6-c4752c3778e0", "comment": "Malware payload", "value": "ea0b59c71f652500e0515d692c746660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775253844, "uuid": "aa6b5fc8-bed9-436f-8479-27a05222d3c5", "comment": "Malware payload", "value": "a9d29e1627f0aa70741cc6ea1795b29317b1ba47a6e7f49ecba24808d1b62a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775253844, "uuid": "26086db0-18aa-4468-a599-0e7ce4f01ffb", "comment": "Malware payload", "value": "301699d7cc4383aad869e3912c838d2160321d6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775253844, "uuid": "8068bc6f-d8b2-4ff2-804e-c2e7bc2eae54", "comment": "Malware payload", "value": "f9b9fb2a2f0bb6c41a8b6863219ca6dd3afc4c871ae30b2c6c5c1b6e4b73bfbaf664f9450be4edb911901f322fed246d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775253844, "uuid": "73617675-4ca6-4675-abca-94b10d525bb8", "value": "T148E22913635B04F8F2A7637886D7220ACBB6B855132297CF53C2C11A1F6A6D0ADB7F51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775253844, "uuid": "4a9625a4-a275-411d-afff-3b3978e835ca", "value": "04a2d32ddf9641423957aac10c22bad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775253844, "uuid": "a9ff59c2-0093-4db7-a899-2d311f23b69b", "value": "384:fvBvFf+KNxktM6whHYFcjdaCw7QOAOLcIJV/wNS0mOm3dSYeWwyc8q392k4:HXL+Q2YtRm3kPTyct3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775253844, "uuid": "96e08ef3-ec6e-4f60-ac51-db70c6f54913", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775253844, "uuid": "ba2560ea-eef6-4b63-9887-3e456f7e9bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775253844, "uuid": "12c586a2-40e3-4e72-bd88-183c1bde03df", "value": "0KBAttack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e67ce8-2f8f-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775242807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242807, "uuid": "60e6ed6b-6e07-4806-8d8f-1776d4057c10", "comment": "Malware payload (SpyNote)", "value": "c6e5eb4deeb8fe76f151477304a25ec1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242807, "uuid": "d58fbf53-7410-47d4-aebc-55a6f047edd3", "comment": "Malware payload (SpyNote)", "value": "ab1363201d0897ab7c55dceb1f8664a58ac65fe4aee3c9600c5d7659f8ae58a9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242807, "uuid": "5960e0b1-1925-4b7c-b3e1-407b58f6edc0", "comment": "Malware payload (SpyNote)", "value": "bf8a5b4c938a5159938f5102d9a416b6555704a0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242807, "uuid": "c5b0e26e-66b1-4536-ae17-7dceae3a1e74", "comment": "Malware payload (SpyNote)", "value": "7b0c76cb9f4f1cffde86350ea86111f6d69888f6bbeb129323d0ed95450571f6d6a94918bb24e8909e0c96d870003021", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242807, "uuid": "afe554fb-06d0-461b-bc5e-eb443730c1dd", "value": "T1B4260243FB45DAC7D8AA93F66F630DA91A030F14C642BAE70461762D3E772D14DC6A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242807, "uuid": "32c6cbfb-071c-4379-b3e4-759236a3183f", "value": "98304:4Fy7PQROiNJvdEOF8AVBv/wFmz7zB7TV0t0aBsX:JPQlzvdEapv/jz9qFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775242807, "uuid": "abf30e61-ac25-4dc0-b057-334abf92d290", "value": 4660698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775242807, "uuid": "81110ce6-54bc-4c80-91d3-4096ff9626e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242807, "uuid": "08c0c4e5-8f9a-44ef-919b-40b833dbcc74", "value": "Blockchain.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa98daf8-2fb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775260560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260560, "uuid": "bdf16c43-2377-4cd0-8484-5a0acc64787a", "comment": "Malware payload", "value": "58b852aba06cc56d5a74ddecf10e42ec", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260560, "uuid": "50d33c51-59f0-4eda-8dfb-66a006853a15", "comment": "Malware payload", "value": "acac67b74934c101ce0199b4dacbdbd934a3c9839e200820a3f51574abf38f9a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260560, "uuid": "10248cad-fafa-46fc-8326-54ded63e16dc", "comment": "Malware payload", "value": "996bde8ddb0d4971c8c419dada9bdf1c97046a3d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260560, "uuid": "8a7e8fb9-b37d-4cbe-99a8-d97628445bad", "comment": "Malware payload", "value": "0d8a0e8a0754bf8f950457cf5bd78aa2449732cabe254cad95b3e95130d31c28696b85476f71b6921a64a15fb6dc7b32", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260560, "uuid": "5831aaaf-950d-4cb3-8edd-c17d969fc132", "value": "T1B287331BD4A0D1EAD8330D7AD45B1C265C433263D160635DBBF81A09BC9A36E3BA7673", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260560, "uuid": "4dbec2fe-42de-47e7-a72b-546291e83cfd", "value": "786432:qUFXYxU3EvI2TWCnqRju5Yb0qIuaal0sBe/sOkpYy1gNVF:qUBYaKTzqRju/qIu0s4kOkmyqVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775260560, "uuid": "afc6587e-c94d-4947-8b0e-d802bddacf32", "value": 36363603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775260560, "uuid": "228ca94b-3eec-4b1f-b3bc-b23cde2ae4e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260560, "uuid": "d7cb2b23-5900-4240-a4bb-966888f98e1f", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3211e8-2f8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775242900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242900, "uuid": "91a24339-ebf6-4bbc-b2f7-3961168c9e24", "comment": "Malware payload", "value": "4496929bdabf370529a4b1c648116225", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242900, "uuid": "6a27788b-5ce5-4904-9e3b-c596248e2769", "comment": "Malware payload", "value": "acb43101cf206f93d177aff2ef5231e9406d0cd3faf62cf30c2ef1295c9b0d05", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242900, "uuid": "357a9e1e-db0b-4732-88fe-1aec17ffe71d", "comment": "Malware payload", "value": "c95db3bb633f441db24c6cc90a601fde03323f12", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775242900, "uuid": "5560468d-d926-4245-ab0b-1e93bb1a3324", "comment": "Malware payload", "value": "be334ac4612263466795bc6eded05fd6363715b1a589e673d135604d660de2c8489e2f157a22ee8d557ee82863a6d40e", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242900, "uuid": "c4d783cc-22d4-4d42-8845-71695ef6e3e6", "value": "T1F1E6338003D14AB6FAD7E13D46A7E115D2B2F4505B2286CF4BE4476A3F5B2F14E3AB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242900, "uuid": "23d3c033-f6fe-4ee6-8d69-7ed0cc47110f", "value": "74f4f918cc15caa2178da4a8adcd29a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242900, "uuid": "61243a02-4cad-44ee-a438-e3bb31e9786c", "value": "196608:TCApNL4ztbW897GDr/x7eovq5XMP6PzFcPVz097WpHskNqSPrGuZRjMFqbH4Mirc:E1yNdq1B7iR0gpHskqSPjZpiqbH4a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775242900, "uuid": "29ed729b-8f92-4ac7-8e0d-6d5e6a258e09", "value": 14059008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775242900, "uuid": "7d2d13df-bb06-4c7d-8380-de048b7ad81d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775242900, "uuid": "da22d338-52b2-4263-9995-776aae727579", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dad5cd-2f4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775213417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213417, "uuid": "db3acc11-4051-42a1-95e5-fc3afad19645", "comment": "Malware payload (Mirai)", "value": "8b640456d25b0b5a9936020592fa6fe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213417, "uuid": "66e9acf1-ff6c-45f8-9151-ab73e6517a8f", "comment": "Malware payload (Mirai)", "value": "ae9922b4b6ad2cfae21a02d29cccbff0353f83073b408b09efa1a21b34940389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213417, "uuid": "31044509-de1c-46e2-bbe9-9fdc0fd3ed80", "comment": "Malware payload (Mirai)", "value": "aeb8f4e60f8e01873609e5bd46095b552938698c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213417, "uuid": "734b9af4-d181-4d93-834a-53a425be8e0e", "comment": "Malware payload (Mirai)", "value": "cbdcd8966b9dde016a700ccaf1df88baf89199b8b57ff7c6ff0e918df5d8e10315eddb3b6c42075e12f49bfd47439568", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775213417, "uuid": "5bccae66-5867-4387-9638-adb501e54df1", "value": "T1F9242B46AA418F13C0D627B9FB9F424533339B64D7EB73069528ABB43B8779A4F23501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775213417, "uuid": "28d9a690-1647-4746-b4df-b2da926141af", "value": "6144:DcQ0pNZsdrwallv4JRijAWyKyav2TSM/RPQrEV:DLdrwallv4JRWBdyfT7/+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775213417, "uuid": "befa8ae0-4cd2-4174-86cb-fca0b62f903c", "value": 219984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775213417, "uuid": "e31e878f-948f-4bc7-b490-97de05bb0494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775213417, "uuid": "2cfa41b0-9fe3-4d94-9e7d-1958e0117392", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f675a0-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775238032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238032, "uuid": "c4361ecd-a4a2-4774-9e01-21da9dca2955", "comment": "Malware payload (Mirai)", "value": "dfbe7e2dfd03fa2d92878062584b2009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238032, "uuid": "7a240fcd-04cd-4708-beb4-ac6d4cdbcc23", "comment": "Malware payload (Mirai)", "value": "aeabe2302b00c6bf7688e44d8c1abaeeb4aa803ada23f8a5c71004cc06431433", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238032, "uuid": "04fb884b-7389-4d4a-9e6e-c0114264496a", "comment": "Malware payload (Mirai)", "value": "cdbfef3998d12c816abf4804bc3ed6174637659a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238032, "uuid": "3cc58e10-da48-4071-a3e0-a350431dbeab", "comment": "Malware payload (Mirai)", "value": "d29189a2833f791fb58a8303924f6d1955a2f7e5d2d70714920bdba5edd8dbf9274d4d799aa825ed58892b254ce9ebf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238032, "uuid": "782c82e4-1769-4bdf-b60c-03ce74e2bd63", "value": "T151632A0272180E57C5E71AB0353F1BE097FEEED022E4B6496A5FA7598A35D335482F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238032, "uuid": "b9f40eaf-8f32-49d3-aaf7-2d224712ebfe", "value": "768:G3pu0cF1u3QY+4+WI5UTP/+T1+qqPrHaLv8DNXbjwZmXD2wJS13:icF1NUfTjbjoIjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775238032, "uuid": "61dd4aa3-5703-467f-adf8-42ce45602ac7", "value": 67340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775238032, "uuid": "60195ae2-b6b1-42e9-a7b5-28398d774b3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238032, "uuid": "6876176d-5907-4245-a2a3-0c53bfca1ccc", "value": "yakuza.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212fb824-2f65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775224682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224682, "uuid": "09a4b0e3-1c33-41fc-a6f2-b460832da3b6", "comment": "Malware payload (Mirai)", "value": "8df19b09f6f70a1bf59136bba61eba83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224682, "uuid": "c84fa21e-2cc9-48f5-9488-c39e160dbe14", "comment": "Malware payload (Mirai)", "value": "af40853f4f25f55ac2239bb15e945d5c97b6ad9d218c34307b1ad4c659efb0a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224682, "uuid": "eda2c473-9cc5-4a1c-962f-36204fc2d051", "comment": "Malware payload (Mirai)", "value": "8fbde99462dc74ec90a3c678a8c5d96c1589c1a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224682, "uuid": "368e4c0c-fdac-48ea-a259-1b69bd542d03", "comment": "Malware payload (Mirai)", "value": "47f4e3d8f5543d06026d7ce8e5dc721d4a25281ad5d74612e1796fdb27d73128df42a795aef526259cd192e40483b8c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224682, "uuid": "a57e8022-c1fb-4f96-bdd6-56df588f8de9", "value": "T11944E81A3E228F7EF26D873047F78A31975976D61BE2D644E26CE6101F1038D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224682, "uuid": "6be51349-e132-46fc-9c62-4d94d2b0d289", "value": "6144:xSNi6SsiZOJs7hR8BDj3x8dQo4jZ4nWmfrvZDmBAVp9QZr:x0+lhO2d74t4nWmfrvZDmBAVp9QZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775224682, "uuid": "34797985-1431-4fe1-b8b4-b19121dc98f6", "value": 270421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775224682, "uuid": "5ec7026e-87ec-4fb2-963d-d72c549ae6b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224682, "uuid": "8a422b01-db96-4174-8df3-70917854b8b2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd48352-2f79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775233323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233323, "uuid": "f7788ca5-5cd5-427f-968a-2bd9f25f085d", "comment": "Malware payload", "value": "df027b47a5036fd4ea26481b9d7ec602", "object_relation": "md5", "Tag": [ { "name": "filesman", "colour": "#3EBCFD", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233323, "uuid": "6372a38f-f946-4aa7-ae50-2207f4970317", "comment": "Malware payload", "value": "b4693f478bc03f719ad19a2724e3219cd0310f7180fcc4e59c796774ce40234b", "object_relation": "sha256", "Tag": [ { "name": "filesman", "colour": "#3EBCFD", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233323, "uuid": "41eb2698-7ef9-4f65-9db8-e9bcc56f85f8", "comment": "Malware payload", "value": "ef9ca54fcf1875012a93b66f3c7893103a113599", "object_relation": "sha1", "Tag": [ { "name": "filesman", "colour": "#3EBCFD", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233323, "uuid": "ac6dcb25-ba95-4706-aab4-9577998211eb", "comment": "Malware payload", "value": "edb404000c60c977f035e67ecaedac49dd53a25eeb25f06d3ef1fdc4d7c4e2c4b118c96e5de4d517dbbc03cd4bfa2e4c", "object_relation": "sha3-384", "Tag": [ { "name": "filesman", "colour": "#3EBCFD", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233323, "uuid": "5252f090-c88c-4d4c-a26a-ce4c7c0595af", "value": "T166C2AF47D21EEF5726102C2F7DA83492E56CCC8AE496A2D5FFD36C1FF004CA829A4E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233323, "uuid": "b958e6d6-4906-45c3-b8d1-34d8464eb7df", "value": "768:q/tKzoCVgdOj7GiWda+nKvReddCdTOTolYa:GHdOeiWdOede6oma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233323, "uuid": "208f18a0-0076-4141-b430-f7e4ef2b1793", "value": 26025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233323, "uuid": "e9d7ea24-29c2-46fd-87e0-b9a2d411384a", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233323, "uuid": "45edfdd2-8978-4ddf-a2e4-050800ec0be0", "value": "filesMan-webshell.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2588f7c8-2f7d-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775234997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775234997, "uuid": "118453b0-2ce0-4035-95f7-d5b3b46c66eb", "comment": "Malware payload (SpyNote)", "value": "00042fa56e1113e00c44f7630ee3e428", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775234997, "uuid": "890894f6-b3e6-4398-9609-b399d6ae8b26", "comment": "Malware payload (SpyNote)", "value": "b600af54745d2cf6529d048e701b579368af19ff69a08b5ae26d1f0d0a706047", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775234997, "uuid": "751c010a-3764-4829-a239-cc840cdf02ef", "comment": "Malware payload (SpyNote)", "value": "a1ebf362592c10a00b892a6dec930134be6163d5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775234997, "uuid": "2b208c8b-a558-4516-a007-acaaaeb87fb3", "comment": "Malware payload (SpyNote)", "value": "e7721b580fc89d0ec45af94c014e192d2d6dbbf3c68bea72a36402b7f0d331bc7608b7b68a7f626e888d2acc698b9f13", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775234997, "uuid": "8ca3c1c7-1bc7-403a-8357-aca385d582e2", "value": "T11E26F103FB54D68BDAAE83F26F270C9916175F14C692A6D740107A7E2EB72C10DC6ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775234997, "uuid": "53ef825a-1038-44ba-ba56-339db3d440fc", "value": "98304:AT8OFRGW75+bJ8UvBVMyLbGmzozBXTE0t4g98L5:LExQZVMyL9zM33e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775234997, "uuid": "af4517b2-bb0f-42d8-b0bc-ca8319f20017", "value": 4576381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775234997, "uuid": "40cbedda-255b-4f66-b13e-eb245828dc15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775234997, "uuid": "bbea6634-8e6d-4e00-991c-3a99dd17da5b", "value": "Google.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6771fd4a-2f1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775193017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775193017, "uuid": "dab81e1b-9ffc-4b4d-a733-96a2ff5777fb", "comment": "Malware payload", "value": "e4ebb8699c6b9dd98ae2116ef80657ef", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775193017, "uuid": "20880b69-9884-42c5-9f86-f54ca6e7075f", "comment": "Malware payload", "value": "b6e6dc4ff0e24d915692b113a1f1414518503e92ff21a394e9f38d1ca2ab4275", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775193017, "uuid": "1a4808ec-1092-43dd-ada7-b00c66ecdea4", "comment": "Malware payload", "value": "41521ea14359ed22c742ae6a516a6bcb1f371fb3", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775193017, "uuid": "5373f9ed-502c-4906-b603-0a8434ca3dca", "comment": "Malware payload", "value": "402fd1434934337bf9cdbe99763e30050384304e7153e3859c3723201e252d2230994965a8a0ea45b5fe444acd8a7cc9", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775193017, "uuid": "1250d272-a397-4d01-836a-781867ac9713", "value": "T12508AE0662F90199E5BBD238CA674603EB727C15133197DF02A47A692F33BE15A3F361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775193017, "uuid": "fa505dbf-db9c-4bdb-8e75-f4d53de90bb7", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775193017, "uuid": "576216d0-287d-428a-b9d1-3fadf93a79af", "value": "786432:ZnWW6dG1HCi1dfQu64u3OZKvoKDad7eV4CWW6dG:adiFo3MZYQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775193017, "uuid": "2600bf5e-37cf-4586-9620-ca2d354d6fcd", "value": 80303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775193017, "uuid": "940f1635-ce3f-44b1-9c7f-96435ecbf691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775193017, "uuid": "4ab52006-5682-4055-b035-b1f518a2f74b", "value": "xy_game_31B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1348079c-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775237973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237973, "uuid": "7a89f022-d8db-4611-97f2-b45d0a645fa3", "comment": "Malware payload (Mirai)", "value": "b5801cd365e4f5aee97629c2af1339f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237973, "uuid": "d963949d-e743-489d-a0bb-34363b729fe8", "comment": "Malware payload (Mirai)", "value": "b6f3c909b03cb77db83da429adad2ab06c6634dde3129b146230cf6ee5e7946e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237973, "uuid": "69e71bd5-7d72-4356-b39d-353810867167", "comment": "Malware payload (Mirai)", "value": "666f230efa30ce224358988d5139f311fef4af04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237973, "uuid": "fc07308d-6628-4350-bd70-db9796cd78e5", "comment": "Malware payload (Mirai)", "value": "8a4c43f5f8a6d97d772006f187f059a8593f0571e42179e5a868a841a20e30cfff8ae28e84ce3f3f68f6dc7b2afdb84d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237973, "uuid": "df8aa711-bf66-4123-933b-4b24acc990d1", "value": "T15AA2D071E550AEF2C1788C719DFA4A421A5A6F6ADD9370705B6C02BCFDB14433AF80D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237973, "uuid": "332ddb2f-917e-41f4-8829-9a27dfa4771a", "value": "384:KB9EFDBvbuoIQ2+EfD50Q1cZgFXCJAH7Fsf9n26h7lRVihoPmLkaxmdGU5E/ln:i9EFNbWOccZ4XP7Fsf95hx8RLZ3UcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237973, "uuid": "41f78b4c-4230-4a58-8531-aadf5866ba4a", "value": 21824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237973, "uuid": "370e5a58-5363-477a-953e-17242bade885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237973, "uuid": "d32740b7-f650-41e4-a927-8a03474f8709", "value": "yakuza.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24500842-2f82-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775237142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237142, "uuid": "5985fe3b-a784-4ec3-a08c-a0c3790ed484", "comment": "Malware payload (SpyNote)", "value": "a799d80da633b900deca820012e94b62", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237142, "uuid": "d79aff25-ebbb-4589-8f43-827bcaa415cd", "comment": "Malware payload (SpyNote)", "value": "b9fb2177e55ad47b2df74ff642bd3ee5058d392c3e2e272b93bec263aa30eeef", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237142, "uuid": "f85ee671-777e-43ae-94a4-001a1d9d224c", "comment": "Malware payload (SpyNote)", "value": "6a4e10cc7527d7e3da6f0911d695089be14bc30c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237142, "uuid": "95e31e69-86e9-4653-aea1-b7b4236398b3", "comment": "Malware payload (SpyNote)", "value": "14a83394491466b4e06fbc7b0c7a5fc6115bc12e01947643560d350ff8421be4de085a9d0999457d52a77ce8c064eab6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237142, "uuid": "531c8c83-f890-49cd-b639-d7c6a2e85036", "value": "T13B26F103EB58D68BDAAE83F26F270C9915175F15C692B6D744147A3E2EB72C10DC2ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237142, "uuid": "037c0344-0530-4786-ba4f-20d6fbb27a90", "value": "98304:XIT8OFRGW75+bJ8UvBVMyLb2mztzB2TK0toUu9c:XzExQZVMyLdzWp3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237142, "uuid": "c49c9263-3f42-46e6-9f75-59ea105a1cb2", "value": 4578771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237142, "uuid": "2b38a132-80ed-473d-ab2a-d4d5c2093dfd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237142, "uuid": "d9828635-bbab-4814-86fc-6830a21cd59e", "value": "a799d80da633b900deca820012e94b62.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2862c1-2fa3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775251647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775251647, "uuid": "040d08c0-ef9c-4b44-9507-5b3c949acbab", "comment": "Malware payload (Mirai)", "value": "614c816d3569691675229f43cf973f57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775251647, "uuid": "6a3fcdc7-04bc-4492-8d5c-d18cdaa58ba0", "comment": "Malware payload (Mirai)", "value": "b9fc06697cabacbbadea8a4a80bf6681c5dd2e984f1ebe067e790531b347b886", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775251647, "uuid": "388de578-5c3e-4d51-a88b-9bce2ea8be2c", "comment": "Malware payload (Mirai)", "value": "ceacff52be875fd3e3fc5d90d56d1c639393c47a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775251647, "uuid": "8aceb1b5-d6f2-4cfd-8862-6c26b15f50cd", "comment": "Malware payload (Mirai)", "value": "d6b1f48841b9a098d5eea26a0f264b4df7e652253ec1697613097aae6baad52fe6b55e31281b739c9854ac214ad9bf85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775251647, "uuid": "827e8d90-6cb9-410a-ab5b-8977e82fda1c", "value": "T173243B46AA408F13C4D627B9F79F424533339B64D7EB63069528AFB43B8779A4F23601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775251647, "uuid": "936c23d3-9567-42ad-8433-fb903a8728f4", "value": "6144:+qbDobgcRvsHaan6Pia29Aa3myxBr7HtM/R+648EgV:CRveaan6PiaYF2yxlHW/Z489", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775251647, "uuid": "db3f1b0e-7537-44a6-b3b2-61b96089c660", "value": 218428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775251647, "uuid": "025afad9-5902-47d3-b292-3541a88ccfbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775251647, "uuid": "108901ab-ba5f-4577-9fc7-61cb5534fb40", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc01116d-2f1a-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775192836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192836, "uuid": "cd2c427a-553e-4af5-a1f2-e90b349d10a9", "comment": "Malware payload (LummaStealer)", "value": "30a102b44359ad90be377bd2045f8f53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192836, "uuid": "7093ee15-7c9b-4147-a46f-9a88bcd20cbe", "comment": "Malware payload (LummaStealer)", "value": "bbe32a257e3aefb42f557ca65ae171faedb5718283801348e3ea990015ec2db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192836, "uuid": "ac168948-abeb-46c0-8f84-0727ce06d67a", "comment": "Malware payload (LummaStealer)", "value": "dc0c3833213b43d44460d9300b0a68b7a45d2354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192836, "uuid": "399906c1-07a2-4edd-a6c3-0f6eddbbba59", "comment": "Malware payload (LummaStealer)", "value": "18a984a1c4cbab05479a3778b5d7c7389981b098ba6c885d3edb86362bdd4b7c9b3c3f9de7d501c3b91513521be3b52f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192836, "uuid": "732c8282-74a6-4d77-8715-87482a2626e6", "value": "T11B563901FE8B55F5EA43293101A7B27F13346D058F29CBD7EB847F6AE97B2911932209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192836, "uuid": "3f7074ef-f390-4fb5-9ea1-1c2a354db56f", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192836, "uuid": "63eedaf8-66d1-434f-ae6f-2dab89f61d51", "value": "98304:WvendQzGF0hmdAw7Zo1XIoRmQU1y3VfBE+:WrP4qF0QU1y3VfC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775192836, "uuid": "8fdd17dd-a8a6-44c9-93c8-fc7ac8c786d0", "value": 6340608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775192836, "uuid": "927c9e5a-026c-4a79-a996-3b6e56093468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192836, "uuid": "c4bdcba4-47d1-489d-8e55-45ba0b1e9dbf", "value": "33d2ede41373ccb57c46aa7f608f7b8610cff511500eaa80c24427a1de11bcb0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e920287d-2f78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775233177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233177, "uuid": "8fc62064-e6e8-489a-82d1-7482edd7514e", "comment": "Malware payload", "value": "68d8501b5706d16336fd515f9a954f83", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "tinyfilemanager", "colour": "#7A418B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233177, "uuid": "341a9ba7-4865-4e96-9860-7063aa717f40", "comment": "Malware payload", "value": "bdff9411d45a403a9b163ad48562752f67bf768ea6e268f08da4c3c16c1a52c5", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "tinyfilemanager", "colour": "#7A418B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233177, "uuid": "6c4c8ee0-6fd9-43ad-ba47-b625e3a52d8a", "comment": "Malware payload", "value": "b544addc15ae9be4244b92f4ff08338b0724bc8b", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "tinyfilemanager", "colour": "#7A418B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233177, "uuid": "8ef15580-1df7-441c-8188-ec3eb8a27ae7", "comment": "Malware payload", "value": "70c5707e953d41b34de59b44c892b380539ffa141dd3d28d6d32fdde6dfeda8a071830b63c02e07b1813d52cf7c2f82c", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "tinyfilemanager", "colour": "#7A418B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233177, "uuid": "d8b5f44e-453e-4c3e-b49d-f160c9b3ae1f", "value": "T191042916F6F8257B4217B4E81E97544C3AAE803BC2061D1EBD8E52D81FC486DC4BBF69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233177, "uuid": "97f883d0-2c52-4d90-b5ce-0d1238d4014a", "value": "3072:NZTZCs2XULSPv68XsGPKBTUIvr38PUYkA1uOFmS85vnDrPDEr+Fqu5JVPNdhb+A:pCPeLSsSuAQ38PUYkA1ummfv/P51hb+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233177, "uuid": "dda97820-6d32-41ad-bb6e-df2d12155502", "value": 185399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233177, "uuid": "9c427f64-d44d-4ba6-b34d-11b8107b6791", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233177, "uuid": "cd1ba828-c559-4019-bb0b-968bc1f342b4", "value": "tinyfilemanager-variant.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae69554-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775237959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237959, "uuid": "f36afe0f-92dc-45a8-9946-d4dfa4f56dc7", "comment": "Malware payload (Mirai)", "value": "1c7d39642bdf12fa6e78935821166ce0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237959, "uuid": "8ceaf14f-3e03-4e22-9650-9e9ab4b81070", "comment": "Malware payload (Mirai)", "value": "bf274f6580e032bb802de68316f9d8accfdd55187cab378a806ad43296c4be90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237959, "uuid": "87f764ef-248f-4d96-955b-f510324e5e99", "comment": "Malware payload (Mirai)", "value": "42630874e1f7380f3dfd1a78318bf531006189ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237959, "uuid": "4bcf9bc0-b14f-429d-8d14-4be717380653", "comment": "Malware payload (Mirai)", "value": "55ba7006714017be8bf585672204dadeb3c650d2c237983d355dd6ff02ff7d338501b941a87d407364452f832ac66d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237959, "uuid": "b514e4a5-76ff-4f1b-9c4a-4906e6941471", "value": "T1C9D2E1632D225716A9310D76A9630553F78DA9E9C39F674B03E90AC376E141BF38382D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237959, "uuid": "7ff01541-180d-41e5-8186-c8ef3d29ff0d", "value": "768:EedY5z9VaOtyNpaHzERRKCjvO8a8dmDinTJVcw3yq3UIhQ:EedY5BESzkRm8a8duinTJWGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237959, "uuid": "c28c82b8-0a18-4673-bd2e-69e86f1710aa", "value": 30736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237959, "uuid": "35061c02-3396-48ec-88d8-4996e6b58fd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237959, "uuid": "7da5a992-7d72-4df9-ad9e-1f091a1f5f2a", "value": "yakuza.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de99f7d3-2f07-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775184627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184627, "uuid": "5cc81729-5f0d-4041-b67d-e27e83841ae6", "comment": "Malware payload", "value": "c49fa859a1a0b22d827e776e679b6f27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sabsik.EN.A!ml", "colour": "#CED05C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184627, "uuid": "f6a853ec-96fa-4481-9857-790a098a8926", "comment": "Malware payload", "value": "c0a738bc221d179d788329e18996be3f53717c14f71cce3e1f4de4f316f61320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sabsik.EN.A!ml", "colour": "#CED05C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184627, "uuid": "1dffe1b8-4807-4cbd-899e-894acc9f26a1", "comment": "Malware payload", "value": "2530395297ba86e8de02fd8ddf9e632acc85941d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sabsik.EN.A!ml", "colour": "#CED05C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775184627, "uuid": "529eac7c-fa27-4daa-9366-d67dc1928766", "comment": "Malware payload", "value": "513cd1e0c796de13b7fff80855aea1c6f5e922db1c24f5c2969f2e6c11cc0f697684920663feeaa09e76273a16acb4ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sabsik.EN.A!ml", "colour": "#CED05C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184627, "uuid": "ee3e59e1-cb20-48a8-b684-1b955a1b4ee3", "value": "T1A8A733DED132B1A7CBACB5B54A4A58C2B4524FBD152D3038FD977808A4FDB06B876234", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184627, "uuid": "fa0b1c9c-ad9e-49f1-a45a-f7d2ca1bab15", "value": "b484b52df60e8d823b647a09bb1e39f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184627, "uuid": "5f717770-d05c-426b-a70a-39f4a568794d", "value": "786432:wqimQh2S8Ll5BjlpAgTxcA64TSQscEOqLrhkfaq/PsHFiHNQV:wqxQslggTxB64WpJOqLKfdklyQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775184627, "uuid": "d1b898a5-7195-4f1c-986a-29cb67892cea", "value": 44812188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775184627, "uuid": "93811ffd-b51e-4eb3-86e4-9b9bcf4c1c42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775184627, "uuid": "104c0eb5-19c6-416f-95b8-cf27d17a73e0", "value": "68IEY-\u5b89\u88c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c607089-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775238042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238042, "uuid": "ee9083a5-350f-4a31-8b06-1b052f7afc13", "comment": "Malware payload (Mirai)", "value": "d819012febd038c445e7641a507187a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238042, "uuid": "faa78c25-9189-492f-a53f-db072473c355", "comment": "Malware payload (Mirai)", "value": "c1643ec1b857dde1f1b7ee06a217de9b29efb1ebd13b2d59d078aa9743952913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238042, "uuid": "2e34bcb7-6c8b-491d-985f-3b5ecf6488e1", "comment": "Malware payload (Mirai)", "value": "9652edb3ae535c37f9850aa462b454eb21590604", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775238042, "uuid": "f701e6ac-826e-4b58-9057-e9c231162a67", "comment": "Malware payload (Mirai)", "value": "c1e4c2d728a8aaa2b7d76b2044de0ca4704959f4a251df933f7c6df6230353c65f669e0577b880348ac75c828f800709", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238042, "uuid": "20c02c5e-cd7a-4777-8f4f-6590f798c660", "value": "T19993951D6E268FBCFBA9C23457B78E25965837C723D1C142D17CEA111E6024E241FFAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238042, "uuid": "6adb107e-0cc7-408b-a3e8-789754d3ad5b", "value": "1536:V41ekkK9VHKN9K5cxtmqu6dEMs69rCCE/iLs7/tMix06+qN:ge0VHKKCtmquuw/iL+lMg0CN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775238042, "uuid": "bfec65f7-e6c7-41e3-bc35-cd1070d7c407", "value": 93308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775238042, "uuid": "a66fac32-ac82-4a54-ae39-65d791c813e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775238042, "uuid": "9e9fbca7-e289-473d-8382-76cbd6eaa3a2", "value": "yakuza.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9422728b-2f99-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775247208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247208, "uuid": "bbd59282-f364-4c10-982b-b74e403237fa", "comment": "Malware payload (Smoke Loader)", "value": "8479938a2f802be5445e5a1bb2166b2f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247208, "uuid": "66e2746a-e6be-4adf-8dfa-dad095609791", "comment": "Malware payload (Smoke Loader)", "value": "c319582f5055ba85151a0c7c2d4a5705ae5fafe23f0427d91a269b200a0843d8", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247208, "uuid": "37de2ed3-b713-40be-8995-83c68b49a323", "comment": "Malware payload (Smoke Loader)", "value": "e160ee2b18f30ce26e3c2159b8975a68393960ed", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775247208, "uuid": "fb65e65f-dfcd-411e-b502-e0f0f93f1ced", "comment": "Malware payload (Smoke Loader)", "value": "9c9bff2cd09eacc5b3da29613279c907ec4afaa9c8c38fd26055c28ce60870ad5ca86ccf8538c672ffafa91866f4b3c4", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247208, "uuid": "7013dbf9-6a28-48d3-91b4-da2df3380ec2", "value": "T10F95F15A47E3658FD3431FB855E0E324C578F3AE1E6F4A3B316A8DADF62C9842450B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247208, "uuid": "dc893939-660b-41a5-abe9-8b2d87e06fb8", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247208, "uuid": "9fda7aae-89f4-4fbd-9462-1f6e75548100", "value": "49152:np12grUjvE87WaM0Zl5cxffd8kWWLWdIq:npvSvEuM0Zl5+1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775247208, "uuid": "e1cf32fa-f1f3-4c13-be33-74a9f2dcf88b", "value": 2031104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775247208, "uuid": "0dd193ab-ef10-4ff4-92d1-60cdd85628d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775247208, "uuid": "c08bcc86-e88e-4b24-b0b6-69c5d8b3a3b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3de80e-2f98-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775246817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246817, "uuid": "1f622406-7f94-49a8-b6df-ef4fd3729d06", "comment": "Malware payload (Smoke Loader)", "value": "387c8b393acfcc13d4c8f4ee93b307fc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246817, "uuid": "03c41d0f-504d-4602-a7f4-921d2bab9a3e", "comment": "Malware payload (Smoke Loader)", "value": "c75b512cabcd93a14c3561deeb3a42c1437a12b20d46042a869bef99c2c252a0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246817, "uuid": "cbe389ed-640a-426d-9239-61e3d6852239", "comment": "Malware payload (Smoke Loader)", "value": "4ef37380a464ba208e030492c47a54fbb29e15f2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775246817, "uuid": "d717413d-6e88-4511-875a-84e90cf7f611", "comment": "Malware payload (Smoke Loader)", "value": "37c6b3267f8ff1408629fda3b4f9313220e38eb1857957fd49b390d7e434f9aa763f4d8a50f19ac129dbd4063cc282fa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775246817, "uuid": "07a4d035-d869-417d-bdb6-02bf36139972", "value": "T16F8512C3ABEA1D27F5A44B7080D34607E730F5D8A7BA5A7F3510607EDA122D24D3A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775246817, "uuid": "d2bbba2e-1ccc-48a6-b500-d13324394da5", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775246817, "uuid": "b110a574-1dfd-4400-a794-06e129991a4b", "value": "49152:QhYgJNx0788X/BiA3VVypJNCbGC7AC9cx:9gJ05iIV17AC9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775246817, "uuid": "6d23a291-2106-469e-8fa6-9a2fec860a70", "value": 1808384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775246817, "uuid": "a1b0bf5d-cdc3-4d40-b770-f363bfa4afac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775246817, "uuid": "d53e5b24-b952-4d14-bac5-5a4375e28393", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6be43f1-2faf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775256769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775256769, "uuid": "f3e079e7-a8a0-4f25-b2ad-e6a856043483", "comment": "Malware payload (Mirai)", "value": "35d3ed6cc4921af4feafa5e460ad9775", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775256769, "uuid": "0cb9b2d5-bac5-4f20-8f2c-b69c2f90afb8", "comment": "Malware payload (Mirai)", "value": "c87a93fd7c57e88b359888dd5e6c589a720b100c1177789381f4ec3f88a9ac93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775256769, "uuid": "39212a94-5419-4195-9784-38def21abe27", "comment": "Malware payload (Mirai)", "value": "f7ed038d22519c9c4d3dcb0f080d0bdd1076a830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775256769, "uuid": "a6b9301d-36b8-4be9-89f1-70832b46fd4e", "comment": "Malware payload (Mirai)", "value": "a04416d93af25e2736dfdd276ff97a9fe6cf6dd0797c49a25139dcf54da25adeac4d0dfde792f4c5713f8797157dc425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775256769, "uuid": "347e4944-05a1-4d3e-b41f-d45c36d2726a", "value": "T157242B45AA418F13C0D627B9FB9F424533339B64D7EB63069528AFB43B8779A4F23601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775256769, "uuid": "5971bd22-c5b1-4908-aa65-32dd0063b3c5", "value": "6144:JqsxT0JkJfaVeKguKebAnpTyOgrhd2IM/R/z2MEWEgV:6kJfaVeKguK68dyOmsd/FzbEW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775256769, "uuid": "07ac0ffa-447a-4a33-9147-7cc568a7289f", "value": 218368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775256769, "uuid": "1fbbc136-e3ee-4e26-afb5-b5caeb14b9b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775256769, "uuid": "2bc4a02a-0077-4d38-968b-b2d3f772625d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a659d6-2f10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775188529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775188529, "uuid": "7f56f86f-5960-40bd-8fc8-e78648e8f8cc", "comment": "Malware payload", "value": "4be93842155cafc57cb936c089090acb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775188529, "uuid": "3fea366a-9fac-4d7d-aa07-d54d65008c95", "comment": "Malware payload", "value": "c8836a733b3df2b4bfd861b81e3452a0bc169ffe707f483a06f7ad89a4cc2965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775188529, "uuid": "022c5e8a-9b45-4475-84c3-660f37e508ec", "comment": "Malware payload", "value": "f2f26e5062f3ebe4499262d76b08b2e5c1bfad2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775188529, "uuid": "08ef147f-3964-408e-99a6-a46738e3351b", "comment": "Malware payload", "value": "67601394a87ef0d00f0f2b4c7031fcf2b1c738a580fc5169f20c976e2fdb0ad52b9f320ea64ed71ed65ca4cc701f6051", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775188529, "uuid": "2f25cbb9-be00-4d2b-8b8b-4b201397338c", "value": "T1D8456D43E2A724ECC56BC134876B97B3BA34F8644135AFBBA594C7302E13E90275DB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775188529, "uuid": "1abab157-b991-4933-82df-423afdb0b285", "value": "914c87072af0bbb39ce82a35fbe9173a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775188529, "uuid": "408c67e9-02ba-42af-8928-8ce65db4010a", "value": "24576:u7lsiBq59WvGktZBj78Ag/L62Yr0ESSbJu5laS:8siBa9WvGktnkDG2k0zou5laS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775188529, "uuid": "8543018e-c89c-4e99-85b4-3f4d4953494a", "value": 1200132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775188529, "uuid": "fb37d546-6d59-4319-84c5-105921a9108d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775188529, "uuid": "7911c4b0-793e-4e5a-a6af-5aeb7252edac", "value": "qy0gk3z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5e7a41-2f0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775188005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775188005, "uuid": "8e0e2fab-8adc-4649-9dd3-c20f310132b0", "comment": "Malware payload", "value": "883cb0af93a2cec29c9500c2cc9cdd85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775188005, "uuid": "79d59c7a-6e51-47eb-a810-98c54a0b57df", "comment": "Malware payload", "value": "cf0c14da713bd05284beb4aec55498c7e38425dc53f36963cd6fdbc21626c9ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775188005, "uuid": "b5248d1c-2ea6-4205-92e1-c021e9c31854", "comment": "Malware payload", "value": "71f2edec1eda8271f3b2f896de556bbdc176d0b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775188005, "uuid": "e717e23d-9966-4ded-aa1b-9dffa3146a18", "comment": "Malware payload", "value": "1fd77a884c797758c283fa8f2f06ab634badc98d10733ddb32ea849825be4195158e50be636e9b5a869d6b4a9b84ad5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775188005, "uuid": "b6d66061-4591-4704-8a08-7b11f01a8ef0", "value": "T1A2457D47E1A360EDC45BC2B193476632F575B8454838BDFF82A4CB313B72E506A6DB28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775188005, "uuid": "acc434de-53db-42f3-a055-d2999253f95a", "value": "c80e21cef9207afb51717f32eed30c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775188005, "uuid": "12eba5ea-36e9-4e7a-8ef7-867d2c6c8c33", "value": "24576:Td0JKTSZgZ/7xqPbjSAzf5+rUZuSCAhuQsgnOhFaV+C3nLERRAJsZIenNwk:TdWKTSZglwDjSUILSPOhF3CXIRRAJsyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775188005, "uuid": "60dc5b2b-5921-4631-9f6f-004f3095f421", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775188005, "uuid": "5dc0f333-c136-4e25-87f8-ebf4bf78fc0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775188005, "uuid": "4ff9160a-f17c-4bfd-b6da-16f2b9e60d9c", "value": "klf7sids6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6321ac4f-2f9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775248414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248414, "uuid": "ba3a2ab1-f3e0-4678-8df6-745ad712ad58", "comment": "Malware payload", "value": "929034bb935ef7d61aed12e8ee8a141f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248414, "uuid": "4e2eb502-f546-41bd-abc8-10dc6e4eee0b", "comment": "Malware payload", "value": "d171ff9bc17c1d9109580ca46060b3bb7d30827243ad79f34d3a169fc634bac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248414, "uuid": "d4cb5a50-2c19-45f3-85d0-e6c16632cf9f", "comment": "Malware payload", "value": "e8f57a4c296637a116bf4f48fc413f53b1645708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248414, "uuid": "573a1e0c-22dd-4087-b3ff-e9bee966da87", "comment": "Malware payload", "value": "75de2abb842808ab65cff6ef19423484aabcbae2ddcbca33c2f774140ba61953c3633a0c36328dc60fe93d6404ed9126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248414, "uuid": "f4c1cadc-a07e-461e-83df-12908455fb0b", "value": "T1B4B4E65BEA7551F1D1BAC03CC542652AFC7134AA8330ABCB57919F671B23BE4A93E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248414, "uuid": "6ad7e06f-62e9-455b-8e2f-18a751ad1bf1", "value": "60ec206247bf0243887a73a620633d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248414, "uuid": "b9033369-d90f-439f-8b2d-bc8f6afd8b34", "value": "6144:0IuPC7UQ6BzB2Gj/10RkCwt3ze837gh/B:0I7UQABLBelo6837k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775248414, "uuid": "0614a296-b9db-42b3-821e-fded5ea72d50", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775248414, "uuid": "550c855f-3103-4cc8-88a9-c4f44e933741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248414, "uuid": "370116dc-c471-4649-b4f1-048a63e211e0", "value": "discord-worm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8368cc-2f31-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775202667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202667, "uuid": "49b5b176-fe2b-4848-b060-55ac6e99b2ee", "comment": "Malware payload", "value": "dfea6c4381362512c41af637e52d4af8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202667, "uuid": "14a928a9-3141-46f2-aea2-fe1f7bb2629a", "comment": "Malware payload", "value": "d2846c8f6d56f5d638cf701d2b0862540003956629aa174516fbae90c3fbcc16", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202667, "uuid": "2cb7ac3e-d1c3-4541-bb0c-9d50ca9abc01", "comment": "Malware payload", "value": "72efbd8588f665e30a05f78826c5bdf98ea2e54c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202667, "uuid": "efc4a5a4-9328-47c2-a2cd-5053796ca00c", "comment": "Malware payload", "value": "d369316554a0db52c654fd173ab09b8e70c53b5d90cc91037c2feb6a67edc6086d65808fabb6ad5ca36acf745d057058", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202667, "uuid": "c5c28384-9a10-48d2-941a-b764335f20fd", "value": "T17D37CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202667, "uuid": "4f526cb2-d6d0-4888-943f-dc29f0917897", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQJ:cqYUQuVDt0TZEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202667, "uuid": "130f6c0f-3d01-42c1-b394-3e1b2bdeb793", "value": 23887872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202667, "uuid": "deb625cb-938f-4589-8087-c36f3b76d290", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202667, "uuid": "0e0101be-c0c4-4d8a-8514-03714d422b52", "value": "d2846c8f6d56f5d638cf701d2b0862540003956629aa174516fbae90c3fbcc16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fef40af-2f67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775225726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225726, "uuid": "144cd474-eaa2-4d37-a9f5-db6f0d6d6c0a", "comment": "Malware payload (Mirai)", "value": "e04bfd0265218b5b7d714d0b69c1ce40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225726, "uuid": "40d340e7-6e83-44fc-aa5b-2df779524b43", "comment": "Malware payload (Mirai)", "value": "d3c7c81f534b213150c0acfabb6476cfb4ebeeae891a16cb76cc26a864f0bd0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225726, "uuid": "22665bf7-5fb9-4956-8e05-50385db5067a", "comment": "Malware payload (Mirai)", "value": "138b7d79925a00bd783bf72bf4dd1ce82685bbbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225726, "uuid": "6a03c163-2711-4b64-a057-8d0b306ab79d", "comment": "Malware payload (Mirai)", "value": "4c11c3ea30fc29f05f3b7896d1688a0ae28fd7460e372123732e3497519b7693ce3a12b0e429745aba51ece2dd6f69b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225726, "uuid": "a788a095-1381-4320-a7fa-38fb61091902", "value": "T1D4E30B46F8814B12D5D111BAFE1E124E37231BB8E2DF72029D246F647B8A97F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225726, "uuid": "69501775-e92f-4c95-8807-091ac8232ef7", "value": "3072:Pn0VejuWohUqYKfDXEzML7RaQY9WQ8b30/jqLYq:8ejuWuhjDX2MLda5fC0/jqLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775225726, "uuid": "c20006a2-502c-4d42-86f8-6b416723f5a8", "value": 144028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775225726, "uuid": "c0e74e32-1ed7-423f-81bd-10c7c3c881b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225726, "uuid": "d7373ecd-2887-464b-8f05-3671cf776b3a", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b323286e-2f87-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775239529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239529, "uuid": "6f549e73-37fe-4c9e-ad70-0f1097da782b", "comment": "Malware payload (RustyStealer)", "value": "adc648ce9cb6ce745cf57305bc574f39", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239529, "uuid": "302fae3b-cdbc-46c7-9351-54044ee3bdbd", "comment": "Malware payload (RustyStealer)", "value": "d3cc5fceeda8d98795d9d813921368620d5e98f2682b76e635c5b567985a3abe", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239529, "uuid": "9a011fe4-fa7f-42a9-a2eb-ff82cf87c508", "comment": "Malware payload (RustyStealer)", "value": "eabdde3ca4d28566a743f2d27951af3b9f9fb56e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239529, "uuid": "4131b927-438c-489a-bac9-d7201620f3ca", "comment": "Malware payload (RustyStealer)", "value": "a164977df36500d52103501fc9c1bad8decc6121bfa808faaf5244a4b728e3c61a9b8a5e94ce5407d7885f3515b89f6e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239529, "uuid": "8c75212d-f21b-444e-86dd-9af8b94cce0a", "value": "T1A066BFB43205BCFBBB1F86B7C6A15DD9133626A24386E8CD6068F7C10953675FE26D08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239529, "uuid": "04c73aa3-7afb-451b-9a35-1a1599604258", "value": "ae3c2ea21d0a1fd83a33d73767c53bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239529, "uuid": "27a84b51-3102-40af-ab24-92dd915fe3f2", "value": "24576:/sCxq2QgPNDQKL6lqaSmWATjlhd35KUzSbvZZxPzB926rEabM7KwVb4+5MrP/kQx:/wK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775239529, "uuid": "22e8872b-2830-4c02-bd0b-1d58070a7083", "value": 7023616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775239529, "uuid": "0d0a2931-3dda-4125-b29d-67953c0b293d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239529, "uuid": "7af9ebf9-868e-471f-b02d-5a15875cf105", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff2dd69-2f78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775233135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233135, "uuid": "a067381a-3348-4654-b095-7f071acd0351", "comment": "Malware payload", "value": "f9d61641efc8a8ae1ad980034b7feed2", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "casino-redirect", "colour": "#0DC1C6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233135, "uuid": "e09830d3-d7e7-49b0-8391-617ca18b0d37", "comment": "Malware payload", "value": "d3dee510f632c6252641192f50367dfb68628ae7a0c9b604ed8dd5fe0207f187", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "casino-redirect", "colour": "#0DC1C6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233135, "uuid": "5d4011cb-0d63-43fe-b688-036dfc660ce6", "comment": "Malware payload", "value": "f94670d0a151c9670cee0bd7303327b2c6813f7c", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "casino-redirect", "colour": "#0DC1C6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233135, "uuid": "cfdb0ac3-7c68-4040-a906-ccb20ae303cb", "comment": "Malware payload", "value": "3f5d219beca7c722ef534e93e7286bcb48d4bbc03846a69357bdc8fa5e88ba2ef2bb1ce8a28f80fc192b97318c854020", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "casino-redirect", "colour": "#0DC1C6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233135, "uuid": "78725383-ef45-4b91-b2f5-1d2604500123", "value": "T18AA12153FCD150CE21B02A1D0D7E898CDECC6D66122DA1C8F895B8561FE62F8F961C8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233135, "uuid": "5032656a-9ea5-4081-ba5a-b9427362ea1e", "value": "96:JrbfffRNIwFI1my3qx3RODuTVoO/uKWjCi:1vRNIwFI1myqRIDuTVo4uKNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233135, "uuid": "bb24fd51-2fa5-4ee6-9674-e83963d22653", "value": 4847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233135, "uuid": "02e98925-34f5-4c80-ba21-bff922715371", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233135, "uuid": "fdff567f-76ba-4111-a975-4fffcdde41f6", "value": "woocommerce-load.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc050249-2ef0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775174690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174690, "uuid": "38ec7b92-fa08-4d9a-9c05-d7163c47d9a7", "comment": "Malware payload", "value": "83dcbc78c12b38e05621c5416155ebf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174690, "uuid": "b5ad316b-920a-4373-810a-3fd804aeefd5", "comment": "Malware payload", "value": "d5a6edb8c1ded3a8ba12d39d7c017815cb2a4899c5c40c7c9e64db4cdb034770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174690, "uuid": "4a4bca33-f3cc-42d8-8a39-f29ab193b2fc", "comment": "Malware payload", "value": "682792b0633393bbe2a431d16e2be93d78644cec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174690, "uuid": "4ce6cadb-5b95-4a7d-bee7-202da8c55e95", "comment": "Malware payload", "value": "bfb28eb04510096a520716dd7ef3d431d331d69bb051cb525e7b928cffc98c7b477b528dc67ce7585ea0c9653abe90fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174690, "uuid": "6cdbfd61-b552-4b6f-a70b-13f7f02477cf", "value": "T1D8C52252FB832073E8365B7585675023AE1B78B918F4E50A2CB6C25D1ABB3E14C75B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174690, "uuid": "e0ee1ddd-c320-4307-9ead-086bcdc4476f", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174690, "uuid": "46f0cb5b-c840-4f34-8584-b1df3a2f9461", "value": "49152:CZzH05Qi3TWpx5AvkQR2QR6jiaQmv48s/b2AP1LyutPw4u/:SzU5qDQsA626QfcQI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775174690, "uuid": "cd6ce186-b0ee-4a36-a918-b052ec70c441", "value": 2586516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775174690, "uuid": "dc751ff0-7570-41e9-ba9a-cda6e8fc038e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174690, "uuid": "5a5a9981-de46-4430-8292-b044f58ee829", "value": "updateEdge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95365b3-2ef4-11f1-a769-42010a9c0008", "comment": "Malware payload (MillenuimRAT)", "timestamp": 1775176404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176404, "uuid": "5f1df4c6-3f17-49ff-8496-f08f64332406", "comment": "Malware payload (MillenuimRAT)", "value": "00766f85b2bd4c2133bf90b43ef9fbaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176404, "uuid": "496bbd1e-c714-43be-930c-15686ca58261", "comment": "Malware payload (MillenuimRAT)", "value": "d5c71eced224608ee3d1a612a29108ea8719f3eb5511267e23755ae191224a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176404, "uuid": "7aaf08c0-3076-4593-8963-2c32e74e8baa", "comment": "Malware payload (MillenuimRAT)", "value": "f511fd24b8812a8c8bc5e5bad641ce6d63a94ac5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775176404, "uuid": "e77f71b7-5188-4062-a961-cad075c24be6", "comment": "Malware payload (MillenuimRAT)", "value": "0775e642a71d6728e4f4d56ab4b686a8722977853dbb4949528bfb75aab62b76ecd6860fc5260632db832522c9c2f4c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775176404, "uuid": "7da7ed29-866a-4ba5-90eb-5b1b1950140c", "value": "T18EB5F21FC2AF6F0ACC1066F9ADA140D72451CEC898BD59F8AE846CDFD69CD7C14B9290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775176404, "uuid": "9bce0f27-0274-42dc-8afa-935c1b60664f", "value": "3ec40ef258012a6a096f45d9e8821282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775176404, "uuid": "d8a8df76-fc44-45e8-be82-2221b6ee0519", "value": "49152:VTU4q4/D69/liJ916FI6AFdqbVvf1DNkJ0cPp4QgwnQxm+sg3brNFU78:VTf6BY9196AboVpzQgwnUjs287", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775176404, "uuid": "52de455d-5402-4960-8ebb-e1d5c3440950", "value": 2479104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775176404, "uuid": "b23953fd-eaeb-40d3-8309-c04aeeb9b92f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775176404, "uuid": "3f4de18b-a2c6-4492-93ac-6c0356d20875", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030a49c3-2f39-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1775205733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205733, "uuid": "7bc21d90-4c79-4bf1-b599-1489e6cc7132", "comment": "Malware payload (Adware.Techsnab)", "value": "b6ad4710aa30d196f9b34b87ae51a32a", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205733, "uuid": "3cc9c12f-0dd3-4d10-bd52-089abf6c3f46", "comment": "Malware payload (Adware.Techsnab)", "value": "d64bc0975e32b85b1d5f927f62cbeb56316ceebad70a78bbf233f515d3067c06", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205733, "uuid": "066d3bbe-00cd-4830-b6f8-ff2c55372dc8", "comment": "Malware payload (Adware.Techsnab)", "value": "c1bc3dc732b860ef4e8d70a23356fbd70c4a43af", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205733, "uuid": "e423a86f-9620-4b1e-86f2-da7847787aef", "comment": "Malware payload (Adware.Techsnab)", "value": "b863167f1436791472eca76e07d0e961ae35a9337283f61ac9fec906936b1dcb05ff7959226a5d60d0a1885e59935d27", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205733, "uuid": "7696db97-31eb-44fb-b93e-6dad2f8bf68f", "value": "T11233B7D48D85F14CCEABDAABEFD14034F6E5E32940C19885E598B504BF0A3B16F4B9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205733, "uuid": "231ebbea-e0c7-45a0-9c2e-0328e9ea107f", "value": "1536:QwNwq8I6tSRQVrJe4eSUmhfpEf75z2MEanqkrmkoZ7/K+RITMmdSBMbYTcad89o:1qrI6tYArJFN6fwaLqJhpmfhad89o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775205733, "uuid": "f7de280c-53c9-45e1-a40d-e1d05a5662a9", "value": 53796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775205733, "uuid": "6f011da5-5c19-4c0e-bd5c-a83a8ff14e0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205733, "uuid": "fafdf980-5dd8-4de2-8022-0a917eed56a8", "value": "syrocast.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e37ff0-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775237953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237953, "uuid": "add934a7-128b-4dc3-bfea-6dab13548fb4", "comment": "Malware payload (Mirai)", "value": "35653bf48b20d7d0bca8eb229867303b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237953, "uuid": "3f04b1d5-5521-4c64-8fab-cde788dc7ff4", "comment": "Malware payload (Mirai)", "value": "d66a8eff096d72081b02ec2b4c2037e724da13305d024b7de4a4c3738c23b19e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237953, "uuid": "d89001c2-9622-4ee7-9860-f775527fe69c", "comment": "Malware payload (Mirai)", "value": "8a3d315684a942ea621a3dc02104045a385ccd3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237953, "uuid": "fb55f6a8-41be-47d8-9ece-88c6eedd4a84", "comment": "Malware payload (Mirai)", "value": "a00e9bd54022456f7cf407bfd3f8a4e2f4903d57fbb72b352374f3da0ff9f429bcc413c151213cd66280393ad4b6c7b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237953, "uuid": "2a000851-df1c-45ed-8371-a28fc1f8a365", "value": "T1E6C2F13B849F19A1CE0487BC25A8A94CE6C479AE7F1ADD80812D7D1F1C7326F0B03C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237953, "uuid": "915c0922-bbc8-4f79-aab2-f799c29900c3", "value": "384:MgjRX74+nsHnozt48N6ASt7i36htH9vSY3GQODlyQn2fBpMBeq5/GDtygvYKS:tgnK56AS83+SIG0QsDi/GDtygQKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237953, "uuid": "6660f65e-de4e-470f-9e2e-d5174bbbdd73", "value": 25880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237953, "uuid": "bfe0cf9d-3baf-4d76-a0dd-1ad120c77067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237953, "uuid": "19b323ac-f047-4457-abc3-24f625bfad7a", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc5642b-2faa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775254390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254390, "uuid": "de697647-89ec-4218-90d2-042efb9ea6fb", "comment": "Malware payload", "value": "02585bd4204bfb6fe6b83d27a20fc204", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254390, "uuid": "f3f5cc7a-9000-4656-9dbd-4c1a56c54fc7", "comment": "Malware payload", "value": "d8fae1f3303be955e67ee1ef8a823c7879a796023e6e23790492cd3af0e551b0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254390, "uuid": "875dacbe-4a16-48d6-b307-50f5a79093c8", "comment": "Malware payload", "value": "5b7a7656a492f3f9e9f5c637d9d0d8420823956e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775254390, "uuid": "c69b32ec-22cd-4629-a813-90d2634aae32", "comment": "Malware payload", "value": "c8740c78256eef4b25dd62eafd3b3200f564c5a3da866e801bc38fb8ea67388552b155005c4fc70e2f6394bbe73730d4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775254390, "uuid": "6f36927c-a27f-421d-9936-1b5fb628fc38", "value": "T124E0CD2006441F95C90569B567472273470BB465C564E6D355051EC45D4B95A0F45AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775254390, "uuid": "96d6344e-55fd-44ca-91e5-463e3d77d270", "value": "6:5jHzLymiu5jtSNH/Wx2jLs/3bwzS9XxIMnJqcUR2bnFHzjEym3t+lvlX:5jKmiUswxsq3Uz6XxPAR2bnLm3taN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775254390, "uuid": "a078265c-595c-43d5-9f29-a74c6d4e6869", "value": 321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775254390, "uuid": "b575ee97-8499-40f5-8400-93afd83ffaa9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775254390, "uuid": "1fb1ca41-a267-4da5-ad54-494988d3ddf6", "value": "x-ray_copy.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3330341-2f47-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1775212068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212068, "uuid": "4d9a81c0-b07e-4780-ab38-9c29f4acffe2", "comment": "Malware payload (XWorm)", "value": "6f7d48e8fb9ca80d74523c9e45d43aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212068, "uuid": "8ad53f5b-8781-4dd2-a0d7-2279d8967639", "comment": "Malware payload (XWorm)", "value": "d906e3af0250cd073fc95562043bde0d89b86232765ccfab8ee0c2836642de78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212068, "uuid": "7b5937f8-08a0-4844-9c72-3a902d9213d3", "comment": "Malware payload (XWorm)", "value": "a09b5ac71565ce6b69adaaa304f6a88df46ece24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775212068, "uuid": "8e647b82-a826-4726-9210-610c71c1e6b7", "comment": "Malware payload (XWorm)", "value": "754c8b72e3d2fa32eb0d672b256c1862ae6f7cd03e3338c29af8d8fb7fd677d71a097244b6a2cf56586a755d08353267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775212068, "uuid": "0b86f69b-6d2d-4c3e-90c8-e91c9df42292", "value": "T16915CF065F8B2F98E6FF0B7CC0561D1473F4D44392A6D69B2FE880F26967F86CA1A150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775212068, "uuid": "982569f5-b24c-43c4-80b4-8c2a4ce02fcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775212068, "uuid": "d3bd9b45-484a-439b-a8b1-16769adb96d8", "value": "12288:FQ+AS2ZVZTbxnqLJzUnxYMBzGIE8QyZAWvtMrsittpoRXdnEgcsm:FQrdbxnqVz78GIEJ68IXigjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775212068, "uuid": "a15cd33e-e113-4a4a-9f09-ef3dc3114fd5", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775212068, "uuid": "adba3795-fa93-47d2-b8c8-2d9688c6fe23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775212068, "uuid": "e90b7219-8f15-457e-b95a-0e71121c6a4e", "value": "Swift_Copy-40125.exe{124~KB}.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99283f0c-2f9f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775249794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249794, "uuid": "d341f9f1-6860-4b9e-831c-e1ea4f60320c", "comment": "Malware payload", "value": "7e52846f61db3ba89907232b3aa97d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249794, "uuid": "6d7743d8-962d-4f0c-af38-fc59d1f7142b", "comment": "Malware payload", "value": "db12eb6667462487e69e9e31fd946cd3d3b5ef5777e3bf45d0d9c797aa6e87be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249794, "uuid": "13ffdd25-b666-4cd3-bacf-77f6ce138f6a", "comment": "Malware payload", "value": "9517a541f7314f2bed47bd5ee1e26b40efe633de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775249794, "uuid": "b3d84c3b-9735-4d02-bf47-9a44e811fac2", "comment": "Malware payload", "value": "9df17e70f1dd223677d5ae1e5cbc85b12f15adcff07f46e668bb241cc97d23010b6aae16b633829bca11146a9fd136e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249794, "uuid": "339c1030-5344-4221-b0d5-46e95bcea097", "value": "T16FD33A7C4ADD5CE3E02C6B3D9A912ADC17B795E10229C3EF2C8260E81FE7AD1C415997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249794, "uuid": "cd81d148-c2ae-471b-bfa7-8d8f09b6b5b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249794, "uuid": "236962e3-f504-4cb0-b19d-794ad0fd8934", "value": "3072:IeouJUe0Ih738mxSGsH4Phrng/Aej0viHrU9fru+dHYbj8YH:EQh+H4Phot0v+ryRYb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775249794, "uuid": "931d3967-c9bb-43a5-b45c-cc980f2877e1", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775249794, "uuid": "255f2f13-0f0a-4ef1-b912-023d94ad6614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775249794, "uuid": "d574aef4-4540-4c1d-93e6-9705268096a2", "value": "G2Y8T1KN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a3c6d2-2f31-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1775202681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202681, "uuid": "871575be-5b7d-4c14-a272-52c27107be88", "comment": "Malware payload (Prometei)", "value": "fcb28f4db6b2a25874f5b896634f9a8c", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202681, "uuid": "898cc80b-f7e3-4b6d-a56e-fe665b1e0329", "comment": "Malware payload (Prometei)", "value": "db1576a9cb41e351930b758965b3a886b8647d880d20724184db31880601db57", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202681, "uuid": "7cd761ee-1588-448a-864f-fb4a3f3afb12", "comment": "Malware payload (Prometei)", "value": "b589b464d1f11f9946782cb8beff1ab2d5ccc281", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202681, "uuid": "64dab787-f566-49f0-84e7-72ff48420611", "comment": "Malware payload (Prometei)", "value": "fbca4e057cca2ddb15abb27758edbd5edcc0d0cd889909c1b529dc595af16d5dda26bf88c1efdf081f8bbeb1629ec976", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202681, "uuid": "edc781d7-85ee-4a34-8a61-bcd0ba1ea620", "value": "T12A746C01335E9AD7F167187060583A735DBCD630A36F18B7F7C56C89346CAC0A6A8B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202681, "uuid": "e76c64df-94e3-4861-95af-d6cb1864a516", "value": "11d7574f4124bae26b618543eea709ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202681, "uuid": "cec5dcfa-dd42-42a5-9b14-7bfe0b65c11d", "value": "6144:Ncz0c6+T08MV6uK+WjXXDWHOd8fVMsEf50bx:OX6j8MV6uK+WzSHOd8dMpfex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202681, "uuid": "bb77c792-a6ef-4668-9ffe-ffe41b3457a1", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202681, "uuid": "f4581d43-1ea1-452d-b723-c06d0d570365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202681, "uuid": "174ce77d-4a91-464e-8779-81430cee73ce", "value": "db1576a9cb41e351930b758965b3a886b8647d880d20724184db31880601db57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c888f8f-2f39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775205991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205991, "uuid": "4aacdab7-9993-4ae9-bf61-f4c0ecf139a9", "comment": "Malware payload", "value": "7d456f758b3da35a485c141172b7bbbc", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205991, "uuid": "34f5a867-61d2-45f8-a7ed-4b83708a212e", "comment": "Malware payload", "value": "db4973d865880696e334cd7ce2a7ff7255c24b9921dd526280bd1de6bb03753e", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205991, "uuid": "74cb4e93-4607-4d95-b1fa-4d3b8203d2d3", "comment": "Malware payload", "value": "23a63842eccb5cd196e9b8b26f5ec79164082021", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775205991, "uuid": "678c64f0-1761-4861-bd69-958170c8684c", "comment": "Malware payload", "value": "9bd47733439cd6ce10031a07e454ff15a0e02623293e81b9f93893bfd8a8daa21e8e9870702b9bd28cc95d8b6bbcd8f3", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205991, "uuid": "5493f3b9-5263-4ce3-bd8e-7b88c65e08d7", "value": "T1C7C6337E653298F1C2CEB47394B37B2878C884266E8ED1E6AB7438D09B527F07137519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205991, "uuid": "df641939-4210-416a-8fc1-bea1a0e44fd9", "value": "196608:HPEkloEePBtKriPSbCavEU5b+ZPUoJiRtxsoKFZbDOVOdlFnsuc6Dnxim:sGe2r/pv15iZPUoJyte5nmVOdzsucmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775205991, "uuid": "be9671d9-3c99-4feb-b929-f0df2a625c49", "value": 11840493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775205991, "uuid": "5577250f-f816-4033-b55a-fdf5be3e60e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775205991, "uuid": "ddfc58d2-1ea2-4cde-8977-2b4bb60ae383", "value": "oxfordmobilexray.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dce9a4d-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775237963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237963, "uuid": "3e5d10c1-97c1-4548-b726-a1a3e8636c49", "comment": "Malware payload (Mirai)", "value": "980105fee76b9b1f7c0195179cbea58a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237963, "uuid": "ad62fea7-8465-4e49-9506-a11fd02e34a0", "comment": "Malware payload (Mirai)", "value": "dc69bcb799a502c9bb8e9f03576a08a5a7a803149e8b301ebad474cdbf608355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237963, "uuid": "1d5daff0-336c-4974-989c-9b322eb5d828", "comment": "Malware payload (Mirai)", "value": "c28b9218293e769612081787ea328aac6707d496", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237963, "uuid": "c56b5839-6681-451c-bbae-55d078f13e97", "comment": "Malware payload (Mirai)", "value": "bc4c4db5c92228d4f2f1bf260dadebd07a828b4d54aed3e625f48ddae514ce994434f19f6924f6dbf70edade7ae66f15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237963, "uuid": "9c45f2df-557c-414c-826f-20ae727a65f4", "value": "T1BBD2D0AECE202B4DCDEF8D7D849D2B62ADC151D1222D9A8D63545C1C8705E4AFC4A4FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237963, "uuid": "dfb05aea-76ed-42f3-b728-a2468d2d85bf", "value": "768:V5nNf8eZ5Ld/ZG6h/UUwESiSt7ojphWME:V5npR/Z/hcUwBplKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237963, "uuid": "2b1d3683-9cce-4739-a9a3-2ae26247b8b7", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237963, "uuid": "5698d284-2bd7-4f16-92e7-d44db39337cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237963, "uuid": "20b2e7be-8d35-4ff6-bd89-e1bf33719af0", "value": "yakuza.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0a2d6f-2f32-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775202826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202826, "uuid": "42f342eb-37f6-485e-a099-e5f1ca2b98a6", "comment": "Malware payload (AgentTesla)", "value": "f31e0d379a27687897f0c93bf8779d9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202826, "uuid": "3b6fdf2d-fde6-4634-8bc1-a72c4851ec28", "comment": "Malware payload (AgentTesla)", "value": "de1f0c95e384774d387b2249b92d7e231a7a5f6c530d94453ca154fcc7d88155", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202826, "uuid": "949ce97a-c9a9-463c-96ba-e0e35e870c83", "comment": "Malware payload (AgentTesla)", "value": "ad8ccc0251396ea47dee8e52a89400ac2265fd9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202826, "uuid": "3eba5b7b-fe33-4374-88cb-e6b18a1ca45d", "comment": "Malware payload (AgentTesla)", "value": "ff0cbd2e98b2fb2e130c7ea5e2d4de96c8944685a74509bb091a4b4226cd1c440114aef2dc1c3c907dc7847a2036f24c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202826, "uuid": "7e6943cb-6d97-4d14-9f7b-401323537cd2", "value": "T1F954E000D5E51206F2B72F10AEFA36619C7AFE62690ED4EE95150D5E0A32C094DBBF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202826, "uuid": "88fa8a7e-e490-4503-9890-e0ca54bdbebb", "value": "6144:Ic0xabfG8g10txsrvMpUuT2XMTYkJc1lD0nCyd4+sTcCNqk79FrDAM6fAyZ:9MIgLfUOkznryFTfNqsMA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202826, "uuid": "beec4d82-bff1-411d-ab5c-5b86127efb3f", "value": 304478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202826, "uuid": "ca6c4ba9-c298-4713-95a8-2d9d61a9dd2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202826, "uuid": "1dfa3d06-44ba-4867-adad-36086c370e32", "value": "A9ZclihBFd7lkQiX.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6119ff64-2f18-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775191718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775191718, "uuid": "58e64bfa-00d3-4e48-a9be-8612655f726b", "comment": "Malware payload (Mirai)", "value": "c9e1a2864de67643ef6477c94c3cdf3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775191718, "uuid": "33d5bdbc-6002-4b80-b2a3-8776d878b117", "comment": "Malware payload (Mirai)", "value": "df16101db6081c19469f5d5de0d51c6d9bd4143be1ca7c4884cdd5196fb1214c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775191718, "uuid": "8be62a6c-a68c-45cc-a614-edcefc9f27ee", "comment": "Malware payload (Mirai)", "value": "b8501fcf43324927be7bda053dc706c4803a285c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775191718, "uuid": "68a5b544-8e70-4fe4-8729-11193e0a8d03", "comment": "Malware payload (Mirai)", "value": "97ccaaa9e4b77b723d63f94968a8b635b9e8d9ad043edd77cf2ab41425cba446d8eb8bf7958574ec0c8ca072af35fe6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775191718, "uuid": "0f884a11-7e02-42fd-9fef-187e5e0fe5e2", "value": "T14B74392AFC41AB51D5D12ABAFF2E928933130778F3DE71229D155F30B78A80A0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775191718, "uuid": "991508c6-06cb-4c9c-8e0a-b5900575bf39", "value": "6144:8+GU8GhPQheq/3dPTkfrAxRY30WnSKMbqXkiXb/+x5lgzJU+6fuecSs+pa4PsFYg:8hgKKLLqqB/OxkePs+pa4CYObMJfged4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775191718, "uuid": "d8b1c224-3d20-46e0-993a-7595581afefc", "value": 339600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775191718, "uuid": "fa5d38df-59fb-47bc-a656-0c9ab31caf10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775191718, "uuid": "db8aefa8-926c-4619-a189-a883831a30bc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9eef0dd-2f1a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775192806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192806, "uuid": "3cecc1f5-96a0-46aa-9a4e-3bce55bd421b", "comment": "Malware payload", "value": "47accb0ecfe8ccd466752dde1864f3b0", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192806, "uuid": "5bfaf8be-1b21-482f-b4e7-819af59144b1", "comment": "Malware payload", "value": "e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192806, "uuid": "ce20c252-5648-40f1-b981-782930f25af3", "comment": "Malware payload", "value": "c922a2e4b0cf9d4795b66d99771517b58485450a", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775192806, "uuid": "3f526682-baef-4a28-8a13-572f184f79c9", "comment": "Malware payload", "value": "03fceac96821dc4d58b48e74de19364bbc98b4bff522419adcdd6f050931cad7f387be49e6ff8a9e765f920f8b673da6", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CrystalX", "colour": "#D1A815", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192806, "uuid": "37cd9c2e-1091-49b9-946b-98f862fe03df", "value": "T179966B07ECA555E9C0AAD63486669213BBB1BC480B3123D33F90F7682F76BE06D79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192806, "uuid": "43ebc95d-99ff-4bb9-a8f9-091a1c52d9a6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192806, "uuid": "f03f83f6-7ea2-424c-afa9-0c6b3db95e97", "value": "98304:mEhSq16VR84rwKsYds6frF9jY+AwGiEEBI:moS6MZrOYdssx9jjbBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775192806, "uuid": "7d32f560-a842-4386-b5dd-7d782396402e", "value": 9201092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775192806, "uuid": "3fdc631d-01e8-4aef-9994-149937399867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775192806, "uuid": "15690e89-5bb0-42d1-bd61-bae3ad655119", "value": "e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee39dd49-2f31-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775202692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202692, "uuid": "4fd161f1-4a0b-4a55-91cd-d504de357edc", "comment": "Malware payload", "value": "af9ee8577d2d9bea808d33fa8d6b247c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202692, "uuid": "5ebaa264-126a-4bc7-8722-1c745ce823ed", "comment": "Malware payload", "value": "e20f675c8df2bf4abbe8868e0cf7e16869473c9d4fe22e8b8e52d458e9880ac6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202692, "uuid": "d2f2ee67-6e17-4351-ad50-bd783c7632dd", "comment": "Malware payload", "value": "e9e7d62b466ce6fbd643d55fa82a634d0ff87d1e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202692, "uuid": "b3bcda53-dc17-4740-8979-29b3353dcace", "comment": "Malware payload", "value": "79820a44a61eb0d5570051621bbcbcee5f0fbd7d75a201f7975ca68fa3f4ee05c87881b8166b1e58e1fedf2e81312f53", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202692, "uuid": "6cd3410d-66af-4fb7-aa1c-d17cead70b96", "value": "T116161973A59154E4C2EED574C6256213BEE0389B273423DB7BD0A6E10B76FE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202692, "uuid": "9535686e-8e88-42d7-8818-448a7437d6d2", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQX:cqYUQuVDt0TZEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202692, "uuid": "b9c30b32-bca0-406c-ac9f-549c3a63c4b8", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202692, "uuid": "be2fbe47-3c00-4cf1-b912-3a69cad6aae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202692, "uuid": "f4cfa9ed-f6ac-4eb0-bb81-9dc874f17284", "value": "e20f675c8df2bf4abbe8868e0cf7e16869473c9d4fe22e8b8e52d458e9880ac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be08c59-2f88-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775239705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239705, "uuid": "f147daf5-bfb9-4361-9139-3a5c6ca25582", "comment": "Malware payload (Mirai)", "value": "30cc5be6a3ebe186b49b4fd0091bfab1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239705, "uuid": "b23c21f0-34a0-455f-b824-42c6330ada9a", "comment": "Malware payload (Mirai)", "value": "e4854563e30c099c8e4169fb64909d3076e1142509463f69020cb179cd2a32b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239705, "uuid": "3f9ab33e-224e-41a8-90f5-81ad8acee181", "comment": "Malware payload (Mirai)", "value": "2aa86cfaeedb6c8ccd394e6890276c559117e8a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775239705, "uuid": "c18529db-6466-4e7a-83bb-9dbb1ccd9cfc", "comment": "Malware payload (Mirai)", "value": "61ef119bae80105ba0c2073f3216fa02bac5dccd4eec5372cf82f59cbe84ff999c451626aceb0c3b24fe792b502b0ae7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239705, "uuid": "04bc678c-cf00-4d98-80fc-79844c6ce83c", "value": "T11D93F60ABF610FF7D85BDC3746A9070225CC991B22B56B3A7534D82CB54F64F1AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239705, "uuid": "705c33ca-7c3b-4d93-9699-c82105673bc7", "value": "1536:VRcAyJPntGt0Jgca4J5ztekNUwdUW0QMZP+vpaB+sc:LcAyJPA0JrtekNZdU3QMnosc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775239705, "uuid": "c4206a5a-0867-46c3-afe3-25d10a0d6c6e", "value": 93224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775239705, "uuid": "afaf15fd-50e1-4d35-b30c-3f4ba43a8d2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775239705, "uuid": "faed1f8b-d619-45a5-aa83-281a04a3d986", "value": "dipndots", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9452d9a-2f31-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1775202630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202630, "uuid": "cd0f073e-6094-4366-aaa0-a0a558700fdb", "comment": "Malware payload (Prometei)", "value": "de2985edbcbd0737e2593210e244bcf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202630, "uuid": "ab140129-cff9-4127-aae9-fa14c40e6d05", "comment": "Malware payload (Prometei)", "value": "e5b5b5bfd73a6ad251eb3d95f71f228c0e96d9f55388084f518c7d686210f6ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202630, "uuid": "8de7d83c-cd93-49bd-8c8d-5124c867c3dd", "comment": "Malware payload (Prometei)", "value": "4dc90bee4b858fb95c394db96538165d9e8d3878", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202630, "uuid": "de481b0a-7e55-443b-9302-5ea5a1f59896", "comment": "Malware payload (Prometei)", "value": "19db6affa417446a584a87ae9ab080b54338f227dcedff9c29299e06a7101598689d81b2ab7ab0cad2ef56e12f8fcfe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202630, "uuid": "f191babe-785e-496c-9306-f9fe90d93347", "value": "T121166D6AB2B354FDC15BD03097AFC6636835B4B40131BC7B26809A352E73E605B6DF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202630, "uuid": "91969914-9fcd-4ad4-93d0-96073ffe6094", "value": "98304:tRy0MUCZs3WcmDZXeC+CSePlPqSJWTREfmeBeutfAZR:KRvL8REfmeBtfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202630, "uuid": "44145f07-27b9-4875-9fca-dbd33ad3ff68", "value": 4284336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202630, "uuid": "3d1db9b8-7ec1-499f-95a8-293cc5fb3c46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202630, "uuid": "fa1b1958-37d8-4d90-817e-c6adadcfc2a6", "value": "34e9982ee33cd630b7a9dd4070225ced552dff25e6284233c65aa4e6d6c51186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d65a18a-2f2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775201482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775201482, "uuid": "1bc4215d-595d-413c-b0a2-879d649c63c3", "comment": "Malware payload", "value": "f0d51b389a95c7053643bace13e636e7", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775201482, "uuid": "dafe8d00-ab09-4c85-9795-432ef1835ecc", "comment": "Malware payload", "value": "eaacfba8b114f37a73c29f6cdd7e3a3707bbde3aaed2f423c71401479d580960", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775201482, "uuid": "cb777c80-b43f-4ad4-b712-80f5a4dc76b3", "comment": "Malware payload", "value": "3a6a29d3faf2b935335e8e2e73fa18a6a6352762", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775201482, "uuid": "4fc21bd8-333d-4893-a200-c6520289cb02", "comment": "Malware payload", "value": "bca18cc3979fc5ffcadafaf4f569c0ec5f3b9ef3f3aa8567753927da9363ef62b8370d9ee40ae4edadacc40f07575d1a", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775201482, "uuid": "723d6ca4-5a8a-4d57-b3b3-7f3a045023c7", "value": "T1BFD6235AF72CA42FC67BA0334DBA5271125B10578983EB937918920C7AC76C84F6EFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775201482, "uuid": "5218dd1f-5689-4012-adcc-e21090d34524", "value": "393216:85arEfP4XTat4k184TLfTsTbJE7RgFpMsA1sAuw:JrRvKOTHrM9Gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775201482, "uuid": "fececd33-43cf-47fe-ba3c-423c38651758", "value": 12685156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775201482, "uuid": "8d9786b5-7c91-45af-9bf5-3f279f783ac7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775201482, "uuid": "a90d27e4-2798-4275-97fe-1945fcd791c2", "value": "com.cacep.filetap.cleanpro_1.0.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8952401d-2f67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775225715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225715, "uuid": "b5f0a008-072a-419e-bc51-6a3dddf2851a", "comment": "Malware payload (Mirai)", "value": "6fa7063816e2557b47b381fac2c7a81d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225715, "uuid": "90e09473-c970-4ab0-a2b4-749c3b3f947e", "comment": "Malware payload (Mirai)", "value": "eac165a583f11b00a25417752c26d7b5b82a49fb881509b9502b80a3528352cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225715, "uuid": "97261605-8660-493a-bb92-4132338f3562", "comment": "Malware payload (Mirai)", "value": "22b9f5a66dbd75f6bca63dc73a8f9fb25ebf22c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775225715, "uuid": "a774a4b9-b956-4ccd-9dba-1eff7a22d9ae", "comment": "Malware payload (Mirai)", "value": "19e9018fc96a28e8fd5de347edc9a89984e348c8f1d05ec77a5462ada700e180c6fa1fd86c173397bb2723e0fbd2db79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225715, "uuid": "ce74f05e-7b52-4acc-888d-3443867d8709", "value": "T132C31A45F8405B23C6D611BBFB5E428D3B2A17E8D3EF720399255F60378685B0E3BA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225715, "uuid": "56aab421-0c48-4844-9e9a-47aa78342d9d", "value": "1536:pjK/iqXG5Rf9xw6mc/uQO3OWuA4RQ4VlJ8T7qnkHBfO5Y80vizH2Vklwtwyw5Rpk:1K/i/7rmupOeWuS4V8qnkHNO1OMW3AD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775225715, "uuid": "3766caaf-5cf6-448d-bb1a-dd3288ae4f1f", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775225715, "uuid": "5631fd86-c2ed-4c6a-a09e-abeba17e9296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775225715, "uuid": "c5325a24-b8fa-4020-b18f-e70606b93f46", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00731f07-2f32-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775202722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202722, "uuid": "94cfe11c-1070-4b57-b0e4-24a265e20b60", "comment": "Malware payload (AgentTesla)", "value": "c41c4984057d778169925f46ca10967e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202722, "uuid": "d86272b9-dee0-4d91-b8f2-6be1cdf86ee1", "comment": "Malware payload (AgentTesla)", "value": "ecac6d81c925b0677dce8e7072391e43db3902e5b05e4e2a64a92d646af686fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202722, "uuid": "9109a13d-37a9-498b-9b81-354fd8ccb96a", "comment": "Malware payload (AgentTesla)", "value": "38675e9c0449ce204de284264b17e627f22728b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775202722, "uuid": "6a1219a7-e613-4945-a7bd-23e7e560db54", "comment": "Malware payload (AgentTesla)", "value": "bc999bb1835a57380a2ef4752b17c93d1294ee5c96f4cdf1e759d0774be34d2318c863f73780c039be00a7fcaf729cd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202722, "uuid": "166196b4-9c95-43aa-bf03-15636ea2a36d", "value": "T1F445BF027391D062FFAB92334B5AF6115BBC79260123A62F13981D79FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202722, "uuid": "aeedf019-4516-4660-9fcd-dc7b66361150", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202722, "uuid": "3b3d79bd-6b94-414b-885f-9a59f1ce3f8d", "value": "24576:E5EmXFtKaL4/oFe5T9yyXYfP1ijXda4XBv8u9szfX:EPVt/LZeJbInQRa4XBv8uaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775202722, "uuid": "0c8b8d97-5796-47c7-afa4-15020bfe6a4f", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775202722, "uuid": "7a71f546-a02e-4b14-acfb-02ad20b1adc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775202722, "uuid": "b0194df0-2f64-44bc-98be-1b327b2539be", "value": "PO E2329-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cace84-2f9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775248036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248036, "uuid": "6eaeea5b-56b2-473b-a6e4-c7ad13fa19ff", "comment": "Malware payload", "value": "6a611643cea5558926e6940a18a8ba60", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248036, "uuid": "63303e6b-efa0-487b-b81e-bcc7bef0ab6e", "comment": "Malware payload", "value": "ee66b4aee73634ea0ccb47755bbdab86acb77db866335a30126505c9e820af5c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248036, "uuid": "e3d050eb-cb29-456c-b268-4fe9cda11524", "comment": "Malware payload", "value": "8e7c1ea06e85fbbe432e252db7c0d4c166216946", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775248036, "uuid": "da40cfde-c4c0-4364-bb6a-33d9e4b79ead", "comment": "Malware payload", "value": "8a158ec9dff6f1bfe79ca02202ad1a01f0af3b0c8c27af2af30f593e1de8eff22b42788b3d6e1e505837523db9829b18", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248036, "uuid": "02e62f97-142c-411d-9fcb-d159fe294b74", "value": "T1F6364A50F9DB40F2EA034930A8A7A37F67346A05A725CBD7CA406E96EC37ED11D7211B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248036, "uuid": "656c3c74-f268-43f2-ac1d-d4dcd614c063", "value": "c7b9fabb19991d383f5951f5915bf283", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248036, "uuid": "2d4fbf80-e037-4273-aad5-5b6ff2bbb035", "value": "49152:tO+x+GqYc5FgH7vK8rdqm3/k6IGl1fgPbutZz2zOvgtV6RBCt9GiF1OnBjRmJROa:4+x+GqpHU7UPitZz2qYtV6zB1wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775248036, "uuid": "5fe427e1-509d-4cd3-b17c-b8ba380ae424", "value": 4903040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775248036, "uuid": "edd40290-b3ba-4bec-8010-54ad365bca58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775248036, "uuid": "1e6c43da-f549-458a-bdcd-c116407d3c58", "value": "cripzw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f02395-2fb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775260680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260680, "uuid": "ef77bd81-d32a-4cc1-b166-85ae31f91d55", "comment": "Malware payload", "value": "6fe7fb57853064d196f6ada3a3956476", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "outcrol-biz", "colour": "#18AA70", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260680, "uuid": "41870f90-7d65-4bf9-81ae-978aaa7dbdf0", "comment": "Malware payload", "value": "f11108eede4202300cf9291bce1e71acddb0c426892afbd7af7568f7e5b12870", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "outcrol-biz", "colour": "#18AA70", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260680, "uuid": "a0418942-5c06-4b6e-a39c-ae2e3acc2360", "comment": "Malware payload", "value": "60f9feedcf50597833ef163713caf8f05b8f0dcb", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "outcrol-biz", "colour": "#18AA70", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260680, "uuid": "1546d3f4-f925-4993-a5cd-6ccd17209857", "comment": "Malware payload", "value": "7d85940bd303368e045dc3112acf83d5d3acc69b1cfeda4ed6fab3e4bc710c0b9e93dd69d190a646bc56aea44f980683", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "outcrol-biz", "colour": "#18AA70", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260680, "uuid": "2d41163a-4d66-4e58-82f4-43dd9f4344d2", "value": "T1F0855A077CD109BAC0AAA33289A25292BB75FC5A0F3323D72E50B7782F776D05A35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260680, "uuid": "0fb18ca6-16b1-4bb2-b4c9-ecc4c0c3a619", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260680, "uuid": "af2f6e0c-004f-458c-9930-9f0e442533c2", "value": "24576:h2sZGL493w65weMrcoX/aNGEQNK8tGaD8qVwI:h2sUL4hqeMrNvgGESQ/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775260680, "uuid": "3604d060-e5ff-4601-bedc-66f9fddea6e1", "value": 1856512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775260680, "uuid": "f461d8b3-408c-4f34-82e4-cc435b29af02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260680, "uuid": "342d4890-0165-40fa-8263-d146a95a16f8", "value": "cLaunch_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be328a62-2fa2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775251144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775251144, "uuid": "81d07535-d53e-456e-b18d-9c68c77119e4", "comment": "Malware payload", "value": "6f1d4ff44418bf1adaf2fef8018d0cf3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775251144, "uuid": "132b0d70-d0ed-4e61-b3a0-caf2ac685fdf", "comment": "Malware payload", "value": "f2559c75597cd7ab5ad85ff689191d0f8fd91f0c1e2af541c341baf6db8d32d7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775251144, "uuid": "df9bfd66-dcd1-4597-8f99-3056629fb04d", "comment": "Malware payload", "value": "09c8f7e735be8180b158e6efcafe930632d204ce", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775251144, "uuid": "e499e99c-d143-4673-b5a6-17b700bc5a75", "comment": "Malware payload", "value": "68d04384d598725f4293abb4092e83a59173580618f7fee95aa45f1fd9eb35e49583f181b326da4393e2b2e2895ea98d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775251144, "uuid": "4c309b2d-ea93-477b-912e-c18b4aadbd47", "value": "T1FDA63356B742DB83E2769B358C7657D5107B3E19CF130293664A723C3CB2AC48B62EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775251144, "uuid": "daa2f277-a703-4ca2-a973-30ac32bf1446", "value": "196608:Rm1wWwPLCLH+QN4ut1eMSuvNGxYhbhTRRptBkhRuxUPcxQHkiE1koo:w1xwPmLH+luHeFeLhVlkfugcun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775251144, "uuid": "0c0f7c90-ab9f-419d-bc9b-d2705bc286cf", "value": 10234424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775251144, "uuid": "f9c5358b-8815-4c75-a4e4-da9e086cd5e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775251144, "uuid": "6cd94e31-4dbc-45cb-ac61-be01edcec036", "value": "Questionario BNL.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2328f92-2f72-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775230589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230589, "uuid": "bf99b497-6203-4644-b608-921b81e8254f", "comment": "Malware payload", "value": "8d88f7e684dc149e315ba62cdd85a01b", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230589, "uuid": "187a033a-d2c5-4efa-abb8-3bef304042c7", "comment": "Malware payload", "value": "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230589, "uuid": "9b6d7623-b23e-44c2-bcae-611209970da6", "comment": "Malware payload", "value": "3b161ce1fcb200c634fa3e38b1cf7c4b5517c017", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775230589, "uuid": "0a4e8c81-2d0d-4bab-93ce-4b09b5faf7d7", "comment": "Malware payload", "value": "5f5bac1d97492a86ecc4203d34af62ce3055c1bc196538e0c1a0ac14f75b7b5f43b31af0e8be9b3c7523a15c2730f5ff", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230589, "uuid": "c7c72392-e93e-46fa-8c9d-fd47d5049b95", "value": "T1BA363342F3D34976D2A05336892195202D273D381DF6AD0F2E78C64F4A7E586C97BBB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230589, "uuid": "08ade2b6-8850-44e4-a6c0-f3e31c3b5b0a", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230589, "uuid": "6f398636-7d25-458c-810f-b593c404e6fc", "value": "98304:4L2CMteh6sQLHKBTf+GDy1vsRv+45rEFYMbXE7R54d:4Kmh6xLqBTf+Ge1vsFMFbXE7Rmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775230589, "uuid": "55f2ec33-9de8-4d5d-9432-446f51018a30", "value": 4930103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775230589, "uuid": "73319632-5c00-4298-b070-6d6b1d40d22e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775230589, "uuid": "2c877230-6770-47ad-ba58-686103ff6e10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2b762c-2f78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775233156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233156, "uuid": "ccdc78b9-66fe-4417-81c7-3496915900be", "comment": "Malware payload", "value": "5d1768c9c27d0ced105446c212c7f66f", "object_relation": "md5", "Tag": [ { "name": "indonesian", "colour": "#83EF5D", "exportable": true, "hide_tag": false }, { "name": "mainhack", "colour": "#3D43E1", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233156, "uuid": "d22c7131-7f87-4254-858b-f737b8d4230a", "comment": "Malware payload", "value": "f561ac8aa7a8ec788938248c24b532788eba83846ee2e6e443a81c119123ed69", "object_relation": "sha256", "Tag": [ { "name": "indonesian", "colour": "#83EF5D", "exportable": true, "hide_tag": false }, { "name": "mainhack", "colour": "#3D43E1", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233156, "uuid": "ba630ec5-376d-48d1-8ada-cf4b89a67ee9", "comment": "Malware payload", "value": "27e9e4cf232f1e39f9635a3978cafe685736a3db", "object_relation": "sha1", "Tag": [ { "name": "indonesian", "colour": "#83EF5D", "exportable": true, "hide_tag": false }, { "name": "mainhack", "colour": "#3D43E1", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775233156, "uuid": "dfaa1c63-a3ac-41e5-9b13-32be2cbae6b0", "comment": "Malware payload", "value": "512dbab014f01397cc3e97a0c408c4197c5aa0ed7575cbd6a91fc109402a9f6f379f58182ff2e1e7a9e0d039ab4bd006", "object_relation": "sha3-384", "Tag": [ { "name": "indonesian", "colour": "#83EF5D", "exportable": true, "hide_tag": false }, { "name": "mainhack", "colour": "#3D43E1", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233156, "uuid": "ab5a6e05-ac97-42fd-beee-9b333dc95580", "value": "T1E892D6A130485A7D91E387EA6332AB5B7C4EC8BAD757D4D4B0E93BF34391C23051B586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233156, "uuid": "dd0b866c-3e62-4979-b561-49d5830dd307", "value": "384:GbU2s2yxCjxXRyUayIk94EzmiZ/rTgAOxc/vQQQp79c05wpdJBxZLNHG848G:Gm0jx2yIUf/rTgAOxf79c0EBWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775233156, "uuid": "ea88aff0-267e-4f28-9ca9-47c3340fdb18", "value": 21071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775233156, "uuid": "2dcab98a-178f-4341-9ec6-ab5130f2f627", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775233156, "uuid": "a88bae94-2d61-44ff-8b9e-0e1e6530c4e6", "value": "mainhack-webshell.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01d24bb-2fb6-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775259711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259711, "uuid": "73a5d059-b7dd-4ce1-9750-b0cea5dccc30", "comment": "Malware payload (Smoke Loader)", "value": "e50265b3160b22693292023617073d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259711, "uuid": "dea7ce80-e2bd-4933-999e-1b35faa5127c", "comment": "Malware payload (Smoke Loader)", "value": "f6e63a680606f0cfdce4a37aaa97cc7a1ec0ea57351c45fd681f80273a15cc7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259711, "uuid": "5d1f7b1e-df33-4ca4-b1e3-4d8e1ec006bb", "comment": "Malware payload (Smoke Loader)", "value": "7e63454f290a9ff0240135354740b1a44191bc7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775259711, "uuid": "4a04c1a3-91bb-4b4c-b683-c221635d5edd", "comment": "Malware payload (Smoke Loader)", "value": "43149df7310eefa0e0ccf9e19911b409e4a8701200c8f1fc4df273b17ec0ee4071794a9f6caf48288206451484ff6e9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259711, "uuid": "68db7c52-51c4-4d7a-8259-60fe42f50c32", "value": "T1A365494A7CD108BAD0AA933288B756D27B72F8590B3223D72E50B7783F76BD05975720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259711, "uuid": "c576ca25-2e8b-48cf-b891-96047991878a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259711, "uuid": "feede973-026b-441c-af7f-7a26dc8df9ce", "value": "12288:/lQjW7Qkc4VF9nToU0MBeJ1TpUgX4W5ZuV8cqGvdzkDMfbGRcA+MIwazkiyN:/lkZQV/nTVuLigXaqGFWPRuYaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775259711, "uuid": "b6943f90-5913-4eef-86b2-f1b7a8e8008d", "value": 1467024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775259711, "uuid": "b3050ef7-b6e9-4161-8f5d-9bfbf91ee5e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775259711, "uuid": "3135b4b6-fc14-4cec-bb02-ee061b284c51", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd90aca-2f4b-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775213539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213539, "uuid": "a7375c82-bd4a-47bf-89fd-730340686795", "comment": "Malware payload (RustyStealer)", "value": "fb651e855b65b3f3e73bcd16b362a455", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213539, "uuid": "a4d7ddac-a39f-4568-8e93-d4f0442cf31e", "comment": "Malware payload (RustyStealer)", "value": "f81ecb59f4088e9c98ed5722b5835ccd1aab215cb79671c095bccb754801f0cb", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213539, "uuid": "f372b818-9b41-4be5-a1d9-c36955120ab9", "comment": "Malware payload (RustyStealer)", "value": "61e9fa008e305803ddb1c765777ec8fb63fa7acc", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775213539, "uuid": "aa7c5183-8c6b-45cf-981a-a7f4f1138b28", "comment": "Malware payload (RustyStealer)", "value": "6367462c7cb39c59cb2d01ec5855632fd33fea45df43dd590c098847bf7634a4b22d4e73085d0915d2abb5f40e2f610b", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775213539, "uuid": "797daede-8127-4546-adcf-67f5bc052edd", "value": "T1AD66C0B87294BCFA971F437BC6962DAD53662733468A98CD1074F3C21613675FE2AC08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775213539, "uuid": "7f53924f-e5a1-4106-a15b-ec79804d75ff", "value": "43bde8802b940524fb43cd661cade5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775213539, "uuid": "ec0e27e1-73df-4573-a6b2-2e455d014767", "value": "24576:Gwe2RUYsx1QIQ8POq1hyP482I48YIatUq84WTmXC4txhw6GhlMQZiIqy94VdQxP0:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775213539, "uuid": "7a9b3c4a-5523-4dc0-8c6e-573c44f0f49a", "value": 6964736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775213539, "uuid": "33bb4fc7-c1a4-462e-bc91-ff3959cd893d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775213539, "uuid": "a5db1d44-0b7a-434e-b758-ff71a617b94a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109344dc-2f84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775237968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237968, "uuid": "71c51f93-9b01-4d41-8858-1fbcae0b1648", "comment": "Malware payload (Mirai)", "value": "dafea7c4bf8f4888677970bb079c3ce6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237968, "uuid": "4599b789-e592-471a-848d-098ffdd2b960", "comment": "Malware payload (Mirai)", "value": "fc713295897316a62ac2f072ab22775c4be9ae5147fb94af48bd7e657a8d18b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237968, "uuid": "f18d02f9-435b-4937-b6fa-30fb85dcfc40", "comment": "Malware payload (Mirai)", "value": "675e9be3e602dcb069190b987bc4bd32d71bba57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775237968, "uuid": "ae32eacc-0921-4c6a-98dc-256b71b186e9", "comment": "Malware payload (Mirai)", "value": "fd5c6067185b186996c45ff40e78d386bd4037c1007cf78f91bfad4d8cbe591242a53541c4d571b980a503108f1c77f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237968, "uuid": "080ea4ea-440c-40b2-a700-c636f76640ab", "value": "T12AC2E195D2450CD4DBEF6E718CC5A3E317E019F4BA96BCE2D280ED42E941BB102F99D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237968, "uuid": "db65da37-812f-4c28-8d58-61bfc2225906", "value": "768:vuG7U8RzULS2kR1jFWDfI32wZ6YcUq4uVcqgw0RNWXo:vuG7kS2cA0mo6Yi4u+qgw0bWXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775237968, "uuid": "74c63750-30c0-482a-9a7b-94887a1fdae1", "value": 26752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775237968, "uuid": "c22c0faa-92a4-4165-b67d-5130c95a80eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775237968, "uuid": "f12f75a8-097a-48e3-993f-2b0ad31e455a", "value": "yakuza.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbe5b44-2f64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775224327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224327, "uuid": "522ee9b0-3fd5-4738-859e-ace4b609292c", "comment": "Malware payload", "value": "b19951e8a322bb116813a84254136853", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224327, "uuid": "883524d4-e86b-45e4-b6ab-ea766d4710fb", "comment": "Malware payload", "value": "fe0673443f05bf3f8aa907f7875012035f5599b2011df3553dba2908803ca8f2", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224327, "uuid": "e1c6ab07-64e3-406b-8ef9-b31c4b302f11", "comment": "Malware payload", "value": "8ff87bce893fbabbcb5a34a00579626b7f9b5b1a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775224327, "uuid": "9141a668-181b-4eb0-916d-489ac981ed27", "comment": "Malware payload", "value": "4b2d3f10466dfaaa71d3a81076ad2e4a3246e510df99ec9a50df3f3fe19be94b60fbeb27b95d34941fe4005d869a5531", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224327, "uuid": "f8dd854e-418b-4db7-bd89-faa7396ddf94", "value": "T16B473362E9E0818F2349458E1C231BDB79E78F9F9987DBD036F760A7882CDE10BB5550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224327, "uuid": "274a466c-d042-435e-ac15-a318b0224cef", "value": "786432:aylk5EmDwra7GQrYR9Rtb1B2Dka3DQas1CxiEFWOAIgy:ayMEmcQ1rSRBPM3iEFAIgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775224327, "uuid": "4528079c-3152-4a70-956d-be26916aadc7", "value": 25201427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775224327, "uuid": "3e3f0233-d058-4576-9e23-0a4d4adaf0a7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775224327, "uuid": "1702aa39-5245-4935-88b9-0a53329640f6", "value": "Libery.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967b3416-2faf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775256661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775256661, "uuid": "4207fd43-f86d-445a-b088-32fe9e6be6da", "comment": "Malware payload (Mirai)", "value": "6f276fb35587a7fa723543ff6df97281", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775256661, "uuid": "eefd43ea-1b32-4438-a6ce-85c3cde9b051", "comment": "Malware payload (Mirai)", "value": "ff3e64769793f229ef263a04df3a0bed5e4c7e73f71cfdab6b914b323fe63dea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775256661, "uuid": "8ddb169c-00ed-4416-9466-32fa4a019932", "comment": "Malware payload (Mirai)", "value": "deb634ed9ed1b43c39cb3addbe665d3d2e0a279e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775256661, "uuid": "deed912f-fa3a-478c-ab60-04f514358b8f", "comment": "Malware payload (Mirai)", "value": "f714222ab50af51465ee3701ee20a3718546e12df816c8d37d7fa5bd663201682944b8395e82eabea2571122bf7d28be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775256661, "uuid": "8e612c29-f7c2-4485-8ffb-8572b975dd53", "value": "T14544F90A7B510FF7D8ABCE3702EB0B11248DE81727662B767238D978B60A58F55D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775256661, "uuid": "97b5e201-6d37-4826-bf1d-9671a26aaf43", "value": "6144:qF6M75NF91jhq0KG62kipqMsqXznPL0aPsuAT4nWmfrqZDpbAVpsQZr:qvHH9sqTPga84nWmfrqZDpbAVpsQZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775256661, "uuid": "ab74327e-42d2-4a7c-ad65-ed89183e8cbf", "value": 274134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775256661, "uuid": "d145e324-2ac0-4a54-ae79-373fba954906", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775256661, "uuid": "1c753583-f556-4889-8603-fc70c3d73a32", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }