{ "Event": { "published": true, "date": "2025-11-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-05", "timestamp": 1762387381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "cd15a8ad-aabe-4da5-a4a7-ae97da3084ef", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18d4789-ba48-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762348209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348209, "uuid": "831f59f8-d31b-4854-9b0a-b8b28b5755a8", "comment": "Malware payload (RemcosRAT)", "value": "526c29ce842d86fcd43acd32b8eaf2d9", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348209, "uuid": "401742dc-7aeb-48cb-aa7f-69fada95b272", "comment": "Malware payload (RemcosRAT)", "value": "0010f5c47bf4153d73f5e274a5e38ad971be6b768873ecdc9468be57d7395db9", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348209, "uuid": "0fa5a68c-d0a3-427f-a338-526ede62c8b1", "comment": "Malware payload (RemcosRAT)", "value": "6236a2dcda5461af6be90acba225fc09b95e779f", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348209, "uuid": "73377677-2109-4a09-ae88-0eb7c0d46eea", "comment": "Malware payload (RemcosRAT)", "value": "3a0511cd567845a13672839084db4fa0729ef5ac74a1130b6226a24cfd282818059b82cd10e8efc7a7614a0b1d0a8405", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348209, "uuid": "3ceffdf8-b276-4b7d-9a9e-daeffa5443ff", "value": "T15FB4AE01B6C2C0B2E17354310839EB75CFBDBD242835997B93DA1D57FE305919A3ABA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348209, "uuid": "05aef1d7-70fa-4126-b9dd-c3970d2ef879", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348209, "uuid": "b68928f4-2780-4b4c-a26b-68a765a400f3", "value": "6144:FlNyrBOlAl4eajA0VGnjeBobKvrsHaerUnYNxi9lw7RuqdwqsAORZq/XQ+cqs1Mw:Fl8oq4eheG0YKvA6erU5XwNFsPZqmSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348209, "uuid": "b2536411-545c-45f7-9331-455a8f2e4e2c", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348209, "uuid": "5a3a7fbb-0795-4854-8c1b-9bcaea7de4a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348209, "uuid": "b4d07d4e-df22-4465-bacd-fdaf5e594a02", "value": "0010f5c47bf4153d73f5e274a5e38ad971be6b768873ecdc9468be57d7395db9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e09301f-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762335963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335963, "uuid": "83c9ed71-5db6-4104-8b27-75dcc7676890", "comment": "Malware payload (CastleLoader)", "value": "f854cccacf472ca2d066a697125d8a71", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335963, "uuid": "d6c93dc1-a2fa-4e0b-958b-5eaa1bbac7d4", "comment": "Malware payload (CastleLoader)", "value": "007f031d4ba5f964136fe73615f524eccdeced5cd7573c281bc1455d5cab2ff6", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335963, "uuid": "c00ac3dc-e8e7-48b4-b8c9-1e3262ffdd52", "comment": "Malware payload (CastleLoader)", "value": "bbeabb67ac469f9faaeddea575135cdfe81b9a76", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335963, "uuid": "a34fe05f-fd92-4770-b494-3ecef08a722d", "comment": "Malware payload (CastleLoader)", "value": "1c1a937aa009406c9253e52cc7f376d7f1e30774891aef0d08e5ba8785d3602952ff312083148d0620c10ccea1c333f8", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335963, "uuid": "a9424699-5000-491c-b066-3a4ddf7fe8ed", "value": "T190F6333BF228913ED5AA573245B397508D7B6EA5A40A8C1F03FC748CCF766101E3BA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335963, "uuid": "74d8f960-f991-48f0-8a36-10b880ebaada", "value": "3f0bbb69bc59a514036d24e77dccf076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335963, "uuid": "adc1ce92-2b7d-4936-9f70-fdf873901226", "value": "196608:58jdu6iBsQ5gudSoFr0lQz+kDfYdQ4Si9LCXC4MaUH6HTBcv4lgLXF:eu6iBsQ5/Sq3+kR4SOCLMaUazBU4lCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335963, "uuid": "692664c5-4824-4865-b58c-65f35858f4d2", "value": 16786907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335963, "uuid": "e2967e99-aca3-43c1-8b7f-103b365f27db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335963, "uuid": "b11a162e-068a-4a81-a584-fb3b788799cb", "value": "007f031d4ba5f964136fe73615f524eccdeced5cd7573c281bc1455d5cab2ff6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3166e39a-ba66-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762360852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360852, "uuid": "76ad2ec9-cd8c-46c4-8e1d-799cc1d8a0bd", "comment": "Malware payload", "value": "0be8ffe731fb2c597909aa756d67a55f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360852, "uuid": "26ed4569-69b6-4d7a-bf5c-8b2a58dc5677", "comment": "Malware payload", "value": "01103e31f8327a9ab98d30e679bc8f8111ae7994c523979351c5306c3e0f2b0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360852, "uuid": "c395d7bd-d6b9-4ebb-bd84-e366063a36fd", "comment": "Malware payload", "value": "ff61994290fea04d1bf35d6c33d89f0232f00d6d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360852, "uuid": "8d5f73bb-10fe-4670-bc8f-120eff392529", "comment": "Malware payload", "value": "948a65c31e4398c837028b59bea5cf08f226d4c7a827f07873086bf5f8ac5aad898ac1195f0ff6a867a6d0fac7c82c9e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360852, "uuid": "c1cb9d7d-2bae-4bc9-bf72-2a4d439b2f23", "value": "T108957D751B98BCB43BFDC226CBC2DCF816677105B9437CCB449523AA0193792FE2664A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360852, "uuid": "ffb52839-01ab-4995-95a2-ba284f68a52b", "value": "24576:xbmxYRrjmJgJg1lnsjNVbhGCe6dZm2hr/3+6XziGYHnbbNxMcONJSbtexsnzpodf:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360852, "uuid": "452eabd6-bb8e-48bd-b72d-fbcf37daf122", "value": 2025831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360852, "uuid": "6ac4ad3a-4c2f-4449-8e80-232810436e87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360852, "uuid": "5e31329a-6726-4a91-a5da-47753d4c8a17", "value": "Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c26e71-ba04-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318735, "uuid": "178edc84-d06f-4525-8ac0-f8bae05eb5eb", "comment": "Malware payload (Mirai)", "value": "a1e755e2531ce2fbe3ac3631ef9acda1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318735, "uuid": "970c62e7-f9c9-4f76-81fe-d03619bf268f", "comment": "Malware payload (Mirai)", "value": "02e0fe3a4509cd00d36b4ad1fbe6205bd33f3840ca496670546152c7eb5fcaa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318735, "uuid": "7d14a987-b9b0-4faa-bc3b-116b028b681a", "comment": "Malware payload (Mirai)", "value": "c892cb9c750e176487d5da8fe553145971eb4304", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318735, "uuid": "fcef4476-8a4f-42a5-8391-a136fd5eb02d", "comment": "Malware payload (Mirai)", "value": "7e0fada19e3fb4aa50bc34b4c64d0e70dc175221d85a3d527e2302dd3c60b19b0a0da7d423409981b42a017f1bb93314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318735, "uuid": "ab80f40f-75cc-4ec4-b8e9-36c961abfac8", "value": "T1A6B3D606BF601EFBDC6FCC3709E91705258C651A22B96F3A7A34D92CB60B64F19D3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318735, "uuid": "c4b28325-bb16-4b39-bb10-544402676543", "value": "1536:lMUJ4is56ugRxUB9kP9REhg0KMFxu6/mxZe2dX1KT6OX19:lPugbrEhg094GSKmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318735, "uuid": "4a9f7e93-209c-4957-b752-f68e9cd7ed5f", "value": 109248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318735, "uuid": "d918d956-8d6f-4ff4-b76c-ce51316d25d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318735, "uuid": "50ac03f3-71d7-4387-82d3-9d43e832a4a0", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2479ba3a-ba91-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762379299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379299, "uuid": "32cd7e83-fe24-4978-8cc5-b8ba64512608", "comment": "Malware payload (Mirai)", "value": "b76157b0a9c8585a435ccd26c17da971", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379299, "uuid": "284aaf0d-2746-44b9-b613-69ee71cdac5a", "comment": "Malware payload (Mirai)", "value": "031d9bd8a83924a33fd4f55f0984ab42b6f8aefaf403eb0c089e0886e8156b93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379299, "uuid": "dc0d57eb-a527-4f8b-b1b2-a863cb8b0672", "comment": "Malware payload (Mirai)", "value": "f5f4db24d8dcf73acc2ae601a74f0b7c915d82b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379299, "uuid": "48ba4c11-aa25-43ca-a923-8c7b921e08a8", "comment": "Malware payload (Mirai)", "value": "36b0c2410613c4ea02e3856c0a98d73623719c5851a757d234e5adde06ed9b3bdcb86ccf077c28f789d717e45fbb83b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379299, "uuid": "ac106d6d-471c-440c-9be1-df8c7f9a2a2f", "value": "T11E737DC5F983D4FAEC120535117BAB379AB7D13E2169DF43C3B9A636EC02502E51A26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379299, "uuid": "d409ae3a-8fe4-48b8-aa50-7ce8d06f6024", "value": "1536:QDDxACSA5kW1wlfo/LGeBX6qddthEZlJ0DDDDDDDDDDDDDDD:Q/xAAjClgjGO6ydIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762379299, "uuid": "8da2dc55-6a44-4a7a-a6b1-57c0498d3ea3", "value": 74932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762379299, "uuid": "5c084795-4568-4a5a-998b-7d8d3b824041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379299, "uuid": "28731b76-3d59-4c5e-9cb0-c2c26fa78221", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb85fa8-ba48-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762348092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348092, "uuid": "6d68b8a1-947c-4fa8-9b08-b16c5bf032c6", "comment": "Malware payload (DonutLoader)", "value": "04de27baf1fcc01124c5f628eada6baa", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348092, "uuid": "3621095f-c613-4994-9075-5be626bb7e9e", "comment": "Malware payload (DonutLoader)", "value": "045ef7693f5bfe30f2fb352020f2308e8b1c167624542c5e83a14c4b07b4cc25", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348092, "uuid": "0ff3f76f-3616-4132-aefc-259da7cc57bc", "comment": "Malware payload (DonutLoader)", "value": "1963e9603a3262b8b12494802f43e52e127f2648", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348092, "uuid": "8e323adf-ecb6-4ac6-8364-1c9abdf8ab20", "comment": "Malware payload (DonutLoader)", "value": "af5fc6625afbbc5e89bfcff1289fda78603960b23e9e3e3c53f4e05f4f6e8646e3e6d2c20b92fb60e9b6297505c8a32f", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348092, "uuid": "0cbd51fe-42f7-46cc-8fd2-e47c0973bcca", "value": "T1EF86D50027E0249ED3E7AEB1EB2E61D0EC0E2D1B39C64C4BB125BD96757E51AF660D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348092, "uuid": "0375b9e5-ed94-4924-9210-b7fe74b50d4e", "value": "196608:hdfhaETiHQL/1OdoP2tiwCXeUg6dcVwCcSUvtR0:hdfZwmeuYOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348092, "uuid": "3215d778-102f-43c0-8773-ee121f7e98ce", "value": 8198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348092, "uuid": "3e6a8582-d2a6-48d4-a36e-15bb4879baae", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348092, "uuid": "dbcb2d60-55c0-48fb-8bb0-1eda7abd0ddb", "value": "BANCARIO-BONIFICO-93883837373773737373737737325612-pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d076a14b-b9f9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762314304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314304, "uuid": "e0f8aa19-36e9-4d02-9591-eee08c010067", "comment": "Malware payload", "value": "8337d2f45db030516104d347d5892e37", "object_relation": "md5", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314304, "uuid": "57604681-ba0d-420c-b4a0-3460b7c2b03e", "comment": "Malware payload", "value": "04e5aadd34ca00ae40d9250fe44dade260501fdafd910e4a2d66c20edb9f9de4", "object_relation": "sha256", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314304, "uuid": "104b9db2-6c03-4536-ab99-450365fea615", "comment": "Malware payload", "value": "cd8ec5d84459d79002dabf10f85c66f251f0be62", "object_relation": "sha1", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314304, "uuid": "92f5671b-c1d2-4c5a-80fd-a1160687a258", "comment": "Malware payload", "value": "1563d0bff9d8e092246bfe70fa2e8c7d03d4e9fb26c8cf8aed1f629dad23a6aa515a5cd499352b3ceac67b06bd6fb897", "object_relation": "sha3-384", "Tag": [ { "name": "147-124-222-89", "colour": "#DBA0E9", "exportable": true, "hide_tag": false }, { "name": "blackhawk", "colour": "#098E82", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314304, "uuid": "ed54c4d4-1144-4684-93d2-8ed4020b59a3", "value": "T158B2528C3FD6B2740376A0337D2FA45AF66FAC65364C5060E170F995F8A8708E6B652C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314304, "uuid": "050830d1-1364-47bc-ab18-57f73f0e6d0d", "value": "384:xZHE86XklyGZ79+YT73RS+zrhwdfhQGMrd4:xpZko9+Y33Vzrqthwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762314304, "uuid": "ef73a4ab-9570-477e-a923-99abfddc0fd1", "value": 25131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762314304, "uuid": "53ff76cf-40eb-4857-ab6d-14787cb784fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314304, "uuid": "d069a722-6829-49a6-9c0f-7ca07e594db9", "value": "obfuscated (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cd718a-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762335979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335979, "uuid": "13c6e273-92e5-4215-9840-002bda6afe51", "comment": "Malware payload (CastleLoader)", "value": "d195e39044641f3b1f74843318bca182", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335979, "uuid": "3f082313-0329-4b7a-a771-543cd466e00a", "comment": "Malware payload (CastleLoader)", "value": "05ecf871c7382b0c74e5bac267bb5d12446f52368bb1bfe5d2a4200d0f43c1d8", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335979, "uuid": "f96365c4-994b-4093-9c47-1dc73346460a", "comment": "Malware payload (CastleLoader)", "value": "6cc3c8c15e72d173c00421573378855baec3ceae", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335979, "uuid": "921c5707-5077-4622-b777-a3c970bd8cd5", "comment": "Malware payload (CastleLoader)", "value": "d2961ea49164b7d2323853ec0e1abb14d601a2e9a47c59df3335ddea6b4dbc26a886aee27dffacf8f0c6e882c5650ebc", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335979, "uuid": "25f990d2-d6bc-4961-86e8-a7ee74128322", "value": "T191068E30B60B8027DC9711B15A6CE7FAC23DEA250B7214D7E3D46B2D0D955C22B36B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335979, "uuid": "22d766fc-0b2e-44a7-9652-99c76f286ea7", "value": "49152:q2XHEQ+f38ZYjTgjU4bLOjV+2Mlst0f+ihmnlFiRR5QRJKgtMtcBtN6pEcbyz0Rq:Qf388TP4ejVlU+ymuRqPo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335979, "uuid": "f418da75-92f7-45d4-99c0-0d3c7bf6b5a2", "value": 3817472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335979, "uuid": "caaaf7b3-abce-4e77-9327-37482e828955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335979, "uuid": "6e85d0fc-9251-4e21-92a1-f9c1f458fe9d", "value": "05ecf871c7382b0c74e5bac267bb5d12446f52368bb1bfe5d2a4200d0f43c1d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f83d0c0-ba16-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762326677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326677, "uuid": "12a5e2c2-b38d-4c28-813d-03cc67b31bdb", "comment": "Malware payload (Mirai)", "value": "443b409d98e72032df0c431765614997", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326677, "uuid": "637e9258-4808-4ef2-a060-87e69e166178", "comment": "Malware payload (Mirai)", "value": "06204838d6f63d54dfa1413d4e18764c5b363a13b0e9e3c463800b6df9c14509", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326677, "uuid": "02985f7e-3ed4-43c5-a468-2334ab3efd4d", "comment": "Malware payload (Mirai)", "value": "b4d3eef9467c84c935bc3a745c0f44b691b57daf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326677, "uuid": "89d9f7ed-a407-444e-8ae0-08a1c56fb4e9", "comment": "Malware payload (Mirai)", "value": "941a9eb051126569edcb1d8d8d18b8add425468e678a1021b7173952f5b97c5f7fb55a531cac3a875ffbdac5707f461b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326677, "uuid": "fa149b3b-bfa2-4f95-bad9-31af2e6f52ef", "value": "T131A2D025D3456EF4DFEF9DA053C1C3C2B6E547C6278AC8E240EEAF022506456B788D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326677, "uuid": "72226cc3-207e-4d4f-b2b8-e44800df3d15", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5NsQM4uVcqgw05VxJ2:mRxsSVsMD6xiJJE5zRWNIP4uVcqgw09Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762326677, "uuid": "c7643f42-7bb1-42f3-ab3e-129f03ad5d84", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762326677, "uuid": "7f473e48-8837-472b-b237-3f15e45a905e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326677, "uuid": "abe098db-7e26-4f36-a0b1-cdab101526d5", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0885a548-ba23-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1762332007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332007, "uuid": "cf48a2d0-1207-4938-9bff-04156bea3f39", "comment": "Malware payload (njrat)", "value": "b6778ecf784456b2c4d3dd69f981dc4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332007, "uuid": "aa743e71-8d6d-45a0-b311-c77227787184", "comment": "Malware payload (njrat)", "value": "06cbe99ced09369211b026246f34d26d30e394b7ff5a425cd33b10e506266a77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332007, "uuid": "7c21056b-aba1-4901-944a-db40d29c1872", "comment": "Malware payload (njrat)", "value": "dcc5afe80e2288704d3f1e859281f1b8cc318e64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332007, "uuid": "d33f63e9-055a-4e86-a3da-4de1864ba4e5", "comment": "Malware payload (njrat)", "value": "537805d70b2d4dec32495658ac9eb4e48a8c5b386086985d2ce84da2dc2cfa7b8bbb0372cd2a56ade2551f37ca5a9bd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332007, "uuid": "3655a9fb-0ba8-4de2-8157-f17c1b6314f5", "value": "T1CD240A2F8B89CBC3F4CC6EF15A2245B153FF6C46146E029B896579B658627C213CB09F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332007, "uuid": "f4d8cd43-501e-4dc2-8989-f448c904efbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332007, "uuid": "e17d8704-ae54-45f7-b537-2284416f0c95", "value": "3072:Tb+1m+70r3h4iDgfx9ra84/AD4ihCLGHLEq9HHD+UE:TbO/Ex4cgJ9+8XDMs9HHCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762332007, "uuid": "cf7e13cf-e374-4755-9ca3-68650fa52902", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762332007, "uuid": "7cae1e10-002e-47df-be92-832f9922f71d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332007, "uuid": "f0a07f54-ec62-4d70-84ea-b4d1f08d2b3b", "value": "B6778ECF784456B2C4D3DD69F981DC4F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23373156-ba21-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1762331193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331193, "uuid": "c0628637-2e3b-425f-ba61-f9586a02242e", "comment": "Malware payload (GuLoader)", "value": "7f1efb05f5c8025fb2f6913d356835d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331193, "uuid": "a37f878d-7018-457d-9aa9-fb20da3c0893", "comment": "Malware payload (GuLoader)", "value": "0808f47a5a5ed79de508d331dd4e8b22704ef7c26baa2fa8df26bc49dc4be323", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331193, "uuid": "ea059222-0a7b-4cdc-806a-1479ea19b231", "comment": "Malware payload (GuLoader)", "value": "0ff7bb20b657a5b49600d8b58515e7312d212321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331193, "uuid": "ec27989a-c912-43c0-bfc7-5aa6ea71f189", "comment": "Malware payload (GuLoader)", "value": "5d52f22e78c3849522f655278a87ee622525c02ae708902ffcbccb499393ef35aa56afec8faf53cae15f5ccadd8ece3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331193, "uuid": "744ea6d2-f435-468e-86bc-ea31b2c9441a", "value": "T173152239F0A9D407C6D19F359EDE948CD5F47E9119B98B2E4F107EAB6A30B61C80E306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331193, "uuid": "9f3a0b59-f546-4b6d-94d7-51b2f553982f", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331193, "uuid": "72ac215a-bf4b-4162-bbec-1776dd2ff66f", "value": "24576:QMwSt/77Hao68jGywD5BYM7Cc1fmP7khz1zuc7JY:QMwqj7GywD577CgOP2z1X7JY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331193, "uuid": "8ca3f7e8-fb63-487a-a118-349b39a51640", "value": 916952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331193, "uuid": "fd5a1eb4-d4fd-4c13-ab84-839abf2f6935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331193, "uuid": "1495198d-9d5b-4a45-934b-e1c9e8eee029", "value": "11042025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b552bbf4-ba99-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382978, "uuid": "2150a8f2-504f-4ee4-91ff-58ade9483936", "comment": "Malware payload", "value": "22bfb28d742f7bad7802e999c4fa7315", "object_relation": "md5", "Tag": [ { "name": "pb", "colour": "#BAC71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382978, "uuid": "0d30a260-523e-46f0-af69-37720e7bf8ce", "comment": "Malware payload", "value": "08dfbf9a98454d36d45f740f6d3ba8fb073af6410f98edcdd25ca3c580fc4fee", "object_relation": "sha256", "Tag": [ { "name": "pb", "colour": "#BAC71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382978, "uuid": "b1fd51ee-1376-4905-8c6e-91d1e99e9745", "comment": "Malware payload", "value": "54cd8ca7665f5745b6826c42def9b00ad6f60763", "object_relation": "sha1", "Tag": [ { "name": "pb", "colour": "#BAC71B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382978, "uuid": "747231c3-3ad4-46c3-9b14-d9307dda2245", "comment": "Malware payload", "value": "88762e35be5fe972d5ad32b76fc02434d3846bd1419ecdb3ea246b632bc09a055d80e95c782ca0192bca9a5846a6a9c8", "object_relation": "sha3-384", "Tag": [ { "name": "pb", "colour": "#BAC71B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382978, "uuid": "cf204ccb-9ea6-40f9-ade9-aa3e8f927883", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382978, "uuid": "05080db5-f2da-4781-a2bc-382b05ee3ac8", "value": "3:LbUWLMn:3tLMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382978, "uuid": "e9af3d26-071f-4844-84b4-1b5d52de628c", "value": 12, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382978, "uuid": "2fed4a91-2590-40b1-b143-b35b62a27f62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382978, "uuid": "4681621a-9707-4915-bb87-e042a74641c7", "value": "BlockIPAddresses.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874976cc-ba98-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382471, "uuid": "57398426-2fc2-4ee4-9bb8-04feef5d7d34", "comment": "Malware payload", "value": "5fe1e857a4ad7b211193bda5c5551f15", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382471, "uuid": "0f5fba18-ca7b-4521-a6e0-7ce78e2493f7", "comment": "Malware payload", "value": "09a13bcae7a29d359a141457c72235c2b478d77a88056a33e8aae75f9f0cfc21", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382471, "uuid": "00ab4fb8-f9ae-448f-a8e5-b5f4ec78ba99", "comment": "Malware payload", "value": "2def077bf8d7f3af3ee9b585dfdf2eea004113da", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382471, "uuid": "5dd082f7-c431-4228-b5cf-52fb7a479ff0", "comment": "Malware payload", "value": "b9ffbe88617bad7c51a7a80fc115732deff15f978a1600d9c05b79548698327a9e09853207141e8d6e36dcf1a460589b", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382471, "uuid": "b173cbfa-8cc1-4bbf-a7db-3dc247b2cc15", "value": "T13C54025FBC1EF117CEAD15A8814E2146EC89086CF697BB989CB2F4F23F3E199550301A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382471, "uuid": "f37ea16c-495e-4da8-a498-16dc4bf17c28", "value": "6144:tsApGDNy3mkVFYfXio8zP5ssApGDNy3mkVFYfXio8zP5ssApGDNy3mkVFYfXio8c:tGy3jYfXGz5sGy3jYfXGz5sGy3jYfXGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382471, "uuid": "9b602d69-1b30-403f-b657-6028fedfc99a", "value": 294969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382471, "uuid": "d91bd4d2-d0e0-4508-b6b1-bbd17c61f452", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382471, "uuid": "5b19364a-c33c-4438-a1b3-ef9fa5f6da38", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3817ed7b-ba4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1762348837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348837, "uuid": "4ce60ed1-f0bc-402b-bd7b-52ac3cdea033", "comment": "Malware payload (Socks5Systemz)", "value": "9783ff164a0e4dea2a4d785f582d3bce", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348837, "uuid": "336956ec-0b47-479e-be1f-60892235d271", "comment": "Malware payload (Socks5Systemz)", "value": "0a74b5f15d7dd4802828c5a353b60437f0191957066008ecef940179ec0be520", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348837, "uuid": "3aab8ac5-ff33-4aa1-84b0-4d7a850a994e", "comment": "Malware payload (Socks5Systemz)", "value": "9ad5000eff22d0ef01bdaa01d85e416c4083d970", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348837, "uuid": "f0a53e1f-5b1d-4b67-b89a-21d32ac327a5", "comment": "Malware payload (Socks5Systemz)", "value": "a0252613463faba6d0997627a19bb4b3377169688dc5c96fd9a4aa43356b374c568772297ad7ddc7aaa2e30f5b995817", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348837, "uuid": "134fd5ab-0b2c-491b-9366-e8a42708fca6", "value": "T1CE06334243A12AFED2535F348D8FB35A657BFD0C9CA83C2435D85DAD3F2944E8A44B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348837, "uuid": "cb6f705f-5c46-4e5c-a241-92a2f4caddda", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348837, "uuid": "8da5a9f9-3087-44c7-95d9-67b64bcc096e", "value": "98304:Mx5yC1h8eQyDbNOuEzk2P8/6bl12mjlgpTkEXO:V8fT9/+lzl6XO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348837, "uuid": "4889d184-82c6-45a1-8dd6-de97a65a86fc", "value": 3797928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348837, "uuid": "f707a8a9-7d0d-44a0-be0d-1fb0683f7b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348837, "uuid": "f54a835b-8ecb-4715-b4b3-e02942cb0ef5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c33fa5-ba42-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762345362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345362, "uuid": "6c27843f-aead-4ce8-a1b4-a80e6b7f4aea", "comment": "Malware payload (Rhadamanthys)", "value": "1779fb09ee33a613635dd21b249dfac3", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345362, "uuid": "3f7d6168-6e1f-462b-ac28-da9b3ca2389e", "comment": "Malware payload (Rhadamanthys)", "value": "0ae1d2e21015b7d04c89109d356f7b59cbc75018587d2938074bb795d104b408", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345362, "uuid": "fb268991-8d66-4f6a-9e87-0604101df7f6", "comment": "Malware payload (Rhadamanthys)", "value": "1bc80f18bce56979edd66c81f7fd90d9a972c7f7", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345362, "uuid": "b0def26a-8ed8-4a93-a79a-495fae29735f", "comment": "Malware payload (Rhadamanthys)", "value": "5078d0228dc75ee418c9cee3c87898bb8a6074fd54d83815b9609216733c8ff692758021baedd96a9cf1d1aec40b525d", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345362, "uuid": "0ad07980-05df-4f07-a20c-b67989ce4401", "value": "T17255EF8786C15896EEC508B82C6F1F349A34C89EE952CA439F76A66DCFCB7D1CC5804D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345362, "uuid": "88fceed1-db2c-4395-a546-78d76c195f5e", "value": "24576:mKuiJy/+GuxAP4e5HbvMioaBu3hHglcaevYvLxNE/gDFWz:AQy/TuxAP4oHbLoak3BaZNGkFWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762345362, "uuid": "6c0f8474-a125-4c2d-9ff5-5b4d0577416a", "value": 1397707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762345362, "uuid": "f64a94ae-f8a3-4c04-b27a-39baeed4f4f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345362, "uuid": "2eecdd4d-4804-40ed-8477-2add020abe84", "value": "Installer-x64l.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619ab3ac-ba98-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382408, "uuid": "5be5f37c-2a4d-420d-bc31-a34b3e35d901", "comment": "Malware payload", "value": "fdd540bbe66451db32836763b14cd81d", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382408, "uuid": "c1a1c8fd-3a06-4922-9c16-d29c367ca09c", "comment": "Malware payload", "value": "0d34870cc8150d0977ab0d02128629fca7104d47d43a76d419a46ba79532500d", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382408, "uuid": "585d766a-6106-46c2-8289-16909d884aba", "comment": "Malware payload", "value": "f8b65026bdd3c642141fc5b7eb28533312daf9ab", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382408, "uuid": "09afea8d-9ad3-4845-9fae-f0873cc8d1c4", "comment": "Malware payload", "value": "04c2c6f364650ec503a3b98c6849cdfc900d1c694ace4b231aafec235231b0dc341fc081c28a4e89641f36b5260c73a8", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382408, "uuid": "0df5c4a7-d447-48cb-ac4a-f782c62a6c09", "value": "T13B54120429C93736B6669EE07ABC70F3D083C7E008A516AD42F4FD1BC95E46BE395D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382408, "uuid": "3b6989e7-1a25-4487-8887-d4792469fb0b", "value": "6144:L/NMFH/isSZx+s/NMFH/isSZx+s/NMFH/isSZx+Y:L/OFH/inZgs/OFH/inZgs/OFH/inZgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382408, "uuid": "fccf6366-b279-40f5-86e0-07f3900e2846", "value": 293511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382408, "uuid": "a76d42c0-450a-49c6-a3ea-d586770632c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382408, "uuid": "dec760e4-c69c-4109-a2fc-82e719386c27", "value": "Ultimate_Guide_to_Contract_Deeds.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdd6e03-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318593, "uuid": "dc2f7b12-ac3f-4019-b3c1-4e3d3d64db67", "comment": "Malware payload (Mirai)", "value": "94eab36115ec1176a2b09c0dd1481b50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318593, "uuid": "3dc2a204-a1ca-4499-8956-4212b6446189", "comment": "Malware payload (Mirai)", "value": "0e3515c2e410a018303daa062a303907ce8fff18f8fe43c34a07e572e90e4232", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318593, "uuid": "38674e38-a097-4fcc-bdda-093289a74f76", "comment": "Malware payload (Mirai)", "value": "c159f296d0b65621e8963d7767b2a9ddbcf74446", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318593, "uuid": "89d438d4-865f-4b66-b985-bf3f5cfe1516", "comment": "Malware payload (Mirai)", "value": "ef97d196dc4e6dcec6df2940dd75fafbb1965dbc3a5877acac2878b89d48d994b8d662e61e7eddd314950b31c9b82401", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318593, "uuid": "746565c9-d46a-45df-957d-2714ff00a49b", "value": "T1F0833A51BD416A22C6E1237BFB2E428D332663A8D2DF720BDD226F1077C691B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318593, "uuid": "a7106901-ee11-47c0-a380-55fa517ece93", "value": "1536:ZDy55b58BgM7GD8s6bRRGwwQoBaq8vi8Mq0GdLzEsXntETWOMnGLzRumQhvKWos:ZDyC24uJKjovgWlYIsXGnaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318593, "uuid": "99f29297-fb43-45e4-b605-f57f93eac1c5", "value": 85128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318593, "uuid": "b0d90b6c-dffa-4c22-b065-71132d02537d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318593, "uuid": "472dfa23-3cbe-462f-b81d-0863213173c6", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d279d857-ba2f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762337500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337500, "uuid": "f0e9fe50-8e1c-4e6f-bdad-cd3701c09959", "comment": "Malware payload (Formbook)", "value": "d7ce6c361cf0a395853a7f06df22c71f", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337500, "uuid": "a94c11f8-5452-4c6f-9e34-d8f8a8c13669", "comment": "Malware payload (Formbook)", "value": "0fd7eb57f5f9d817dd497c1ce3be0791f5e798077f8dc2c3a4e2b2b0b0bdc2c6", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337500, "uuid": "4dd5d6af-8cc6-4411-8a9e-1de41a1b40c3", "comment": "Malware payload (Formbook)", "value": "d1e3a580d2411d1fe1e68d72277d5d5050c79c71", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337500, "uuid": "5472f126-b8b2-47f7-9714-37a3ad39b169", "comment": "Malware payload (Formbook)", "value": "6f81b01f6b4cd81ed3b70c10baa519aa7866df08025a97e2771f262f08a0190c4a4a14235174bab30c8932ef14076f2f", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337500, "uuid": "f029bdee-dd9f-44db-a542-5dc6d5b40426", "value": "T177453A11E641902AF9E300FAC3F70578AE38AB30231525DB97C479E9EB269D57D31A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337500, "uuid": "0a72224b-839a-41cb-8a2d-cfeb6a337621", "value": "b42527f43a705981f8b9e10bc7016d28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337500, "uuid": "bc082cbe-3716-43ec-bd15-f01b1edd7ed0", "value": "24576:wf2MiudMrA6SxNs81UnBJ4kbs1h6g1uR/GEflSxeGvDNrj3ljqCO/+tyznwAR+cu:AfcBGk87TTjiGyzZR+4ZMAdRiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337500, "uuid": "17035b0f-a7e6-49d2-b663-19b6251c41ea", "value": 1190400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337500, "uuid": "8e5a6b50-d4a7-476c-a07a-ada70b62e4f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337500, "uuid": "4e415364-5f44-4a61-94f9-62559946e873", "value": "0fd7eb57f5f9d817dd497c1ce3be0791f5e798077f8dc2c3a4e2b2b0b0bdc2c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db6121d-ba5c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762356605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356605, "uuid": "4f5a09d3-7fc3-49e5-93b8-065e82cb5ac7", "comment": "Malware payload (Formbook)", "value": "4a647d31488eafe8986f2fca99381206", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356605, "uuid": "d5466f68-4969-4783-b441-ce5fb357500b", "comment": "Malware payload (Formbook)", "value": "10bee70d4e0f6828a3a352e207e973cd9870f40e712fdb59c8f750e8cb56e6d6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356605, "uuid": "afd55bf4-f8d4-4350-92f4-b1645a2d610e", "comment": "Malware payload (Formbook)", "value": "66999e5ea2f96179aea09df3a3f0a423cb9a031c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356605, "uuid": "95f69585-3694-49ed-b6f2-7433176cb5c2", "comment": "Malware payload (Formbook)", "value": "1efb2adddf466fc6d7b54c6c6f1b569a2af841026fb42cd68f14001485b220eccfee7627aa06e17466d73497e6a9efef", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356605, "uuid": "a0b969d7-99d0-4cdb-b013-33d01fb62048", "value": "T1E7E4230637470334308A36AB53EAE8D07D47574AB375A0E8D829B3765BF832E5A4CCB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356605, "uuid": "9ce23f65-fd9c-4d70-b831-2dcdbf577b6d", "value": "12288:GelqAJMMdAoZDyX7hjfYj5U9zwtvojIshnciaciSYucPI8rm+60V9AhQFX:GnAJMMhFuatU52ofhnNBYtr9rAhuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762356605, "uuid": "7fc72e82-561c-4d12-8dea-8f46af75ac82", "value": 696794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762356605, "uuid": "18492897-1cb3-45a1-b398-ab55907b605b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356605, "uuid": "2ae0ea94-fdd0-4e8a-921f-b2e0f9236cf8", "value": "PD3920251103.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8063c99c-ba87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762375158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375158, "uuid": "195c9ef5-f06c-4be7-a118-11eb71b947df", "comment": "Malware payload (Mirai)", "value": "d189a7dc7f7c334bb8a6c5f60fc65193", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375158, "uuid": "8aa84746-d254-476a-b061-4fa6be9e1330", "comment": "Malware payload (Mirai)", "value": "10df3aca6948de087df836a860131acdedfbbd2c44d94cf91c11039dbc17f978", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375158, "uuid": "2bf3351f-90bf-409d-a873-a09462150d61", "comment": "Malware payload (Mirai)", "value": "a498c850cc5c1d3a1efc6094b9a1475ccf04339e", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375158, "uuid": "66d1fe29-5482-4726-8a1b-2fb844dc3f95", "comment": "Malware payload (Mirai)", "value": "fa5ae94988e49cfca516dd54542691a119c80f7d99aa97fa63d8c23d4223dfe2d8cdd572cd19eb2a39a524bf03a22d56", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375158, "uuid": "9becb4f8-953c-4d64-8f55-3bd539a498fc", "value": "T129D43845F8809F61C6D535B6F74D42A873074BB9D3EBB2069A245B3437EB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375158, "uuid": "be5fbe76-5546-48cf-a617-f2ef1a5c2c53", "value": "12288:Tk8cZgffdhPgryivr+J9aIGx23QXt2cXK4od2ye688pVkC+:Tk8dhPgrIJ/62gd2SKFQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762375158, "uuid": "f551fd9f-6c53-472f-ac35-40de7df45d4d", "value": 604372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762375158, "uuid": "0aba2b8c-1ce5-4a86-a29a-1bfddaa9bfdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375158, "uuid": "304b838c-34d4-4326-895c-727dd8c45164", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80165992-ba99-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382889, "uuid": "6fded552-9b13-4092-993c-84c646851094", "comment": "Malware payload", "value": "4722841f6d4cb885cacee7600a760cdd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382889, "uuid": "2fca683c-bd31-4568-aa97-76ea01b6ffe4", "comment": "Malware payload", "value": "113735ee423cef4d9f1feabffd032816f22eea88b3e103332883cc19f1136e21", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382889, "uuid": "f65dcbfd-847e-41e4-9a1e-2217c543f67f", "comment": "Malware payload", "value": "8f18251b32ade966cb18e69a220c74b69d9e36b5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382889, "uuid": "f878cb4e-b415-4681-9e89-511b52530abf", "comment": "Malware payload", "value": "aaeba0f347249f8752af3f9bee3b52c69016e03373e643492c9a55abfef625269669cb079ce5f58bc0c1760cf2d6faff", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382889, "uuid": "98dc1b5a-6a83-4990-bd73-e3ab277b62c1", "value": "T1C9242A17F35368FCC866D13446976332B5727C290134BA2F4BA0EA716E22E50BB3AF55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382889, "uuid": "abe76ac9-b2c6-4d80-9b67-d336489d69f4", "value": "a0daabc3a80e7d0785538c2055dc8341", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382889, "uuid": "a5f2912e-25e0-4090-bcf8-4ee2b6a9c774", "value": "6144:ZURZjtJ88tKgo8vxJnCGJqQAk9xMNVNOAFV2:ZURZg8tKg1HLdgnNOW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382889, "uuid": "ad3005de-a287-474f-a4c7-aa98bf90fe59", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382889, "uuid": "e9c84a66-c5bb-4384-88c5-0b203a192cd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382889, "uuid": "384fdb55-8480-4db4-ad26-e56ad142e473", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba85e279-ba56-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762354210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354210, "uuid": "06da955c-2bda-4758-bb77-e2680371c301", "comment": "Malware payload (Mirai)", "value": "05ea90def67396d604ca6c4268c0dd3c", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354210, "uuid": "7534b467-153b-4bbb-ac58-ae1f7c0d1a20", "comment": "Malware payload (Mirai)", "value": "1163395a2f40496f4e7d70b38a7cc84aa5ea294143e4931d07e5034b84238942", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354210, "uuid": "9438c637-5fdc-4da3-9a5c-fb630ffc24f7", "comment": "Malware payload (Mirai)", "value": "4113ebdabd7f1ba68648294be331313c71966b99", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354210, "uuid": "0a240b45-4af6-4569-8597-00d8b00d7902", "comment": "Malware payload (Mirai)", "value": "45abf6d56bc0dab332f5ca7a993f59ebe41c4b1e3e59cc8e5f4c74a12aaa6e542f1141f8481670154d8f3bde08e3eb10", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354210, "uuid": "a6bc4ea2-2c3d-4ffe-abb8-5cab6a390caf", "value": "T199D43845F8809F61C6C539B6F74D42A873074BB9D3EB72069A245B3437EB86B0F3A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354210, "uuid": "fd01e659-51ac-4742-b791-79d72bf56e27", "value": "12288:tT0M9MmnRby4ao/8vOOKetAVqeeJWeciDd2crUJ8pVkCd:tT2mnRbyZGGeVBiWDiMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354210, "uuid": "a0c299f4-0071-4862-8bd5-db6054d4bf8a", "value": 604372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354210, "uuid": "290a7ce3-c84f-4da5-a124-799bb6e53c92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354210, "uuid": "3ccc9d54-8af7-4c5f-8ae1-3ed2756f1b6f", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c772d1-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316814, "uuid": "bd0c67a4-806f-4b23-b17c-01fb420b0166", "comment": "Malware payload (Mirai)", "value": "abd623c4ae976460f2211978b1c9da3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316814, "uuid": "f9f27ed1-8a59-457b-abe9-628f1173e472", "comment": "Malware payload (Mirai)", "value": "11a9bb6be3b240551ac877e8295bd8e2d037e24037c652026b180095a874c014", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316814, "uuid": "3bfd147c-8688-4646-9ba4-923649664173", "comment": "Malware payload (Mirai)", "value": "f0596a304b5a4511c6f1713f0efe9627719747b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316814, "uuid": "13135733-3441-4751-8a2e-3c611a7ab75c", "comment": "Malware payload (Mirai)", "value": "ba0e7782177e034623ebdc8a958b42461045b4a7317b9f71dd1e4beea6896394199b273721916bc6a915b01ed8613ab8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316814, "uuid": "07fba695-c2e5-4dec-a677-1d8e9492d94d", "value": "T1F7434DD6B400DE7CF947EB7A80114A0AFA35726154A30F27A267FD93AC720565C2FD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316814, "uuid": "d93abc47-68b9-4110-925a-c666882c9b8d", "value": "1536:TKgor9Y1msaRM5PA+6X6aCkBnKSQDVFQFM8L:R6sEM5YXfLNmF2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316814, "uuid": "bd52815f-af1b-49d5-92f1-ba7cea83ad4f", "value": 59720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316814, "uuid": "e34154a4-54e5-4773-92d6-68a73c684ac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316814, "uuid": "d257fc78-e834-42ba-a5be-d82dd0078674", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eec1638-b9fc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762315482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315482, "uuid": "3bd84e5a-c007-4c01-805f-38f3cdf924e0", "comment": "Malware payload (Formbook)", "value": "f01e7c38b1d307924929e21a4b394463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315482, "uuid": "5afb9e45-2428-47e7-848e-ddfb407d35f5", "comment": "Malware payload (Formbook)", "value": "11cc53e72e2f50f162ecbf30fe545b9fbdec4527ae1fb36522a563e8303894fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315482, "uuid": "01c707c0-7fe4-4be7-8c35-67ef20ef3665", "comment": "Malware payload (Formbook)", "value": "b407c31fba5f7ba847f20fd03dce1add1abaf66f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315482, "uuid": "9f438b36-146a-4ce1-ae9e-890172986bdd", "comment": "Malware payload (Formbook)", "value": "612d2524ce742da719d9e2a51ac2bce652d0f51dbafbdd87a971e2e4965fc07ddde69fd72eef43a57a0fd534f73d137c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315482, "uuid": "a2e6e689-45aa-4182-91e4-9d006d3ac190", "value": "T1C445CF1373DEC365C3B25273BA16B701AEBB782506B5F96B2FD4093DE920122521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315482, "uuid": "80dcddbf-89bf-4967-904e-658ae503ae3d", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315482, "uuid": "4fa60b84-319e-47c9-b03c-0134023a767f", "value": "24576:vtb20pkaCqT5TBWgNQ7aqzKMSGihRzDojBSL6A:sVg5tQ7aqOFGivojS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762315482, "uuid": "7dd3251a-5051-4f6a-8676-bafb77eef16c", "value": 1201664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762315482, "uuid": "6a814bb4-1435-478a-ac03-16820a0c5bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315482, "uuid": "3408ad80-622b-4ac1-acb5-5dff035e80f3", "value": "INVOICE#R09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f2c23b-ba16-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762326519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326519, "uuid": "21d9dab2-ec63-4ff7-8fa5-7c61d1944adc", "comment": "Malware payload (Mirai)", "value": "381bbd0a2dfdabe1e3edc5583fccc250", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326519, "uuid": "df78fdff-d9aa-4404-8636-758b9a60d4df", "comment": "Malware payload (Mirai)", "value": "11f61a0222e99cd9d0e93837806335d50ddb02e3a6ced8cdbcc2876a9bb3ebc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326519, "uuid": "7ecfbead-da64-40a3-a46d-6229a25e80e6", "comment": "Malware payload (Mirai)", "value": "f1c29d396ea2fef243c04526e9bd942de04e0e46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326519, "uuid": "d96ff5ad-9e8f-41b8-b94d-010e96173731", "comment": "Malware payload (Mirai)", "value": "9404e313ecd86abdae824f0dc3f95c0a8abf6f1fb0e86e413a5f55ac1adc109c6e2ce51af0ad3196a4c528d4c968119f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326519, "uuid": "452014e0-5ecf-4fd8-ab5e-c2e90bfbeeb0", "value": "T14C1301F4A209B962F3BFD6F0AA75C177B30B06E2F925167AA1D23F55356430F1552880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326519, "uuid": "a33863ea-29ed-4b7d-9aea-214905efc3d9", "value": "768:p10aB7QgjZH7r4CJ0obKym642zHh9TBSxQI723CLOBT22mM14KpM7BUd:p10aBkgjdrmobKymb2TjTB34P2my4aJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762326519, "uuid": "799a5cbf-eac2-45b3-b770-dd91ac123237", "value": 45040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762326519, "uuid": "9603319b-63ec-4f86-b198-9a213f20f9d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326519, "uuid": "f167b3d3-def0-4fc8-945d-05fb81f2b0ef", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff5f6b1-b9e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762307136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307136, "uuid": "a9b463df-6eb4-410f-9822-521025645907", "comment": "Malware payload (Mirai)", "value": "02faefa00b470cd8e1c72cfc4de4a47a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307136, "uuid": "bd4c29e8-6f24-4d98-a1b4-25a473d1f2fa", "comment": "Malware payload (Mirai)", "value": "12b48a88042f87ecfd68f3ac7d808038899492c3ef877faab501e969bd6a886e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307136, "uuid": "d2e32031-d7e6-4659-982d-0cf8c1f67708", "comment": "Malware payload (Mirai)", "value": "7fd73dae1b0c2b2e27d74ee61d14f64bea1a2f51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307136, "uuid": "5aa5d57a-7f9d-4b1b-8f11-fd595f582137", "comment": "Malware payload (Mirai)", "value": "76129b9ad9593f82159b68d68f0fb9e4dcbc7d8835ce53b45f52a3b7e36dd3b644ead76d413b0fba00043a5cfe2d03ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307136, "uuid": "a6709bbc-659c-422f-b82c-9b4056a30846", "value": "T12CB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307136, "uuid": "35cec688-2d6a-47fc-a567-8bc060da2660", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1n/LWy:c9sSyzz36YaWWgg1nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762307136, "uuid": "00b2af74-90b9-4f15-b684-052555ef761b", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762307136, "uuid": "d3a98762-27fe-4ea0-b896-38a8bb1aa3c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307136, "uuid": "9b9b3972-e413-44f6-85ee-be1d7dc74579", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a364c40b-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316805, "uuid": "4ffbe8e3-4f7f-45a8-923d-1a12883d30fb", "comment": "Malware payload (Mirai)", "value": "76ab440a4a3e78e212bc8f1fd98d40e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316805, "uuid": "eebcdfe2-8adb-476b-a78f-91c373d10e7e", "comment": "Malware payload (Mirai)", "value": "12d2f59e9a9c766d20843393b05f7707144ff1f80ee1a8ad5d6675b153a29a1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316805, "uuid": "ba01d10c-ccf9-4fa1-9dae-c59570dfbae5", "comment": "Malware payload (Mirai)", "value": "448d9cd5025e22ce9e515a19d13b0442f5e7c4ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316805, "uuid": "8254be5f-c65b-40d8-8234-2e814f069e42", "comment": "Malware payload (Mirai)", "value": "68e43a4ae053a9d6b48e5c0c1bc98d8f2b330ca25fdcc6b42e3fabdf3fb562998defb3ef5397822f072350aaf6cc440f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316805, "uuid": "413f9cf2-24ff-4347-a6f5-8242d44ea14f", "value": "T1EE84E11AF20E2E42C9DBD936158BC1459756EC5733E383062F86A5BA3C283378F2D785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316805, "uuid": "37c8d294-989d-4c34-93b1-7cf36f0d4860", "value": "6144:yKgrlprzJbPZ9dLpLVTLi/6R1mjilm1yZTjBp0SZR024A48prZBW:yKgp7ZbLB8CeiFVP7R024H8prZBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316805, "uuid": "30849eb4-f7e4-4be2-98ab-92ad00aee473", "value": 391136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316805, "uuid": "7b1861e8-1eb3-4211-87cc-4836bb575dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316805, "uuid": "96fb8168-5007-4353-82c8-707e941083ed", "value": "miraint.armv7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b676236-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376760, "uuid": "9b541d96-edf1-44e0-9c7d-2064788d6c74", "comment": "Malware payload (Mirai)", "value": "32f8018b6550cd74af3d72b788be651c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376760, "uuid": "66c915a8-f58b-4894-87c3-43b7fab8aab7", "comment": "Malware payload (Mirai)", "value": "135741684aa7b1d8397d626591e23f0990ba5b2fcf121fa90ea6446cba8f7c9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376760, "uuid": "bbc16f16-d108-4d8a-b373-63fdb4c12b38", "comment": "Malware payload (Mirai)", "value": "924375692377a1354a60ce6ae52cff62a804fd7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376760, "uuid": "8f6f58ec-64ec-4265-b24a-a0ec455df7ae", "comment": "Malware payload (Mirai)", "value": "6a22b6cf760768368894405b708783eddcc3b30316283d0f0b114dbcbed7b4a1a91411e3706ab7b0e4a29279c5cb3b1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376760, "uuid": "46aeccbd-a558-40f9-aa46-f1929f25fce3", "value": "T1CE431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376760, "uuid": "30bb934e-a89c-43dd-948c-9ebb03543ae1", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376760, "uuid": "810674a7-e71a-4257-9d98-b6100b4f3eb0", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376760, "uuid": "a2573948-ef65-43b8-a1ce-a527af359306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376760, "uuid": "56ed2ad8-6810-4560-a854-4d5ae799b39e", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f8c530-ba57-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762354572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354572, "uuid": "c273ad41-67b7-4810-b0fa-9d2d5fcca91e", "comment": "Malware payload (XWorm)", "value": "05ceb11768255ef106e317fe93ecc522", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354572, "uuid": "a6a65b0d-3517-47d5-a4a1-bab29109dab9", "comment": "Malware payload (XWorm)", "value": "1393a105128cb3b877843861a80b0c628c3b692e3473fa73ff818d1f47aaa7e6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354572, "uuid": "fe369f38-afa8-4aa5-8f20-b9a5b4dcef19", "comment": "Malware payload (XWorm)", "value": "e7afe670b7753bd96ae89ec3d3319428fc2ef7ec", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354572, "uuid": "d4a8a9a3-b5b0-4cb4-8106-4742f9c00fd5", "comment": "Malware payload (XWorm)", "value": "e2aec9eee8319910e3c3fa3bb268ec8c4d3a0a0d24478a7797876d469267f50de972ac9c09f07c3a651fb992f71d719f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354572, "uuid": "8f48d66e-c0ca-4b6a-b7a5-55fd2c1622b8", "value": "T181F3E8B03D0194883FB5A04EF7D9D69F97D7E90A376122DE4222CC5F166358A8BDE834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354572, "uuid": "3a2e08ab-08df-45f1-9161-1d7a8eae9112", "value": "1536:pCLc9L+N9Lfeuf2DV/glkW3PDl+RFInK+lLG3i2bHr9iry:pCLcF+N9Lfeuf2DVIR/Dl+RFiKaOv9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354572, "uuid": "18aec5da-4772-4ae4-99bd-75a5ef9bed27", "value": 169576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354572, "uuid": "765ae229-856d-4192-a30d-65b975ee752b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354572, "uuid": "91fa88e2-082a-4bec-b787-4948b3c10ee8", "value": "awb_DHL_original_shipping_documents_nov_2025_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d60b677-ba2f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762337304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337304, "uuid": "7e42fe6a-7989-4685-a9ee-3b3e53e86681", "comment": "Malware payload (Formbook)", "value": "4be1ae298b7174f13c9ef8dce3b7d800", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337304, "uuid": "b4457963-89a6-4c89-874c-e68d1df096d3", "comment": "Malware payload (Formbook)", "value": "13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337304, "uuid": "49e48f4e-3aff-467e-ae5b-29ce58d4bfd6", "comment": "Malware payload (Formbook)", "value": "1eabc2abf54e6905480d7abd9c5b7314259293fb", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337304, "uuid": "87bbcce4-9198-441e-a2c5-f792f7dc52be", "comment": "Malware payload (Formbook)", "value": "ee79e5bf78ea965895329e3bba5cd7a206c11dfbc499dc6b07a0cb6b1bfeb3f306646adcaac2ae427d325335269d4a58", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337304, "uuid": "aeb10469-2df5-467b-b5b7-de12978b63c2", "value": "T18FD65B6B76618568C35DC13BC0A38F05E83371B91733C6E783A402686F5A9F45EBE678", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337304, "uuid": "2a7a9d77-b4bc-4cb0-a1c4-c701825b30b2", "value": "de6273c02bd4519d211a58c54c890cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337304, "uuid": "a708c565-1ca9-4345-9c59-9016d878e4a2", "value": "98304:3RkyhrOHMsfh0V28cni6KsjtO0QVgIX0y4GvwSTe19FMyZ8dQI:3nhr/spCTcxteuddGvwSTex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337304, "uuid": "624d8e2e-93eb-4560-b88e-166452f989ae", "value": 13041664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337304, "uuid": "15be2a43-b280-497b-bd86-886c24a5d2c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337304, "uuid": "051b2639-e3ab-48f1-b3b7-269082a163d7", "value": "13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65362ae3-ba57-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762354497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354497, "uuid": "c6dfddbe-6621-4a3d-992a-3806d782eae4", "comment": "Malware payload", "value": "3d58b00bfca5378465f4072f4bfbf903", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354497, "uuid": "f2afb6a2-a752-499a-9a3c-fe904d612490", "comment": "Malware payload", "value": "13cf33c93827a2214877580204b342aa03a2425f1190f9b8451096ecdf791eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354497, "uuid": "82a0b77b-4357-4652-8a0e-6805bcb2bf12", "comment": "Malware payload", "value": "54fa8f896f6ef18da61b652badcf9e7e69246b86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354497, "uuid": "6facb06c-dca7-404c-9a9b-72f9c7b6f71d", "comment": "Malware payload", "value": "c519d5c6efa5769ef9a22298c397febc521a7bd3823b041ec98faf28dec64b0a555e85871e8642c724d7daabcf2a85ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354497, "uuid": "255e99f3-b0a2-404a-bde5-255da687157a", "value": "T144069C15E3DA01B6D42BDA78C6599333DAB07C925735C14F0A98FA0A1F33B909B2F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354497, "uuid": "d3d908fc-5347-4ebf-851a-8ae2bda9acc3", "value": "7b407282ef55036d842693b1714d0a5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354497, "uuid": "8f1f956a-225a-44ef-8be2-2b5124c34e87", "value": "49152:DUfc6rp8GjxvBfApGtVx97HCXA+KFJF+ycBL/nqMoafVK9l3:YrHApcCds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354497, "uuid": "b0bbe5b5-8be6-4eb8-8752-5547c72e15ef", "value": 3727360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354497, "uuid": "e85c3f21-6da6-4f46-9e5b-77a22e7f9ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354497, "uuid": "6f3ee705-43cb-48c7-93ce-48b859a7c6dc", "value": "jli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6e0abc-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316929, "uuid": "b935046b-c20f-4954-80d3-485d11c299ce", "comment": "Malware payload (Mirai)", "value": "3d04b78ec7a5664f7fe890ec1cbdcb57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316929, "uuid": "4bb6756e-14c6-4fcf-a81e-e938318719b9", "comment": "Malware payload (Mirai)", "value": "14241b8675cb4eb7bfe4412ca5a1d0472e78e0a5643d45804c4c355655cf9a5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316929, "uuid": "2b623ec2-bb17-450a-a140-e5fd5a93c8bf", "comment": "Malware payload (Mirai)", "value": "065a8b3833aabf4cd3abd10dc9c677555e59115d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316929, "uuid": "6e85504d-868e-4ebf-aeb8-8f04c4f7c920", "comment": "Malware payload (Mirai)", "value": "1dfb4ebe6c25f2ca6749fbad360e6c5d8291cf627f325d0263b92569055f74c8e67baaf3f711d3a44bbd8bf8a87ea353", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316929, "uuid": "6369d420-829b-4e37-9b25-a1bb6dd8e199", "value": "T1AB630846B8918B16C5D513BAFA2E118D331353B8D2DF7222DE146F2077CA92F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316929, "uuid": "0af9ba27-2cb5-4f69-b7ed-3b53fdfcb4e7", "value": "1536:m5n8z5bNz9vLXmKSgJ4VmHAiczK7F+lVJINBD/SrUvmnirQL0I6iCgaWZWe:ZbhpzmKTKmhczKSVCNBD/aSmmgaWZWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316929, "uuid": "58707423-d427-400f-9bbb-c066ef456969", "value": 70932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316929, "uuid": "68021932-1fd9-4da8-bebf-0ff807cf67d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316929, "uuid": "85158489-c271-4eee-9ff9-3592f66a9903", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c693bb-ba5b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762356452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356452, "uuid": "3f04a734-a468-4f4f-8a97-9df4b917a7ba", "comment": "Malware payload (Formbook)", "value": "7e5f81d927dfdffea9d567e023ea1140", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356452, "uuid": "4dea82ad-4a98-4a7e-b4d5-d43db6d97018", "comment": "Malware payload (Formbook)", "value": "1434ffad05e041b6b8fb3db75b0d2eb1772c6000d7265415eab71016eb463070", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356452, "uuid": "9da4bda0-8834-4932-bce3-8e1864381c5c", "comment": "Malware payload (Formbook)", "value": "6debf15d070b674dd7a6e55c6597faa71ae2b71f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356452, "uuid": "311bda5e-3796-47ff-98f9-73db6cf4a9bc", "comment": "Malware payload (Formbook)", "value": "115940547b50ad7c66b66261905991d76f76a4c698538eb688456d6aaba396b4cc72cbcf667bf3eed032c383d5354bfe", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356452, "uuid": "dd932eec-36f1-4bbe-a312-a20c8dfec028", "value": "T164E4230637470335308A36AB53EAE8D07D47574AB375A0E8D828B3765BF876E5A4CCB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356452, "uuid": "5f241343-66ef-480f-96b1-d6a0a4554d8c", "value": "12288:oelqAJMMdAoZDyX7hjfYj5U9zwtvojIshnciaciSYucPI8rm+60V9AhQFI:onAJMMhFuatU52ofhnNBYtr9rAhuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762356452, "uuid": "27d678ac-ab5b-42d2-beb9-9c29118d0376", "value": 696816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762356452, "uuid": "17c6aeb6-3f16-4eda-a068-c1e0e48649df", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356452, "uuid": "ce20c18a-361d-47be-a0c1-653c4c3d9f4b", "value": "Payment Swift Bildirimi.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5c344e-ba49-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1762348412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348412, "uuid": "b1a74836-2b7e-4ce8-93da-202f22b9a588", "comment": "Malware payload (DarkVisionRAT)", "value": "18b75a2af7686cdbae35e19df7402efa", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348412, "uuid": "67926acd-097f-4278-b12a-be3dee2794e7", "comment": "Malware payload (DarkVisionRAT)", "value": "14c05cdb96927e00ce8b6c226de36aeca6a4f4fa7c7239b27072d49e054f257a", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348412, "uuid": "0c562d39-5d1e-4573-a3ad-1537e9485703", "comment": "Malware payload (DarkVisionRAT)", "value": "fc2dfe2265e5269c6f463db0028b1243b63b68e8", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348412, "uuid": "50b7df05-92ac-4356-85d6-08f27c30bbaf", "comment": "Malware payload (DarkVisionRAT)", "value": "3f2b8f3d6fb7d2365856e87261b9797641486a15519d6aa145200fe9e69590588d44512fa37d1d4ae65bd2ba73479115", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348412, "uuid": "cb60ebac-2f14-4de2-953a-49c358e25ccd", "value": "T15295233A032B8CFBD059C37A8EE2547D7CA97ABF9C614C7B36958A040F115911E9F24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348412, "uuid": "ca043851-4da6-42e4-a0e2-33ea943f07e8", "value": "679877ea45ff38e48e48875d525bcbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348412, "uuid": "c4f0b622-2ee4-4946-a8c8-46e90adb71e3", "value": "24576:rAE91tVP2CjdbwAa7jVejzXXbgtFGrMzObRqzj+8knSa0vimR1Wka47zWKA7rOr1:UwP2Chb9iVyjX4ygj+8kSaiimR/sKKaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348412, "uuid": "617c3734-f50b-4899-a3ce-f8fd24720e8b", "value": 1917440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348412, "uuid": "d04b9ccb-b632-4bbc-a493-890f10b19388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348412, "uuid": "22d83396-077c-4579-a148-311fc9ebbbfa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02526c8d-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319542, "uuid": "eecd1c60-6ee9-4107-8532-71ce24c8c478", "comment": "Malware payload (Mirai)", "value": "7accfde1bc52ce405046d71873ada173", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319542, "uuid": "111f7d05-1f22-42db-8693-d5bafc18c896", "comment": "Malware payload (Mirai)", "value": "15598cecd0d6be2d9b5cd9812b55d409d80d080f51007d779f7e890dea5c2c8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319542, "uuid": "0cd84eac-49bb-4a7f-9cac-62990fe9331f", "comment": "Malware payload (Mirai)", "value": "ede1a4fd769f0dcfa11b0584570e34506196fa3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319542, "uuid": "65c54e19-5df7-4afe-8cca-996abf1a22c5", "comment": "Malware payload (Mirai)", "value": "78ab7ed0dde6b846b54d88f3e68c507707c503d22c3d5f2db26868f9035f65ef0bb7742e66de99746a5bff25e9779d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319542, "uuid": "039e1b32-d227-4feb-a74a-869eb18911df", "value": "T10C630227B4A7FC33D4785739F9AAC4482ECD27A888EA6CA310C42548ABD54153C4D9EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319542, "uuid": "fc28478f-1155-4cce-9ef7-a789a33fddbd", "value": "1536:29D2hPRzTKH1lB1YtK/hiQC+t6zpwgL/BKxEZk2W3FZuk:2t2h5zc1lB1Yt8H6ygL/sck2Wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319542, "uuid": "95ac8b19-7043-4686-9d63-569ab119dae0", "value": 66976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319542, "uuid": "93916a4b-e13c-4484-9782-5f743a6f7224", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319542, "uuid": "38dd02e4-3e3a-4136-9ba6-6605982ae54d", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b835a38b-ba36-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762340463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340463, "uuid": "cf068559-7448-4975-b024-cd001bc0ee2e", "comment": "Malware payload", "value": "1abf1fe2f45227ea9a81829ec1701006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340463, "uuid": "a195880a-f045-47c1-8d75-b3839d181777", "comment": "Malware payload", "value": "15ab5c5224fb54df7c260ba433ce9302ec1862040f3d3ffd499ce8a21c4cdca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340463, "uuid": "79418896-ba8b-47c4-90a5-63874842d387", "comment": "Malware payload", "value": "39e30109e76585c20f669334997f041d126dff53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340463, "uuid": "c823fa3a-ab6c-4d86-8dfd-595193b573cc", "comment": "Malware payload", "value": "ee7cbac779bd79ff8b96d69d003070eda0732bf00832242347b9291b4a53fe811d84b36bcb4b9114659a7e20c45386e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762340463, "uuid": "8847aa45-6db8-48df-97ab-12e58c65ddab", "value": "T14D047C01B881C072D07319394875CAB15E3CBDB41F759ADB2798063AAFB41D06B3AEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762340463, "uuid": "a03bc1d9-ab74-4b50-8fb6-8d7691f76c06", "value": "adf84226aa47b7f9ea411fc02bcd6232", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762340463, "uuid": "50dda81b-bc5e-4b4f-8e11-6a244868ecf6", "value": "3072:9c5YN2pjvc4ixn3GjHwyyVICHoBAI74/XVvbSI:AYN2pwaQxVIkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762340463, "uuid": "1958eb61-3f31-49c5-834b-787b3d528ab5", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762340463, "uuid": "21cec8ed-3492-45ec-8463-0c55f684cf28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762340463, "uuid": "994f734d-58bf-412a-91fa-b504855f0626", "value": "15ab5c5224fb54df7c260ba433ce9302ec1862040f3d3ffd499ce8a21c4cdca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea77783-ba64-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762360284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360284, "uuid": "fe5cb132-da2d-4758-8cd9-e3078ec6e6af", "comment": "Malware payload (RemcosRAT)", "value": "102edc9c15f3f95794106525cfc54a25", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360284, "uuid": "d469717d-1610-4bdc-9858-fec19c2f6f7f", "comment": "Malware payload (RemcosRAT)", "value": "15d06f0f7b6bf7f36fd512d786647ec502f7f3e5b839bf7dc7eff86459780d26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360284, "uuid": "e9e22cb2-4af4-4afa-9a96-057d465cbc5d", "comment": "Malware payload (RemcosRAT)", "value": "b3e7f8f581dbf8cce252687ade0237cc35b688b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360284, "uuid": "8b166d13-a12d-4dce-a8c6-1670dbacccfb", "comment": "Malware payload (RemcosRAT)", "value": "9486d530be130f71af7264a5bae1c3e4d07d651271781305e5a72759d994ed1e7a9bf2f1af0e2804261be44e469fd6f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360284, "uuid": "5b989dff-cbfd-4eb4-9070-02006b8cff5f", "value": "T152D65B6B1D9177EA33A01EAA53AF8342D8356D13D85202CE0F6D27966FBD7C33A9011D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360284, "uuid": "f9b49544-f8f9-4ad6-b146-dc3436bad06d", "value": "1536:f2gvdgz7eIU4OduSVQUz2YjIizu7NLCm5Vgc:ugvdqLUxuSVQ2zjIizu7Nbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360284, "uuid": "bea4050d-02c9-4545-b675-c79705fa8c5f", "value": 13865027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360284, "uuid": "b6a79d51-729d-4086-9d69-05525db49e7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360284, "uuid": "67d765d2-d8c7-4768-9a3e-96da5add68c5", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72c48d6-ba20-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1762331092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331092, "uuid": "af3fb2cc-51aa-4488-a6b1-65e9d5bc2a7b", "comment": "Malware payload (NetSupport)", "value": "518f7298621ced63950771ee79457f08", "object_relation": "md5", "Tag": [ { "name": "88-214-27-75", "colour": "#4BE4ED", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331092, "uuid": "f5d59e6b-bc70-44c3-876a-68f6f3a3ca17", "comment": "Malware payload (NetSupport)", "value": "1639f639e83b6f645f2ad19f0fb7302639beea002c83355f47b6ab6d7ca9f28a", "object_relation": "sha256", "Tag": [ { "name": "88-214-27-75", "colour": "#4BE4ED", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331092, "uuid": "297d1c0d-f644-47aa-be35-52c74889c335", "comment": "Malware payload (NetSupport)", "value": "d5cac6878da437b4113aaf8b37ffafe91e3e29e2", "object_relation": "sha1", "Tag": [ { "name": "88-214-27-75", "colour": "#4BE4ED", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331092, "uuid": "cb1fde70-1803-4b5b-9305-7b755e7a598e", "comment": "Malware payload (NetSupport)", "value": "ba50832c67c26dd8048e9b00ed0d272761c1b608e3fea4bc1f63a62de775f6a5fd16164e653844b8b1ee8bbd37a86531", "object_relation": "sha3-384", "Tag": [ { "name": "88-214-27-75", "colour": "#4BE4ED", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331092, "uuid": "e9701a12-3f4e-4900-997b-80dd9f860d81", "value": "T14BA2E0310F2BA738E27EC77CC4CA017EB58D9147805F12B96A95E04EBB4FB7229D6900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331092, "uuid": "4376a3fe-6a74-474c-a773-0510c9fbac87", "value": "384:DSTjBhQ3a+/tDX36ngNdMxtGm/tQerMm1Xw3tgGf4exVa+Ao6U8I:DSTjBhQK+nIJxtGm/tCmtwdgGfzja+Aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331092, "uuid": "124b83c6-798d-4a5e-82b1-15a19ef5bb1a", "value": 21681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331092, "uuid": "02926d11-e95c-496a-acc7-e91b0a363313", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331092, "uuid": "7d4676de-506c-4d4c-acd1-baa265926e22", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee730bd7-ba59-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762355586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355586, "uuid": "164fbd39-d97d-457e-b31a-7cbc9a5645a9", "comment": "Malware payload", "value": "fece4ca03be810b63c76a9b671ee85c8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355586, "uuid": "8b5ec0c9-d52c-4c11-bd15-9dd07cdd67db", "comment": "Malware payload", "value": "174b6374e2a27527b372819843eaf5841689aba8ed7b676ccd7f24b18d720a04", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355586, "uuid": "7a5d63e3-f783-4739-924e-fe62bbe4d2f2", "comment": "Malware payload", "value": "09d4d0c440e13da21080f865bc5ab5c2c4d886c0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355586, "uuid": "8d67b11b-ccb5-493b-8b63-96950ec13e96", "comment": "Malware payload", "value": "53aa65d3cd0a98ed413fc612ac0a7c5b523ce11039c8114c1773af095d7923b72b404620fd7c63b16cecb08709aa0055", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762355586, "uuid": "3c81df2c-a77b-456b-8ca4-3623faf623a9", "value": "T1D8D528CA789090E6C4BAB231B975818436607E444F2137D7EB0CFEB61A327F51AF535A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762355586, "uuid": "f2b9c138-8a88-487f-b7c0-1266013e0d10", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762355586, "uuid": "3766f29a-47fc-4cf5-b81e-53ae850268cc", "value": "49152:h0xBH1et14kSf/vXup2aMZvwHMlvN7QgLBKZujCnD1GD:oTvXVvvFZ1c2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762355586, "uuid": "aa4e5b18-28a8-4bf9-9bb7-03703891279b", "value": 2776392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762355586, "uuid": "a5c8e2d9-b0ab-4180-bdff-3ae2972fde4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762355586, "uuid": "369643d6-c7cd-4edc-ac43-6bf4a5830dbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fb361d-ba85-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762374386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374386, "uuid": "b09fe089-dbcd-40fb-95d3-49ed1bf590e2", "comment": "Malware payload (Mirai)", "value": "30d6da2de71f6e13d77860dc4ea4244e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374386, "uuid": "37af3030-f9a5-4b2c-8bde-ce482cd44bcd", "comment": "Malware payload (Mirai)", "value": "17717a44a84d81b1e942fa2b703f077f0daf044c7a30af357644e9f5d57dbcfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374386, "uuid": "df17b14b-31fc-42e0-80ff-15ceacab1e36", "comment": "Malware payload (Mirai)", "value": "0727f0d6297c392578f8ade3c49863331537b0f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374386, "uuid": "330805ed-0e26-46f1-8021-ac3a6622bdc7", "comment": "Malware payload (Mirai)", "value": "3d6a94d747e3521fe4145cbde53555b82bce23103147cf0513a1a2b03eeddec99326d459240044542243d49b06151d8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762374386, "uuid": "7b2b2c51-5e4d-4913-9378-bb6095b75f0b", "value": "T10E256E5AF2B370FCC167C030436FDB62A835F46911216E7B25C4EA752D62DB01B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762374386, "uuid": "57355ef0-4d0e-4b0a-8d67-2d0778566699", "value": "24576:mWIN0NM50h8pZxnrNF64MkpqZfr8q2SJmTS:mpWgPnrf6TkpqZD8q2SJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762374386, "uuid": "2a9c245a-0513-42cb-9ce1-2417b6a068ba", "value": 1000512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762374386, "uuid": "a0cfe222-f57a-4897-a6ea-abaad0d1fa8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762374386, "uuid": "a9b3842f-1046-4cf4-bac7-fce351494682", "value": "Mddos.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb93d9e-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376900, "uuid": "463f7e09-0086-4497-8157-4311558097b8", "comment": "Malware payload (Mirai)", "value": "d926d87c98222f0ba5cb949e6cb43d9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376900, "uuid": "44e805b7-8f3c-4edd-8137-21cf2553d4c5", "comment": "Malware payload (Mirai)", "value": "17d182031c2714adae1e04100a41e1e91e0c6fff6122713ab4a052f5242397fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376900, "uuid": "d05816bc-81e0-4b38-81f0-aa6ce60f7091", "comment": "Malware payload (Mirai)", "value": "0bc3e56369307af47f8fdb384e278b9f1fda48bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376900, "uuid": "262f217f-fd38-46b5-982b-7aa0ead82ab3", "comment": "Malware payload (Mirai)", "value": "6a4b12e04e7e47d87b611f4e8dda11b1e790afa6645eb9cadb042dcb109c7975a8cf7ad5fcc68d3965a8e622e544e91d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376900, "uuid": "308c8e77-a723-4be0-8426-3850aa3a0909", "value": "T185630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376900, "uuid": "61929e9a-cdf5-45a9-a2f3-62d29a44a371", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376900, "uuid": "8d4f03b1-6fc3-41b7-b183-0bd57aa68138", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376900, "uuid": "198a3027-76cc-4bf8-9352-6aad4ef9925f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376900, "uuid": "2a97567e-236c-40e0-9c3c-8a91c6da422d", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b429a14-ba96-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381485, "uuid": "82d352e4-033b-41aa-9049-7f5bf997253d", "comment": "Malware payload", "value": "7e012bd0dbf4f9a24cd1d8e8a92a9935", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381485, "uuid": "a95c94f5-4bad-42a8-aeb3-7136956763a2", "comment": "Malware payload", "value": "1856d7650f29c9500fce4b030a049805fecded75591e1404aa561786e7e2f377", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381485, "uuid": "191af77c-c126-456b-ad04-a6fc480b8dd2", "comment": "Malware payload", "value": "2d1f30656d47e166000227afa6dd8e0bd107bbd9", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381485, "uuid": "3979cf8d-8d75-4b17-a9b1-445f20cbf4c0", "comment": "Malware payload", "value": "d7b6bb32ea7b2aa2d8920b1c03c9a4001a5081427f04b4baf452b711fb98e2f8602591e0540fbf29ed1abc6107b03475", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381485, "uuid": "724ad964-638b-4962-92af-3d63533cdbda", "value": "T11E5412B876C6AD5384CB4938976AFEDCA484E4ACF047DF98F044D828193C6C72797399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381485, "uuid": "2487f937-49b0-4b38-872c-9a2511f6b038", "value": "6144:X2PuBCG0X3AOJGPq2PuBCG0X3AOJGPq2PuBCG0X3AOJGPe:X2+sPYPq2+sPYPq2+sPYPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381485, "uuid": "c673a6ac-4c79-4a03-bd64-4507eaa3c2c9", "value": 293778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381485, "uuid": "d2c3dc27-70c8-4714-9d36-0481819dcfaa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381485, "uuid": "d7e3af3d-752d-4fff-b30a-c34475acc8d9", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bbd570-ba58-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762354897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354897, "uuid": "62cf90aa-aeed-4a8b-889a-691adcf3120e", "comment": "Malware payload", "value": "65dc5164fd82e2068a33920f309da699", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354897, "uuid": "c082b487-073c-4fb1-b470-4b958eaed587", "comment": "Malware payload", "value": "19a7728c4b4ed2fc51e0a46da623a78c2389f4350407f29658c384475a8bcb46", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354897, "uuid": "c4456544-d3e1-443b-82df-9aefb7a62c10", "comment": "Malware payload", "value": "c93399508f9b11331725d44b3eb016e38ac5125f", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354897, "uuid": "84d31171-9a15-4488-8ea8-94cb5515eb26", "comment": "Malware payload", "value": "bf134803a1d4cd41f486b86f3befea2f6d9d34c87ffa1b404e94ca45aea363c8d9d1a8053abc222075d660fce9caf37d", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354897, "uuid": "569887d3-8353-47ab-b7de-c63350163018", "value": "T1ADD4227B0AE63CBDD09C92FB6263B53034296DAACE783104950733DE9D8459E016A5FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354897, "uuid": "d0b70ae4-dfe9-438e-b1b2-db8a77fa21b3", "value": "12288:WuHgnDhA4F9WKLo4nXgEltEmbvSMUDZI4qeh0BgeOsYk+M//xNHzfdpqC:W2gdrFt1nXbD6MUDZIq0Oetcc/jzfdpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354897, "uuid": "cf97d576-5115-4cae-a08a-b95323817b15", "value": 653510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354897, "uuid": "27a2b5d7-6594-4feb-8059-dd706a8bd074", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354897, "uuid": "d23b0815-f3e7-429a-a5a9-8e084e950fa7", "value": "New order.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee46b4c2-ba65-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762360740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360740, "uuid": "bfd4d901-4137-4094-a784-381b1d9b6e59", "comment": "Malware payload", "value": "2ca6f4de79751c38631a6d4fe82ac3ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360740, "uuid": "37899dde-7232-4961-be7b-6bdf6928c842", "comment": "Malware payload", "value": "1a467f79830c1d466b0fac84a7d6c2fc7f26026675c2d0dcd270b902ec5ffc1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360740, "uuid": "4633eec1-46cf-449a-8265-061bbeb54de2", "comment": "Malware payload", "value": "d5d4f151da33ff7bf28405668cb01d18ad52e3df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360740, "uuid": "2c7d6d9b-6a7a-4ff0-9209-e2cd99775a89", "comment": "Malware payload", "value": "da1fd47a983cd5203fcafaa037360bb7aec7fed2454662797646033957e6ce2f1cb880f0d849508b37c9cc7a0951dedb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360740, "uuid": "6b7f025d-6f06-45cb-bde7-ea1b8ee5f7c3", "value": "T175760223B24E273EE46A563549369970553FAE60E41ACFA396E03E4CCE3D3501D7EE06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360740, "uuid": "60a8965c-db5c-4cad-85bc-ba0c8f080345", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360740, "uuid": "f5bd579e-5e09-4108-858c-23410f628f29", "value": "98304:SDbhE5C6XVrhKGvHLZaVeBB42JicRN8SxY9Vnl5zeY:SDbhIlXVrh5HdaAB3Gba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360740, "uuid": "4f81d516-944d-4e80-8336-1b0865faddfd", "value": 7823113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360740, "uuid": "1ad9aff9-964a-4a45-809c-8698d1d262c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360740, "uuid": "1f2bed4e-fdb1-4568-ada9-792ca6678bc5", "value": "2ca6f4de79751c38631a6d4fe82ac3ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6477354-ba4c-11f0-91c6-42010a9c0006", "comment": "Malware payload (TrickBot)", "timestamp": 1762349908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349908, "uuid": "055c30b4-c117-40eb-81e9-b5af17cfd2dc", "comment": "Malware payload (TrickBot)", "value": "083611a154aa1fee6388ccf2651dc973", "object_relation": "md5", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349908, "uuid": "f21bb544-9b60-466a-943e-7185babd76b0", "comment": "Malware payload (TrickBot)", "value": "1a71a8bc099c9ab4d4c65431aa2190690ee0be76536c430e1acaf79254b4a455", "object_relation": "sha256", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349908, "uuid": "14ba9864-4596-4b36-a008-4fc69f14b5d5", "comment": "Malware payload (TrickBot)", "value": "515aba2bb7a212b81e68ace2dc0fa94e86f89d3f", "object_relation": "sha1", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349908, "uuid": "1711118e-e93d-42b3-ad4f-6c891ba13872", "comment": "Malware payload (TrickBot)", "value": "8cd99187d9d45f71763c62b3ace1560853bd615a3aa9110b429301b1ad05aa718fd2bbc47913c60dd202af9362cc79aa", "object_relation": "sha3-384", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349908, "uuid": "6921c558-36e8-4b71-9a84-70b93678a451", "value": "T1336423680E0565C3E34F7BB2419464CDD668A613741C36533B7EAE7488AD9FF7183274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349908, "uuid": "127b9fe4-8596-42e9-b9cf-e1714665b19d", "value": "6144:ZdEDrZC5CLJQ483WULQIoKK6o51NO2bn9rXYksm2Y73LIH9W0O:XEsUJlC0n6o51QaYS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349908, "uuid": "2649c786-d8e3-4a9e-9724-727ca8b91d83", "value": 329191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349908, "uuid": "70c5def5-e993-406c-9049-1882ffe719e8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349908, "uuid": "88a3a7b5-d0b4-418f-a3c3-d5648de9eca3", "value": "1a71a8bc099c9ab4d4c65431aa2190690ee0be76536c430e1acaf79254b4a455.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c89e00e-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376870, "uuid": "5a1141fe-f257-407f-989b-89bd59e40db2", "comment": "Malware payload (Mirai)", "value": "a183512e924e28f443707a62ccda04be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376870, "uuid": "619bb18f-7165-4625-8cb7-ac28ea5fff01", "comment": "Malware payload (Mirai)", "value": "1abec07590a50dfc57f206eb339ffd27194fb291471929f1b1eecdabb0c5bd95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376870, "uuid": "fb48476d-574c-4a3c-af7a-a8d98d6eacb3", "comment": "Malware payload (Mirai)", "value": "2b7002c4db46cc673cc63ed92c14aab151707655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376870, "uuid": "bced78fa-89c5-418a-b260-02eabbe9768c", "comment": "Malware payload (Mirai)", "value": "551ed2940bde3f2767395b1a4492f88e3efe962d49abc62b54978b95798e7945102adb6fd5b0595e675d0636b6fa383d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376870, "uuid": "415c19f8-de90-4d91-a4eb-e11cd34a38e0", "value": "T18EC2D1E07726FD31C4206C3DE52A4D8A3A91067C91FF393664258D398EC169B67B88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376870, "uuid": "215c9c22-c179-42d4-9ef8-6a449f9fe832", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrRc99q3UELup6:OKy4qfqoeJdXWgRcQLO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376870, "uuid": "51b02195-6d43-426d-bbb0-e4890a7be305", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376870, "uuid": "c31f1002-f03b-4890-9c7d-ff2485e6bc86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376870, "uuid": "59cb4570-036b-4e60-bd75-ad36f3bc7536", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1bfcc8-ba91-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762379260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379260, "uuid": "844d3868-d036-4ac7-bab3-7e8009f023f0", "comment": "Malware payload (Mirai)", "value": "efbe7dae81bb8f790a5b53122ee29b0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379260, "uuid": "85048487-28e7-4223-bb07-44bd52ad5d2d", "comment": "Malware payload (Mirai)", "value": "1b5877ea179306d2bc577bdda8547ad9478f4f30b67d6f60c6e011058b33843a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379260, "uuid": "e36e72e4-fa4a-4c9d-82f4-77ed5b224e9e", "comment": "Malware payload (Mirai)", "value": "7673a9452126ca52cc2e7ce5eccde5165f895fd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379260, "uuid": "c2e58d19-430b-4e56-9f5f-57fb40a3cb47", "comment": "Malware payload (Mirai)", "value": "3f5e892772507568b2ecf58bd097454aeb4751b11ff519b25bf37a3a9092bc63c1080ffd7be71cb959bb5f8b8a9e2af6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379260, "uuid": "bfd4dd81-b54c-459a-94dc-058d45936221", "value": "T11AA2C031224D9C21E3B04875EB3E8247A18106F4C6FD632B1AD7467EEB9128A757B74E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379260, "uuid": "b3890030-1243-4eeb-ae8a-33fc89033229", "value": "384:jYYQDd4RVtYX5fzsM+vt48Igm9e7obFvFpuu6IAS+SHlzDEY8chymdGUop5hOS:hQEVtyQM+vt48Ir9e7oJFpuu6IA1SHhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762379260, "uuid": "6abed391-d8eb-4a71-8ff9-a739f93f223a", "value": 23364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762379260, "uuid": "b5d6982e-64fa-425f-a81f-9eed1de7d00e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379260, "uuid": "f2c48f33-d9f6-4714-99fd-1b94fc92d5cb", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84577dc4-ba48-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762348106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348106, "uuid": "d6eb371b-9ad4-4fad-a93b-e93d2e6f179c", "comment": "Malware payload (DonutLoader)", "value": "25b87c17b984ef501a55af8f6fcdd849", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348106, "uuid": "ca4ebeaf-e290-4b84-9ddd-cb591040d948", "comment": "Malware payload (DonutLoader)", "value": "1b9030762d34332b4a447844fed804e1136646ced009b27f5d99652f60df1d0b", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348106, "uuid": "6f9b8e1e-3ab1-4cad-be49-b7c442007a6e", "comment": "Malware payload (DonutLoader)", "value": "82a58c979a7247b2c4645bd0c181e4aaa8e30b90", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348106, "uuid": "740d18ca-ecc4-4708-8402-7627cf4685fb", "comment": "Malware payload (DonutLoader)", "value": "19cedffe9c8ddb6ce97e41f2573d28915b6bf4259eb0269c3af12e9aeaaa4638d308ff0f59a344c49d60f4fd8be5e80a", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348106, "uuid": "50e3a5e1-9fc4-4214-b72d-ce15cb8577d7", "value": "T1B486D50027E0249E53E7AEB1EB2E61D0FC0E2D1B39C64C4BB125BDA6757E51AF660D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348106, "uuid": "348d1198-6688-4fc4-8e57-e3279d5791d7", "value": "196608:pdfhaETiHQL/1OdoP2tiwCXeUg6dcVwCcSUvtR0d:pdfZwmeuYOmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348106, "uuid": "ad33c725-0485-41a5-ad69-61df3fb2aa86", "value": 8136298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348106, "uuid": "af020138-a1d7-410a-a992-b820ab25d5b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348106, "uuid": "5304dc05-d9e2-4143-ba2a-b10fab9bbf3f", "value": "BANCARIO-BONIFICO-93883837373773737373737737325612-pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa42a937-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316817, "uuid": "bb59e3a8-379c-42b8-9559-37f1b3d9ff1f", "comment": "Malware payload (Mirai)", "value": "e3fefc4ea06fa7c78993ce2351adc428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316817, "uuid": "ac544c6b-ac6b-4092-8f71-8b72d89ff35b", "comment": "Malware payload (Mirai)", "value": "1b90d928f67a8a2f849f39b408507282034c5911b5a8afd693248e7ce6dc1552", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316817, "uuid": "8007c6eb-1223-4f5a-b2e8-405f3fd97002", "comment": "Malware payload (Mirai)", "value": "6575a4f308183431b6c305d7cf1953ac6c726d24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316817, "uuid": "fe449373-1f01-4198-aa78-8f1c88d9d773", "comment": "Malware payload (Mirai)", "value": "362e2193a68beed9d6ffdea898591bed197e25913b3a5b56f41a9f2c4996721b379cf2377feda62dec5b9d6b0e6a54a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316817, "uuid": "0822b86d-37b3-479c-af09-f71fd8d5572a", "value": "T1F1238EA7C43CBDD4D14982B8B9244A3C5B23E016A6933EF5B64785638047EDCF6193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316817, "uuid": "2afd02fd-51e7-4415-bb9e-3c0d7319950e", "value": "768:baV/jptstaT85n1Ocwtgp4k1LqprKCfLGAQdqx5n2nBrcIC+oCZ21CuFE:baV/3s+YzwtgFGKru52BXCG21Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316817, "uuid": "d55b06a4-1670-49d1-a80d-27912557b932", "value": 47560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316817, "uuid": "26a401bd-437d-4287-af2c-d218dff88a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316817, "uuid": "f872897b-449a-4c5a-93c2-f1361a62ad38", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1817dd86-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762335899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335899, "uuid": "497bc8ac-c9a6-4249-a1ec-cfba14bb53b8", "comment": "Malware payload (CastleLoader)", "value": "2e5e97bd2d075d8e42c2d95c421c3213", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335899, "uuid": "24d77b35-8a76-4d4c-8bb8-ab064a65f16b", "comment": "Malware payload (CastleLoader)", "value": "1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335899, "uuid": "dabb9f6e-6fae-4dfc-b2b0-54a5fc1a7b9a", "comment": "Malware payload (CastleLoader)", "value": "8f50be4682f83f201551b668d8aa18410fdb9ade", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335899, "uuid": "6d60c887-9d27-4f35-88ef-1ebc79ad1aac", "comment": "Malware payload (CastleLoader)", "value": "ee6af3f5831f5903838afc3cc42b57597c6db70be19897ed2a25cad547c6132bc424641eab7f5fe86de7bec970790ef1", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335899, "uuid": "7f4e306b-8b75-45ec-b0dc-ae5febb48924", "value": "T1A207333BF364A03ED4AA0B3244B396604937BE255A0A4C9F07EC394DDF765611E3BA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335899, "uuid": "865b8932-e2a0-4b57-bf69-cf4042683698", "value": "ddcedd78f40b325fbb3d85f86dfd646c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335899, "uuid": "db9766c1-e393-43d5-aaeb-e418e616aa65", "value": "196608:S8jdgKJ3c9rqUqE/bJQhahFmzVANKptHHQXDU5P1wbHXqbzwejuVDch5ly22RmoY:bMD1xw/tQXDU5P1w+wVDcvz2Rmow6Szn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335899, "uuid": "10047282-d888-417e-a74f-6f37f9c6503b", "value": 17832596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335899, "uuid": "3693af8a-13c8-43e9-bdce-8405da692d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335899, "uuid": "740f8de2-20c5-45f9-8cc3-d2e6ef908e3f", "value": "1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70aa8ab-ba48-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762348191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348191, "uuid": "9acf5f51-1473-4fac-802f-a54c3add54d3", "comment": "Malware payload (RemcosRAT)", "value": "af4c26b57b9a6d18cc8ab7b4e2acdf3d", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348191, "uuid": "0baf0ab6-8c61-47b2-8d50-8d876cabd512", "comment": "Malware payload (RemcosRAT)", "value": "1cbcc2f51cd5b1ff9fe30cf5ce88c27b64bc78dc33250d8e030520c4aa1c65b2", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348191, "uuid": "257fd3eb-2ccc-499f-92eb-13a03ef53f90", "comment": "Malware payload (RemcosRAT)", "value": "c64bc7c6616b38591a3f7f44bb5a8212fb4007b7", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348191, "uuid": "9a8b1a3a-9484-44c7-ac59-c9d9b51a4f73", "comment": "Malware payload (RemcosRAT)", "value": "fada8d6d90c2bf33033be8564d35a1f15d7fcc6965e7dc8459e8e3cc7c863afc8ea643b1f3ed754b80f3bd1bcfcf7b4e", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348191, "uuid": "7d5d3fd4-0b83-405a-8127-f3e76ef59268", "value": "T10FB4AE01BEC2C0B6D17215344429E779CEBEBE2018719D3B93DA1E57FE70151DA3ABA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348191, "uuid": "47cab450-393b-4d35-a095-06a5a2c9bcef", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348191, "uuid": "4cbd2e77-4622-4952-9e02-3ba8cebb437b", "value": "12288:P9pI1LsgyGcY6v+12a3AVPEhx2sPZSXSw:P9i1LsgyBYa+sPEhxlZAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348191, "uuid": "437587bc-54df-445a-86b3-13453d8d814f", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348191, "uuid": "fb6e5f19-805e-498e-bfc6-705c5ac4743c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348191, "uuid": "37dd41f7-bdfa-4b01-b1d6-e252801bdf11", "value": "1cbcc2f51cd5b1ff9fe30cf5ce88c27b64bc78dc33250d8e030520c4aa1c65b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b2ef4c-ba23-11f0-91c6-42010a9c0006", "comment": "Malware payload (Coper)", "timestamp": 1762332222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332222, "uuid": "be0c61b5-9771-46c2-b381-f9781654af5e", "comment": "Malware payload (Coper)", "value": "f2c9f6ebae89fa5280ac89658f802265", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332222, "uuid": "69eb5f90-4411-4fb0-83ca-b27386e2b2f0", "comment": "Malware payload (Coper)", "value": "1d5b2b87512ce21a691b9638b482c553594fe3dc7eb908a103e63c0c2c044d65", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332222, "uuid": "a98ffad6-2ace-44a0-bd39-9324f62d22f6", "comment": "Malware payload (Coper)", "value": "d082b99961a60df73cf86b0b9b95c80289415f13", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332222, "uuid": "53c0ea4e-198c-4d54-838c-f8b3e19545ff", "comment": "Malware payload (Coper)", "value": "8961a2599c5c5d34ca3f5c2f0374f98f6c2b7aa5e308eaa9ce7c6765c4d91bad218f54d3468f60e6c9a0609f68eff75f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332222, "uuid": "2ec00b21-90b7-4fb4-8324-c0deda18ea87", "value": "T15255F177E8B2726ECB8C93771599AD6367A2720692738C08369C36254F5CBCC0F157B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332222, "uuid": "db904aa6-4c9e-4e87-8b0b-943bd84390e1", "value": "24576:dw9Yk/B2gfUar0Okt7kb3RLMenGRe//Y341Jw5fOVKqwrtRsuP:dw9Yk/BLfUar0Okt7kbBae//W41Jw5dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762332222, "uuid": "17ad3b09-e96e-465b-94cc-8523388829d1", "value": 1333280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762332222, "uuid": "eaa443fe-aa86-4a20-82d6-cb43c2e55bde", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332222, "uuid": "65c33b15-08c9-4e78-af18-5bc9ce186c60", "value": "ChromeGuncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209eb7ae-b9e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762307137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307137, "uuid": "fbe34a97-bff9-4551-a6ec-46b39952af2d", "comment": "Malware payload (Mirai)", "value": "31dd89700a870e58ccf18ed0cd4870f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307137, "uuid": "a9d33ac5-831c-4785-b4f9-006fcad7cf24", "comment": "Malware payload (Mirai)", "value": "1d9cdc85259b4979f4577a725f86ee998093b3bee7ece26f5d2dd74eac3b6fa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307137, "uuid": "dd34c6c5-116b-4d2a-b589-a5458fcef30c", "comment": "Malware payload (Mirai)", "value": "4b6a4cf4f3706bd25fab142182d054f3daf4f7d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307137, "uuid": "3293aef3-3024-4cfc-b616-8ce9b6eebfc4", "comment": "Malware payload (Mirai)", "value": "c42e0a95578c313bfe776045aea6fa783d4d36064d6143f7fee101a42c7dad113ddc307655a9b5c6002b6e9b188df5c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307137, "uuid": "14cbd5a9-403b-49c7-8a38-d6bccb1b2668", "value": "T1CEC2D1E07726FA31C4206C3DE52B4D8A3A510A7C91FF393664258C358EC1A5B67B88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307137, "uuid": "b5496f09-425e-4c54-99c5-06d1f7668269", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrIjl9q3UELuV:PKy4qfqoeJdXWgIj4LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762307137, "uuid": "29ad2a19-f2da-4ecc-aebf-d6dbf4e3507b", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762307137, "uuid": "01044acf-cce7-4eef-b860-fb25825ff308", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307137, "uuid": "986359e7-e4b6-4842-a077-a46c26ca454b", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e7b092-ba37-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762340779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340779, "uuid": "bcfaaa15-2b1d-46f2-bac1-bc40cb4f244b", "comment": "Malware payload", "value": "8eeec39a6bc1a0ff4cee3a3bb0ff24ef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340779, "uuid": "0654843d-8d82-42bd-a96d-9df0f021ebf0", "comment": "Malware payload", "value": "1da1afceb5accde9fe4b674912fc01388d9d3e4550a9876a06813030c22615bb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340779, "uuid": "3ef0e458-eacb-4977-95ba-ee0f72a088c5", "comment": "Malware payload", "value": "2608fbfbba68686b42d78735aa1d04411d98e21c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340779, "uuid": "4c5e2cf4-85a1-473c-b8d7-b4fbb1bdc12b", "comment": "Malware payload", "value": "292a8b30b8d030836b45cde4546c771f5bb851a93ad3a4e4f4e64624744ee7b3ca9661d67165619c43a8db88fd6330bd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762340779, "uuid": "2da02b2b-2d00-4cda-a920-833560a44253", "value": "T124C08CA2453CC471533A0A6EB261E2F4EE06A4290FA138B6D4188784A2740740C4FB3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762340779, "uuid": "2667ebc3-a834-4ab9-a39c-bbd47948328c", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfDk+chMitUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMf4MhebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762340779, "uuid": "d7a44873-f40b-4c09-af91-5c99bfa8dc12", "value": 167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762340779, "uuid": "3d7612fe-76a9-4d35-90b0-bb92ba1b800c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762340779, "uuid": "5d3a1fec-8f83-4c73-985e-0a51b5cbb646", "value": "u0409oqb3y.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a979b09e-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316815, "uuid": "ef81e6b5-8b05-40ce-9903-b0aa000b331f", "comment": "Malware payload (Mirai)", "value": "f95b9cc6b617c818b5604cb4db27ff55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316815, "uuid": "2d4edd37-3f23-44f2-a9ec-9866750a1d10", "comment": "Malware payload (Mirai)", "value": "1e4a4619afecc3f53f118f7cd0fbf07038563dfa879eeb0335ac84f980c08a5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316815, "uuid": "5859ec30-f5f9-47dc-866f-1631c97422e6", "comment": "Malware payload (Mirai)", "value": "28d0be63b693b547184bf28a098998c6e03a714f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316815, "uuid": "e5f8791d-52af-44a7-a03f-bb13b4bef374", "comment": "Malware payload (Mirai)", "value": "c0de8a79019d6d9e410c33a8911dd31b51c159c9e9698d40595ce77eb107895c2a401a4941a7ed688741e1566220dd91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316815, "uuid": "62367d19-9cbc-4cdf-bd53-82812e7bd1a9", "value": "T15684E15AF30B2D87CDDBD535148AC2859755E89733E3830A2E47A57B3C2827B8F28785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316815, "uuid": "8759af98-9f70-4a7d-8ee3-10387bd32cf6", "value": "12288:iMv3JZdjsLC4ADMtk3tvHQTBwBT8prZB9:jvl2GVpHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316815, "uuid": "b8bff7b0-9504-4063-af31-0a734b59cd0c", "value": 399328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316815, "uuid": "0de4ea35-fc6c-4bd4-be2b-d413e8b8df45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316815, "uuid": "aca31f09-4761-4321-ae34-ed7670a21b08", "value": "mirai.armv7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ddbb6a-ba98-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382625, "uuid": "7be1c8ab-2383-4b43-8100-5d6a50924032", "comment": "Malware payload", "value": "3f384e4949c4ceeaee4fa2343cbdb2ff", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382625, "uuid": "c6c3d796-5b09-4587-b8ef-b86639b4f945", "comment": "Malware payload", "value": "1f1488888f63b039ace1e98b897f1c5b1ac79ea8009c227a4c21a40f4e789002", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382625, "uuid": "8d08fcbc-6422-4661-8c97-64e6c39c90b7", "comment": "Malware payload", "value": "bbe0dc89cf7183239b7fcbf1934fee52d496a928", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382625, "uuid": "429ba042-6bf7-4108-a485-1d5c2916e88f", "comment": "Malware payload", "value": "1918bac7eb7b0c23a2ab7f0c5c253982fe06cdfa079de1559e939e847e5c218c30fbedc550dab8c4ad9595209ea814a7", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382625, "uuid": "ad38a93f-c54e-4d6a-a209-5383769fdd79", "value": "T1AA54124A7E3EB0428DB0187E4D1DAF5CEFC056F87B88FC9642149478BA16C4376A716B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382625, "uuid": "bf4e9eb6-0224-480b-88e6-1b390010ed8d", "value": "6144:rR77GQdaKq+zhW+8vFoWhR77GQdaKq+zhW+8vFoWhR77GQdaKq+zhW+8vFoWx:RyQdab2WxvhPyQdab2WxvhPyQdab2WxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382625, "uuid": "aae307a0-7254-4924-b36f-9f5c99e47092", "value": 293454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382625, "uuid": "f1ac505b-31b9-4975-af70-4e442349a0e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382625, "uuid": "5e804c26-7428-4ed1-ad74-e068334a2c2a", "value": "Ultimate_Guide_to_Contract_Deeds.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398e0315-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376757, "uuid": "2ed6efad-5c19-4ac0-bf29-a17dd01826dc", "comment": "Malware payload (Mirai)", "value": "393dfc800b398efbe5191267d26017d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376757, "uuid": "e82c0fa4-1c49-41c8-8acb-3513e48ad46d", "comment": "Malware payload (Mirai)", "value": "1f1d7426892d7c1a0c5d1c0fccc9e434c42ff773cc6764f3f57120f5c7b9c6f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376757, "uuid": "f9f7d0c2-26d5-4b0b-b96d-76a98e768b3e", "comment": "Malware payload (Mirai)", "value": "303fcab6e22bd340fa3ecb6e6293befcf8deb57d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376757, "uuid": "7fe686c7-46d1-48ec-bb37-73a85b454a55", "comment": "Malware payload (Mirai)", "value": "b4e458450215bbc5dbeb06cc34e2883925a04d7010c42f13f07733f6cf323a065adeb764959ab7aa74f92b9ed157a45a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376757, "uuid": "f046c03a-bbe2-4113-a91a-af24485409c0", "value": "T14773A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376757, "uuid": "7770b649-4adb-4231-92e9-b6a70aaaf33e", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerESt3:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376757, "uuid": "1a3b527f-3df6-4c63-8ad1-0f887c2b2791", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376757, "uuid": "775c8c3d-f765-4412-bb84-698fb8083788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376757, "uuid": "4113643e-3a6e-43bd-bb57-89ccbe449200", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0941d5-ba66-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762360951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360951, "uuid": "f41658e6-3e41-492b-9b19-7f65ca172481", "comment": "Malware payload", "value": "96a4f188e9846e0b7c0db092530c8523", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360951, "uuid": "bffc67c5-dff5-4f11-afa4-b33d493c9ae8", "comment": "Malware payload", "value": "1f965906c7ca3162725563376db8e65b2f7d66487ed48e58820164616790c606", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360951, "uuid": "53d9c930-f5f2-47a0-a4b5-86bb770941fa", "comment": "Malware payload", "value": "c9952c2524ed88ba76702c6ba81fcc2846ab9f48", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360951, "uuid": "d775b765-1bb4-4ce6-a02a-08ab590ebe00", "comment": "Malware payload", "value": "97b236c975a20d7baa6d0484019822d4ce3658be8f78ba38fc1680f1dda58cfdfc6b981b9830c427bd3c542d9cec8757", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360951, "uuid": "403e3a8c-708c-468d-ac6a-98d6bc710a90", "value": "T11595F182EEFF5D72C22AC63945D712144320DC188A719A473ACA76387AFAF55372336D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360951, "uuid": "19df272f-5d68-4c14-9c9a-743f758fa190", "value": "49152:RXy613EhyImJh4iRZchzM7NFCf3vDPjLSYzfD:kA3EsImJh4iRWO7mf3vDP3lzfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360951, "uuid": "32e9acbf-2f47-45aa-8d33-fbcf0d0c8881", "value": 1951232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360951, "uuid": "9d673909-44b3-436b-adab-3c6d11a86470", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360951, "uuid": "2b995d70-2887-45e0-a1a8-16495d91e9ef", "value": "REPRIME LLC_PURCHASE ORDER UAE.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245af685-ba45-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762346657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346657, "uuid": "9c079732-915e-454a-b5a7-feb92ef70502", "comment": "Malware payload (Rhadamanthys)", "value": "bad5bd5312919e45d13fb7ecf86229d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346657, "uuid": "ff9d5a50-5d64-4672-bfeb-c7198e6b0911", "comment": "Malware payload (Rhadamanthys)", "value": "201d9edf0873483adbd4c6f09d97afe28f0077cf624407dfc8a707302f9c94c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346657, "uuid": "e2f8d106-130a-4344-83d4-b319fac97932", "comment": "Malware payload (Rhadamanthys)", "value": "14e4cb4661b9f19ea09211f47ecb0a8c40a570cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346657, "uuid": "c952753c-8007-4cab-8e4c-c059972e56ed", "comment": "Malware payload (Rhadamanthys)", "value": "a03c266db706f878cc1d6988c0fb25aa5bf508dab49f131e3d8a1fb11742a8b1399b0ccc56c36bf6ceb2884b2fcee86c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346657, "uuid": "b321eb14-0e6f-41ea-b0d2-0323539567ca", "value": "T1BDF73363AD2E08FDD0D5B77DD12F05F5864B284F098E10D972BE91AFB8F85064E2258B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346657, "uuid": "dc9b18ba-ffa7-45fc-bfbd-c3b9e1789c11", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346657, "uuid": "6bb99e63-bdad-4386-96be-ca4a7b3d85b8", "value": "1572864:uke4hdV6xfsH8GynQ3Y9GF0J2/3M4fvHLTkEY68xsqBJwt:uke4DoxfWeI/0A/3/vHLosEet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762346657, "uuid": "d9881a03-e178-46c6-8375-572d81e5b11c", "value": 76172606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762346657, "uuid": "0e285b73-9406-4ec6-b547-ee14f3653432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346657, "uuid": "73ad7ab8-6562-4562-b66e-8f9a8345b452", "value": "Vertan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231689df-ba91-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762379297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379297, "uuid": "168a4724-8f87-4e29-8922-c0455901ff01", "comment": "Malware payload (Mirai)", "value": "0b00a42bf62d05aa69af5df522384932", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379297, "uuid": "44273d36-9388-48d4-9062-cd5e616c7515", "comment": "Malware payload (Mirai)", "value": "206877d6c684dad1e0eeeae4ebd50a28ffd2dff1dc3acd7f62b86aa705e7d3ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379297, "uuid": "59635593-8390-4af4-823d-ef9e1cae8614", "comment": "Malware payload (Mirai)", "value": "b4c6168f852d335143ccb5ca2081e97fcfc8c6e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379297, "uuid": "62c1a3fa-38b7-48ca-b677-fde32113869f", "comment": "Malware payload (Mirai)", "value": "d37b6709522da8bce34d7a0e2fa301f8738bd7c09d4c1217e905ddfa58e312a174a3eea755b38738ac2b6bb630b77b50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379297, "uuid": "76e6d297-2a15-4469-b7ca-24e006b192dc", "value": "T15C735B077980D1FDC4AAC139437FB536D433B47E1239B29B57D8EE2A2E0AE601F28955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379297, "uuid": "1640b23c-9a6d-489c-ab49-47b2b93ae548", "value": "1536:iLOyNxLpn+alOBm3nZAyBdlrvPUwHxo/J/zJL:iLHDpn+EImXZ5dlrFxo/J1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762379297, "uuid": "8ee85e5f-6beb-40ea-9dc6-ee28d11bb727", "value": 80400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762379297, "uuid": "5538a48e-6a76-46d4-8801-fc14f0a53730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379297, "uuid": "28af7ad7-cd4e-4975-ad46-2e2cf9d292ad", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232f87cc-ba29-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762334629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334629, "uuid": "234fb22d-4ba9-4ba7-b9b1-9880cf781313", "comment": "Malware payload", "value": "4dbcfc129a01817d2d7c37ec21df5b46", "object_relation": "md5", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334629, "uuid": "07cd6c19-5737-4b7c-9d96-ae96dac6fb04", "comment": "Malware payload", "value": "208aa90e43cd0b4cf4abe657edba6f98b9b1353aaedab0e6f911971fe2ce8508", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334629, "uuid": "b06706d1-886e-4497-a0c4-eae48ee26606", "comment": "Malware payload", "value": "c729f8b4aaa1ddcc55dbb8a516e11e1c2ab256e9", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334629, "uuid": "fda6a1e3-f478-4817-9b3c-86a63cbe9b2f", "comment": "Malware payload", "value": "ad6be5ef83cc9c74bbae2b8dcd911c729cffb93b4e5239505e88bff19b56202c9c196b8fc82ffb7ca791043d1b5099f5", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334629, "uuid": "492de1ac-8bb1-4d8a-8b30-0bfb86c3ab34", "value": "T1FAE723E409B6A93562DD52E42A056DB2B85D325C2D2B9674DFF409903AECF0E0373B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334629, "uuid": "4062c4cf-ba46-4502-b5b3-5ed9f446171a", "value": "1572864:mp1mD49h/+x3qm+Hij4moLAR8AOCQMEnHNu0LJ0jAL:l89do2HPo83r5HNu00AL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762334629, "uuid": "8e70eb43-71cc-4129-adee-d00af5b19e4a", "value": 69644785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762334629, "uuid": "8ef0f3d7-0654-4a66-8996-c212cd87b8e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334629, "uuid": "a3dba23d-aa13-4f7f-be6b-7197b94a7662", "value": "2023156ea841fb8fa80bcf0cadc3fbe6c653cbf76b2d06f3c2aad730c43155df.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da394379-b9f4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Joker)", "timestamp": 1762312173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762312173, "uuid": "5e682003-6416-4c98-b959-1aac4c86c35d", "comment": "Malware payload (Joker)", "value": "c69043476aa3ffeb46005e85208f4bed", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762312173, "uuid": "31e67f48-bb7c-46f0-a7e1-e4490a897b30", "comment": "Malware payload (Joker)", "value": "21123870a0735c5a132287f90b129a0ce00526d624793bd00ba5039a3988b659", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762312173, "uuid": "46336e6a-3266-46a4-956a-955301513a10", "comment": "Malware payload (Joker)", "value": "43dff57f86cb9b075015d97111a9c3c96de9496f", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762312173, "uuid": "26d17a17-732e-4890-8d61-806161542eaf", "comment": "Malware payload (Joker)", "value": "72749773868cdbf7211651ef8ed7ee04c957af45bd66c0c4b0191f2c6b9aa5788daab9103a9fd79f6c7011131221a48b", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762312173, "uuid": "35d8305d-f3b2-4d30-b055-6276fb7e969f", "value": "T1D197124AF71DAE2FDCB3F0388D6A136279650C94A681A7976601F62C7EF76C08E057C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762312173, "uuid": "f833ce57-9562-4300-be83-8de466eb910d", "value": "786432:yvWNveqHADovfOjMR39B6CCGfJmhkbIQ0ggLi6JEhHbJzsBLF:yvWpeYAUfv9jFfJmhkbIQkiIEZRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762312173, "uuid": "8c5e3da7-de3a-4359-9149-a8f3cda741e2", "value": 41157469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762312173, "uuid": "bb64ee4a-2fd4-458c-9865-5bdb232a59b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762312173, "uuid": "f5e21fd6-407f-4b14-b771-7ea1772a63eb", "value": "Swift+File+Cleaner_2.6.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0504c9dd-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319546, "uuid": "52774457-08dc-44d8-8156-f0639852a16a", "comment": "Malware payload (Mirai)", "value": "9c0a8ba1c35cfe72abdd16ace3fd612d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319546, "uuid": "6d5eecf3-6400-48b2-88ba-50f2ebdc145b", "comment": "Malware payload (Mirai)", "value": "216c1fe4013d8e6a226268bb8f0ddcd86c76a6dfb3b43f59fb9d53681e9b33e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319546, "uuid": "2e6fe8b7-3b44-4885-adde-66173091ac81", "comment": "Malware payload (Mirai)", "value": "7ee49092bd732f4a099fb0c6a1d8bad92cce3ceb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319546, "uuid": "31b925b2-cd09-4bdf-8667-7d907311492d", "comment": "Malware payload (Mirai)", "value": "b25b61d44fa7801e3378e9fcb07eb59f8d76b497760d8f216de846a2aaf3ee74033b95f4053e862772a7ecf3a48b3535", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319546, "uuid": "b25369dd-94e1-42f1-a279-e0ccac58c66a", "value": "T12FC39D87B78B10A0C4624AF017C71B9D6B537211CE6FE8E3BC1E663F5A7A4DB1916381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319546, "uuid": "44310c5a-99b1-4221-8057-9e0446820e26", "value": "1536:068QyAmkjsPrai52H6q62rf52T+7CD1yyql3/eiAY8xP/AgEvEX/LW8:fYA7jgrar6q62L5c4+Qyq0iAYNg/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319546, "uuid": "852e98a7-0b25-46a1-b415-5a596d591bcb", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319546, "uuid": "d1444090-afd7-4e9b-b516-93365925682e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319546, "uuid": "667a02e0-449a-4be0-aca8-7786c569c9cc", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b72e481-ba49-11f0-91c6-42010a9c0006", "comment": "Malware payload (WraithNet)", "timestamp": 1762348440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348440, "uuid": "424addb3-d5d6-430c-a2c9-e0251220785c", "comment": "Malware payload (WraithNet)", "value": "4c5b4bf0a46d009f904fe82042afe6c2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348440, "uuid": "98b1be23-3cae-47ea-8613-2da69a5e2bb7", "comment": "Malware payload (WraithNet)", "value": "21c51bef21b8c0ce0e697cf0cf96023d3943b868c7e674e9df52a7dbe89e3eb7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348440, "uuid": "295518e8-bfd9-4a41-8e7a-8eee18bfdd40", "comment": "Malware payload (WraithNet)", "value": "b9bc56122eb59c0243e4b25f818c27febb07e6bd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348440, "uuid": "41ad3fe3-ca5f-4c14-885e-30fccbb38693", "comment": "Malware payload (WraithNet)", "value": "66d1f749d5a76fa8122989d1ce1df0c98c09b68f1ac27ed33c2a1a734805a28583f279d96d09add90847ab3a13542177", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348440, "uuid": "3bd1f732-bff3-4017-8108-75bbf23d4638", "value": "T11E64233A11B05C31C67D7731A1AF51CDFE12D4239F19D6B52DA0E0EA7A381F624A394E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348440, "uuid": "aa1e95ff-5f49-4c3b-a637-cc51aa544527", "value": "1e23bfff958d32bafe61268aba966fd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348440, "uuid": "757cc0d0-8938-4245-bcbc-5ff22c7b1ac5", "value": "6144:aY7ZFNm4XSbJ4WVgtNxYcjzrXa+OwwcYpQdamH+QuMz+:3FrXSV4WVgtNx7XaRb1iluMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348440, "uuid": "cfc72101-5547-4c74-8322-b22c7c730ece", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348440, "uuid": "a6e48f08-cbc3-4a99-a358-25e8aaeabe79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348440, "uuid": "771f2dab-2b51-49f8-8ba4-0e6493f67c82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf2575d-ba3e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762344010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344010, "uuid": "1fddf60e-14e3-4052-b3e2-bb9f4fae46fe", "comment": "Malware payload", "value": "d8359264ca7331460cc8978143c2bb9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344010, "uuid": "a67c9c87-5ed2-4cec-a8ed-2d1bb9691a21", "comment": "Malware payload", "value": "21ecc1b02f9c4ef5caac772f712f4fb21195f6181ebcc434cc574859074ffa0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344010, "uuid": "0974d935-efa5-46a2-8dd9-042309a9c3f9", "comment": "Malware payload", "value": "c8b09d0799b13fb79d0117e584f696f58e838e98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344010, "uuid": "b0a20bcd-c5ae-443e-a588-83bbbf7bd919", "comment": "Malware payload", "value": "ab417cb5a689d0a7b4693b121be38f68c7ddd885f893618fc25e49af778a3edf5805d8deb9bb542e8ebd3f2574992e92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344010, "uuid": "1ca16038-1d52-4b16-9cf0-db38d43aeebb", "value": "T107C23B0DA6AC8732EA3FAF3DA9B242178A71F502E431F60E588CD1D919E33508D5476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344010, "uuid": "918b9419-fd3f-4acd-b328-f0fa6a24c6ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344010, "uuid": "d760b224-d96c-498b-b6e1-143c41ebea82", "value": "768:oo/qnPAoZ7PCAK1kYzbzJ0SbICF82ADpQqMsl:onPAoZuzzbtkCF8tdxM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762344010, "uuid": "94b5e992-62a1-4981-99b3-57331cee0139", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762344010, "uuid": "df21a79a-cb50-44c8-a513-c304a25ccacb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344010, "uuid": "2bd5ecb9-98ad-4af3-a758-c00ccb013473", "value": "ConsoleApp2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ce09c7-ba58-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762354972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354972, "uuid": "871ffa27-cc46-44d7-84ec-82a2d8b1fe18", "comment": "Malware payload (AgentTesla)", "value": "3145cb33a7277145cb4a35b0506ab8ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354972, "uuid": "bfabc1b7-0109-46b6-ac69-7dc4c6297033", "comment": "Malware payload (AgentTesla)", "value": "21f03ff49818a849d55e020a068a1e7df02efa479cd25bbed12467b288879145", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354972, "uuid": "b2083905-c515-47f7-a2b1-36cfa59b6ca8", "comment": "Malware payload (AgentTesla)", "value": "13466597d7e64e12b540cf695b8ed446f55608fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354972, "uuid": "ec188e29-0ed9-4b81-b839-c7c695530c66", "comment": "Malware payload (AgentTesla)", "value": "5f70d80ffa6c5e3f3e766bf2c01ac18a068ee4cb9f11a19dcbf9092e690cd1a1c34b38e865f84bac87dcd6ba57fcfd4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354972, "uuid": "8fe36f6e-97a0-4ce2-81be-de70f36b31bb", "value": "T1083512F12983C390E2EA8473985E7DB64AD211BCF3CC6A0CCAF5A249F975CA45E7D450", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354972, "uuid": "1654601b-18b8-4653-a7da-034d46c2251e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354972, "uuid": "bbd1826d-dea4-4d0c-ae9b-433399ba0ba0", "value": "24576:/PCsNggz8dGX0D7rJ5GmIqUUnswhgjKLrkllO9qNYvtksPXd:HCsVAdv3V5VIqUungjQrJhvtPPXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354972, "uuid": "92de220c-f2f1-4edf-881e-fbd06a83d505", "value": 1088504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354972, "uuid": "406da360-15d4-419a-8f2b-3acac71a47ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354972, "uuid": "94bff38c-e722-4573-8167-1c19bba9f524", "value": "NuovoOrdine200506001233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353f0096-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376750, "uuid": "51217736-4f6d-4f6e-914d-995f1f31cf98", "comment": "Malware payload (Mirai)", "value": "43513f3b1cb70e79d285d1765083f7c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376750, "uuid": "2533332d-895e-4797-b757-bfaac44ebf36", "comment": "Malware payload (Mirai)", "value": "22dbb890c0ec07df8284b566efdd4c35c98b2d73077197e2f348215a17f497e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376750, "uuid": "d07b58f3-de1d-42a7-a957-0fa934df4f92", "comment": "Malware payload (Mirai)", "value": "89331b7627e54d7bc494b64dca17b042bb410ba1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376750, "uuid": "38c5a672-afa3-4522-a3db-2e4620f4923e", "comment": "Malware payload (Mirai)", "value": "cc0da6eb8610bc52dbac61e0f4f4abe6cdab4d41ab6c5e30d65595ec5930bb7833afd76764883d70d09dc82b35cc793b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376750, "uuid": "b1611f66-f563-4bb5-bf13-b57801810a29", "value": "T1B9230891BC819A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376750, "uuid": "e40bc032-1228-45c6-a716-6ba103742613", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THk:5DmKF7Gxyk8cqoHAmWurAufsG5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376750, "uuid": "1824e5cc-06a5-4230-b291-fc8c43e6e969", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376750, "uuid": "660f08b0-e5cb-4123-8ede-4019954c3c0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376750, "uuid": "cd177ea5-c9bb-4748-ae10-41b3ceddbeca", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0783870f-ba7b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762369801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762369801, "uuid": "52cf63f3-c0ac-426d-b52d-ae07cb68307e", "comment": "Malware payload", "value": "7851d7a1ccacfd0ed64704fbd67ddcb3", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762369801, "uuid": "0583c1fb-2deb-452d-bc4e-ecfeb286c07e", "comment": "Malware payload", "value": "233a511f9ec3e634786ebbf27690d0ea6ac6ec7a1d01c1280371e0930c00afa0", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762369801, "uuid": "a1137c37-c8a7-4c05-9121-73144aba4f93", "comment": "Malware payload", "value": "00c79d8cd34369830d59300fb125b66752e4fc0b", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762369801, "uuid": "88934381-fcb0-4924-aeb7-2160e89360df", "comment": "Malware payload", "value": "39bded8cd0f80691567e975d64833e565d0bf772bfc4b26362d808bb10bd4ead1b706a2df3ae5befdc015277731de21a", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762369801, "uuid": "b83cfba8-5bcd-4303-9f99-56e47a80667a", "value": "T1E654123542E0886716A937F522C9F879A6D1006FF4E83FF61C3A05C975D429EFEA2C25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762369801, "uuid": "36115ce6-d846-4bbd-9e50-d712df3b60c9", "value": "6144:nq/Mo4+Sh/kIjh7tyq/Mo4+Sh/kIjh7tyq/Mo4+Sh/kIjh7tm:nq9SOI1tyq9SOI1tyq9SOI1tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762369801, "uuid": "0ff5d499-f0c0-46ea-b35b-827d2825c3f7", "value": 293436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762369801, "uuid": "29b866dc-8b06-4aed-be5a-8dca088631a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762369801, "uuid": "3a2d33d5-816d-4f49-aa64-7f5977b8b715", "value": "Ultimate_Guide_to_Contract_Deeds.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f124c2-ba42-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762345504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345504, "uuid": "7aa1d3d0-23b0-4255-a284-fed053052414", "comment": "Malware payload (Rhadamanthys)", "value": "b2441eaf02eefe3b4129bd1aaff748a3", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345504, "uuid": "681d9e7c-be44-4804-bc66-82fd7ba298b6", "comment": "Malware payload (Rhadamanthys)", "value": "23b2738e74d3c088c30f43056d87b72f04038fd77ef52b513ad1d03305da3fe2", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345504, "uuid": "61394711-f603-462d-ad1d-fb8bbbabd422", "comment": "Malware payload (Rhadamanthys)", "value": "58af07ee23d09de281edbf24b9dc5a96d8a21e81", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345504, "uuid": "d1cb9083-e4b6-4532-b773-c81279c45138", "comment": "Malware payload (Rhadamanthys)", "value": "ab4533f83c0af6fbfad67786badbed4eee302d9c0ec20e28e688bbddced2cacc4c1a8de5137563a716b871034c847e3b", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345504, "uuid": "35a0f406-a07c-4137-b504-f89ec4e3d747", "value": "T1D9D50866688104E5F0A6B2B5B9A6524336E2FE440F3363C72F59FB782E721E05DF5708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345504, "uuid": "dff028c9-c824-4806-bda5-062ec194af02", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345504, "uuid": "d8ac67e2-823b-45db-b4ca-e85c205f3ea0", "value": "49152:u/ZtEquszFGKuMoISojzhDYVRPB3FlWzMC:uvFGPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762345504, "uuid": "a4ae8324-35ab-49d5-a5ac-d7c85d340663", "value": 2939392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762345504, "uuid": "aca76ccd-0ed3-4be1-b1c3-2f09b31f95a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345504, "uuid": "2994fbb9-8bcc-470c-985f-834b5d0b83e8", "value": "Installer-x64l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3ba873-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319984, "uuid": "ddab116c-c53b-4f1c-8f3b-96c2e1c16308", "comment": "Malware payload (Gafgyt)", "value": "d6a783e2931acd1ac5137a16cafdbbac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319984, "uuid": "6caa24f4-65d9-4712-be47-561bfb490fca", "comment": "Malware payload (Gafgyt)", "value": "24a92c5e697428fb6a795ca1c4583bbd7d9eb857af3c9df7256928483d1ee74b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319984, "uuid": "1eb0b74f-b7b0-4540-9171-671e7c0facb5", "comment": "Malware payload (Gafgyt)", "value": "3e4d90edebc3e8cf821d75e9607c268bd109c9a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319984, "uuid": "6fceb489-b05e-4e80-9714-86ff11be58ed", "comment": "Malware payload (Gafgyt)", "value": "b06e61cadfe0a3bdffb8e906ebf5fc79569ac956cf4c43c690700df8dee19d09c09b735d410a427b429badb955cf6801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319984, "uuid": "442486f4-53c9-49c4-aace-466f1df792fa", "value": "T11AD31A24F8504756C3E323FAE65C869E3E220FEAA3DB70214A348F6157C2BD62579D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319984, "uuid": "ff0c9f21-f442-4ecf-b468-8e8baa446870", "value": "1536:kYnOOhkGz2OodaDl5K9NpdaO21hxM/qpMaguILMxiXSTXuvxGCxq5YqX1aYK5h/k:kdaMehS/KMaVTXuvxGQqvX075h/wNHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319984, "uuid": "e8db17ae-f0ff-45dd-beba-9e2816c96530", "value": 136120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319984, "uuid": "b26c76b2-7786-4a10-846b-7bbaa9f7607d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319984, "uuid": "fc2f359d-75fb-4b90-bbc5-c262558f63e0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9a5d7f-b9fc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762315559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315559, "uuid": "d2cbf689-8350-4545-9e91-0e4260564d2a", "comment": "Malware payload (Mirai)", "value": "939c0c4bfc11dc88f41335ef901270d7", "object_relation": "md5", "Tag": [ { "name": "89-110-95-186", "colour": "#F1C79F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315559, "uuid": "e984acc4-51b1-4c13-b6f4-446302c773a2", "comment": "Malware payload (Mirai)", "value": "25d49fd2bc2c50e773b00f31a67578965b73f08f569b106ad5231b4e87834c1f", "object_relation": "sha256", "Tag": [ { "name": "89-110-95-186", "colour": "#F1C79F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315559, "uuid": "e041147a-4d4e-4167-9cbe-99ac29905161", "comment": "Malware payload (Mirai)", "value": "6f81f7fe22df175cae53a030b1d28654ab49e6fa", "object_relation": "sha1", "Tag": [ { "name": "89-110-95-186", "colour": "#F1C79F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315559, "uuid": "d0b7308c-10b5-460f-9088-14ffc74854e8", "comment": "Malware payload (Mirai)", "value": "2ee87de1e676b194921420f2c9372968ab69d0c5e886899e4daf9109ec5b983cc627da413b616c64eab3c92e75852fb8", "object_relation": "sha3-384", "Tag": [ { "name": "89-110-95-186", "colour": "#F1C79F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315559, "uuid": "137cc2ea-a86c-498e-9b39-09887c95dc4f", "value": "T111B32B46EB414B13C0D5277ABAEF42453323E75493EB330689286FB43F86B9E4E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315559, "uuid": "a5277157-ede0-4f1f-80c6-f38394e13b4c", "value": "1536:KZnKthAThmX/0sagH0p1WkRqcmzdlrPiLguvmPzVy1Cekzw/9DXqdvD9mDrz:r6TKAgH0p1WkRqpGgu+Pzs1C5M/9D6oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762315559, "uuid": "46f1345d-32ba-4ab4-be9b-cbb644d274ab", "value": 111730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762315559, "uuid": "97b33bad-60d3-4273-a7c0-bef94d35d195", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315559, "uuid": "25ea61a6-00dd-4d80-86fb-d9f30fdbe198", "value": "25d49fd2bc2c50e773b00f31a67578965b73f08f569b106ad5231b4e87834c1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2342ea94-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762335918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335918, "uuid": "b43b0983-6cd8-477a-a0f4-9ea2d381f67a", "comment": "Malware payload (CastleLoader)", "value": "febe6f24e2ed3ca822b46b096603cf94", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335918, "uuid": "168891fd-64d3-4184-ab8c-631a40647a49", "comment": "Malware payload (CastleLoader)", "value": "25e0008aba82690e0f58c9d9fcfbc5d49820aa78d2f7bfcd0b85fb969180fc04", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335918, "uuid": "889d7f92-2e9b-4404-b41d-93ee21fe3513", "comment": "Malware payload (CastleLoader)", "value": "f30771acbaba8d8ef18f9b00029a40944d7fc74e", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335918, "uuid": "1ff2799d-bfca-45e9-97c6-82fe37686c33", "comment": "Malware payload (CastleLoader)", "value": "9be40e66e077a6c7b6d200b2d9da64e6145f62e8f4688b595ae33ceb488471bc0bbfc4bab8183283e87d827ac07d2c81", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335918, "uuid": "85067a69-d13f-4faf-9f56-a34ca655bd7f", "value": "T1C7348D01F281C47BD4A20A771598A3B641AFBD344B5916CB73D93F6AED308D24B34E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335918, "uuid": "18f44d1d-a63b-4691-932a-d1cf22238d2d", "value": "e1bd82e8b4275e0c717f1065b63ee328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335918, "uuid": "a89644b9-9040-4a53-ac78-0ac937939e82", "value": "6144:5Q0GpqESPZY2lS3EMFypFlp0iy9fgZQDm:5Q0BbO2839FypFyOZQDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335918, "uuid": "11d573fd-4bee-4024-b010-8a2a18ba9e61", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335918, "uuid": "cd193409-782b-4911-8c85-39bbe30adc74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335918, "uuid": "918c1276-f353-4218-b0a5-d24d20a41793", "value": "25e0008aba82690e0f58c9d9fcfbc5d49820aa78d2f7bfcd0b85fb969180fc04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0d6cc3-ba69-11f0-91c6-42010a9c0006", "comment": "Malware payload (ConnectWise)", "timestamp": 1762362159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362159, "uuid": "b097172d-40b8-4b39-b326-09251b994ec1", "comment": "Malware payload (ConnectWise)", "value": "af05acd97b12b6f5d5c8a416fb6998e8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362159, "uuid": "8120ecc9-ab83-49f6-a915-99ca2ef72b95", "comment": "Malware payload (ConnectWise)", "value": "26fbda92490b8ab92a28b709b11b31361266714200fa8954f91bb0bbc96e9c2a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362159, "uuid": "ddaa5969-8a54-42b0-a47f-1f6e29864a6e", "comment": "Malware payload (ConnectWise)", "value": "5d928fd023e9b0e282236d9ffd8466374ab39cdc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362159, "uuid": "fd60c7d2-67ca-447d-9e50-58abe30e3c67", "comment": "Malware payload (ConnectWise)", "value": "f2e1c6f40cb85db9e23dded816e829c85a6d29093ca0b3cbadceeafef80f98d1499a9f27e5c91d4e282368d3f2c97e5d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362159, "uuid": "bf6082f6-3aad-4d6a-af7f-666703670a8c", "value": "T1FDD6232163F80509F1B71938E83A90F65A36BD55DEA2D21F136A750D2D32E809EB3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362159, "uuid": "962483b7-50b0-4231-8969-514238b199d0", "value": "98304:VWkigfFaKgYdGdYh3eqQumU73tc0WkigfFaKgYyWkigfFaKgYCWkigfFaKgYlWka:Vfa/YpeqQzKfarfaNfa6facfaPfao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762362159, "uuid": "20ddfb88-5ca7-4876-b47b-0f154e8f3d66", "value": 13443072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762362159, "uuid": "2cce1f9a-b202-4192-8a1e-5387d406c1aa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362159, "uuid": "4436e1d6-90cc-45c8-84b4-c844f5b1b865", "value": "Client-74563(2025).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa25e971-ba14-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762325970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325970, "uuid": "ce66a87b-dcb0-4c47-8f16-f14d1a91c42b", "comment": "Malware payload (Mirai)", "value": "f8ee193e609672c711b605b83bccd373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325970, "uuid": "35a62c1b-ce4e-47a9-b18d-872847546484", "comment": "Malware payload (Mirai)", "value": "27cd3dc7628bd4cf1afa485d00af18c385da539b49c764020d7dd71ef2a32434", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325970, "uuid": "d7c14042-64a1-4e42-a31d-e176fd6e0821", "comment": "Malware payload (Mirai)", "value": "8dfc760b08d2c0035ff7da11cf4f25cc359fa23f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325970, "uuid": "fee01e26-08f7-4801-b16b-a1999052a3a9", "comment": "Malware payload (Mirai)", "value": "221a41a45c3c3304877e5f7b6caa20fa93b332f269ed637763a38f9450a160d04479d5c2e27c21181b82bdfa623f2c0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325970, "uuid": "c1a54354-0a60-4256-a2cb-aa22be6be2a3", "value": "T19303F19832C05865DE3C63B5EF36CA5B3FB675899190504F2848BC762DB2F01F533952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325970, "uuid": "1f916387-bc36-4c9b-b6c4-9864956e6483", "value": "768:3StpHIAPGl7uqVIXx5U0OLyKnv6zR7M1kWjjdZD:3StVIAP6uaIXx56ygv69AkOx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325970, "uuid": "7bc28b7b-20d1-4115-9e2a-e214e78fa610", "value": 38996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325970, "uuid": "b2764b38-85af-4915-9051-c124bfc27a17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325970, "uuid": "781a5e07-62f8-4529-99c7-f5c8b59371c5", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659e0b65-ba95-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381126, "uuid": "6035d530-4ad3-4b0e-a87f-7fa00bbed3c3", "comment": "Malware payload", "value": "efd35dd282db44156040a0665becfd9b", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381126, "uuid": "27c5ad71-6319-4071-9d1b-35a51b73a47c", "comment": "Malware payload", "value": "27f68595e33a4596f6534f76bfef33e374f9799987353b8520e6d389ee72f647", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381126, "uuid": "74b6ed9d-020c-40db-b98e-fbeac0e3f6b4", "comment": "Malware payload", "value": "d9c921ce89168ae4b86c4d1713789418c140e9f7", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381126, "uuid": "d606e250-3649-4546-86c2-7df630036fce", "comment": "Malware payload", "value": "499da18600a3a7dad206d60492bad738b86baa0976f60c7b5bb13cf539589502b29c75620f6fb8c950438a444a3d175a", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381126, "uuid": "234baf43-df7f-499f-a321-117ded4d2cd0", "value": "T16C5412629174F1158CA88BB928ADFE7674C6B1F92B2D5C2E047A25CF78731E2084DC69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381126, "uuid": "e8c1ee21-c902-437c-9656-2deba788fe97", "value": "6144:GRjsK2USWvuGp4RjsK2USWvuGp4RjsK2USWvuGp1:0jsOb2jsOb2jsOb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381126, "uuid": "2974389f-8b02-4020-b7d7-9bc397ed5e19", "value": 294825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381126, "uuid": "a4b0b4dd-404c-4db3-8cb9-0084c5669eb9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381126, "uuid": "8f80680f-3d16-4557-aa1c-37df6287f68b", "value": "Ultimate_Guide_to_Contract_Deeds.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a575deae-ba1d-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762329694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329694, "uuid": "eb0e43e1-04b0-4226-bf2b-b4906b283739", "comment": "Malware payload (AsyncRAT)", "value": "8241a31bacf400b80f22a535838aeda2", "object_relation": "md5", "Tag": [ { "name": "172-31-37-118--2000", "colour": "#9DA9BF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329694, "uuid": "d5cf3216-88e6-468b-b914-c50a795a40b5", "comment": "Malware payload (AsyncRAT)", "value": "2a91f68ecb550085680a192445ad710d8a73ceb4c1cf884ac81277993098f626", "object_relation": "sha256", "Tag": [ { "name": "172-31-37-118--2000", "colour": "#9DA9BF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329694, "uuid": "a2b8c5b9-b1b0-4380-8574-1b2e9b9f3b2f", "comment": "Malware payload (AsyncRAT)", "value": "9f1a0259e653c9d956b809ba20ba4b9471d73575", "object_relation": "sha1", "Tag": [ { "name": "172-31-37-118--2000", "colour": "#9DA9BF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329694, "uuid": "226691ef-ecd6-4949-8fd6-0f775b927f37", "comment": "Malware payload (AsyncRAT)", "value": "be09a49888c80d6c4765588a2e107886d89433c816393f47e989d7bd9cde3a572281cac4ab103ef993597d023e76cc09", "object_relation": "sha3-384", "Tag": [ { "name": "172-31-37-118--2000", "colour": "#9DA9BF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762329694, "uuid": "9844f56b-b0e5-4a4e-8a77-a18c4f47064d", "value": "T163511E39B2D75B1002A01D61A435DC5223E5D5CBCEB9186BF4E682C70EB8308CFA0DE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762329694, "uuid": "458b0195-ed39-4e1f-b5ab-51e45906c4bb", "value": "48:P4DY777x/CoxSteiu5gXdm4joLld1I6mdXD43jtAtktK5g:P4D8Steiu5gXgXLoN6eyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762329694, "uuid": "ed7771bd-afcb-4b89-8a77-f2b5523050ad", "value": 2453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762329694, "uuid": "70392ba9-7c86-487a-80aa-890dd10ec178", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762329694, "uuid": "414364fe-e6cb-46e0-967e-f8e9cc781b20", "value": "ClivetVpn.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6ab787-ba6c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762363637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363637, "uuid": "f36f8348-db11-43b6-aa0c-ad31302f337b", "comment": "Malware payload (Formbook)", "value": "42d56aedf81b5bcb99d68c65cf7fd81a", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363637, "uuid": "05fe5262-93be-40b5-8874-d22ace522239", "comment": "Malware payload (Formbook)", "value": "2ad6ca5c2471a53baebf2d1735ff9fbfe5d6a76d963e990d75098f66cf668257", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363637, "uuid": "2a60a3af-d952-4952-b554-c0b925b634a6", "comment": "Malware payload (Formbook)", "value": "b454a92cdb02eed3858bc3c71c4e2b9d3fcf1866", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363637, "uuid": "dbaf6378-443c-478f-b453-311b881d90b5", "comment": "Malware payload (Formbook)", "value": "f91be6506fafb848c9b8f654d07769f8cab36aea787377ba5e2d4aa70c367c8b47cf627e3883ef5330c105aacea33c47", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363637, "uuid": "ec5fd8f5-8860-442f-8a53-a8f9af97f68e", "value": "T10ED422B709D17C3DC00CA5FF65877239B0A81EA666B43149A84B73CD1C189BE19525FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363637, "uuid": "436ab0b8-5e1e-4560-abde-437341405bb9", "value": "12288:HuHgnDhA4F9WKLo4DUnoG5cxb/a+kIdIGqPXGcpZReM6Kuvc8J5:H2gdrFt1gpCJdKP2K/e/Kuc8J5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762363637, "uuid": "41887301-ec46-4b8c-bb56-a2ea15fb9219", "value": 653586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762363637, "uuid": "a550efcd-7dee-49e9-aa8a-2fc699f4a3f9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363637, "uuid": "0ab85e62-392a-4cc9-9064-0f27671f0437", "value": "WIREUSD_47300TT.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1db2866-ba3a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762342224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342224, "uuid": "60622d4e-0090-4fab-b4f4-7e75aa4ac467", "comment": "Malware payload", "value": "3021455cf98d017b9ec3cbe7c7391504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342224, "uuid": "4e79d246-b82d-42d6-a21f-3c80060497bd", "comment": "Malware payload", "value": "2ade65c0f8a5cd699b7b964e1c0e25c723ee03d7bdc903c1d1d15321f6127325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342224, "uuid": "17670bd7-70c1-4712-ba7d-2fea120d8397", "comment": "Malware payload", "value": "d9a9e3f8a796bd952e18f0c74a99f2449ad7a92e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342224, "uuid": "1d220540-67b2-488f-85b9-6cde6a96e665", "comment": "Malware payload", "value": "8e7015bed0096884b678cb947eeb17972393164d44205b1947205cb4573f3777a45eb5a0855eb8dc1c8857f2fc5f3a93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342224, "uuid": "de6531ba-f2b9-4b11-a02b-1976c8a9d142", "value": "T127E533C20EAF7802F1BE1E352BA392E95D03BCA147D5425E7120B47E79DA1DD391E13A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342224, "uuid": "06081255-d0ec-46a8-8fc5-4461b2a94d7f", "value": "fdf7eb85406c6308fffec00e08549295", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342224, "uuid": "6c08e030-614c-43ab-8a92-5da694395eed", "value": "49152:IdFJPL0aXS2jN3FVeBe6Ts4ogCio+4f9V0lXlgV1fFTZz4fXwxr7wvnsb+Vpy/g0:ILjN1VmeEs4lstz4fXwEn2K40ApZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342224, "uuid": "55912451-f71a-4077-b362-fa3af2637b24", "value": 3285264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342224, "uuid": "34ad8c5e-d429-45a8-99ff-9169df48293f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342224, "uuid": "bcabb7fb-7388-4f1d-bd9f-a5a82f271a71", "value": "180\u51b0\u96ea\u661f\u738b\u5408\u51fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00cd034c-ba9c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762383963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383963, "uuid": "e72d2285-b834-454e-902d-896da9116aff", "comment": "Malware payload", "value": "9c2c8df4ea8223bb1611ce25984988d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383963, "uuid": "46b3ebc1-1f33-4953-ba13-93948fb4749a", "comment": "Malware payload", "value": "2b708addd75ec3ca541895cd2c417fc216e84b42ca96f785a6d2deeb3e59af5f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383963, "uuid": "3b30a4d1-abcc-4ad5-9186-4c7708527503", "comment": "Malware payload", "value": "83d73134ca97e26216a130135c353a9eca0dcaa6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383963, "uuid": "a69b8769-95b3-4650-862b-326a415e250e", "comment": "Malware payload", "value": "646751f93d7c608488344387fbbfac011c1d603af2a700829132110880a3892de676886deb88c1a9498ae06530276a3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762383963, "uuid": "fbc9ac33-718f-4915-a81b-99a250d3bbce", "value": "T147410344BE9619C880AFDDA26FE94063796BA90515CC818351FEDC130810ED3BF577E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762383963, "uuid": "46fdde7d-1329-4f5c-aeb2-490cbcbd338a", "value": "48:OoRviH9dMyEMtMvp/fSOS1pGBvWkL7ksExzhMaLXU4BMOKZUUJFTYXM2V:OoRvid+yEOMvp/fSOS/kL7ksExzKaLXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762383963, "uuid": "1ab4e253-b712-4f4f-ba51-dcbff9c89d45", "value": 1995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762383963, "uuid": "a4b614ee-911b-4170-a9ff-e0a6d66713cd", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762383963, "uuid": "4d3c5f8b-0a2c-417e-a439-c5e6cc01b9ae", "value": "IR-20251002-120251009175156.pdf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5137cf-ba4d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762350272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350272, "uuid": "087703e2-abdb-4f0c-9239-ae6478fa5d4c", "comment": "Malware payload (Rhadamanthys)", "value": "95b2e474cd9610fc140c857fa16e7842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350272, "uuid": "3a0101f3-54fe-4e5a-a9fc-415ebd3c9ce0", "comment": "Malware payload (Rhadamanthys)", "value": "2c57a124b322ae24bd805a694053e9ed1456c832149f3dbd44ccea92327cd552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350272, "uuid": "eddbbb9c-9aac-4f01-9b7c-58a584e7f83b", "comment": "Malware payload (Rhadamanthys)", "value": "3afd3be50bae46ffd3a6f98b5e69a5a945e067be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350272, "uuid": "4c98bdae-468f-48f7-ae92-c65e836cc580", "comment": "Malware payload (Rhadamanthys)", "value": "c9fab5548d39a1f4021e11a91541b348c75116dba195b645bb9ca8462b7e14c0fa66ae011630fb940d9ba8ddb3295e98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350272, "uuid": "272eea79-94e7-4b19-8a24-ae438b4f0f02", "value": "T1ACA52306A3E4C037DF622B3550F81B0735393EA02FB467E71B81B9966EB26C4347576A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350272, "uuid": "e85047ec-cbca-44a1-9e3c-cd45514ef48c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350272, "uuid": "5efa2d92-2138-47a3-958c-31658d70aa5b", "value": "49152:CCCtVGSVj1vdh2zWlhwSqTNotO9L7VE3W38TM8q6O35CdkTIV8u:hCtVGcjQ4hITNotML7O46k5CdkEVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762350272, "uuid": "77d39bd5-9e8b-49bb-8f10-26a5da8bb4a1", "value": 2134680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762350272, "uuid": "80c57b31-e564-4aa1-a47a-4e8a12e3d21a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350272, "uuid": "2bcbfdf3-b3bc-492e-b8dd-f99ededa74c9", "value": "project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313f2f1a-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376743, "uuid": "54f503cd-6db0-4b1d-8527-10c25c81a81c", "comment": "Malware payload (Mirai)", "value": "e04f3212b5991a12b445b35b210edecf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376743, "uuid": "40e6b683-3375-4d56-bad0-cd0bd96ccfac", "comment": "Malware payload (Mirai)", "value": "2ca8322ac811aead016ac4ed385ed6d6cc221b3ae8d7eafe2913a8ff839a33d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376743, "uuid": "371ab74f-4f2c-4596-8b09-db65ad8a661c", "comment": "Malware payload (Mirai)", "value": "dfcb4bd868fa5bd31f32376d131c70a422b00501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376743, "uuid": "473ba31b-1cba-41f5-a0aa-cd34824bdd3f", "comment": "Malware payload (Mirai)", "value": "cedf5302fcea7995e0ecd2f92fd94e57110e200f197672c0e0ca039f27070c1c0d43efb84972862e6f091084b4383b89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376743, "uuid": "1b692113-efec-4dea-879e-6840ffde429f", "value": "T17AC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376743, "uuid": "1d86c038-f046-478c-ad21-84d382087b08", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHonrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuInrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376743, "uuid": "723c5936-776c-4c03-9268-754e857b0278", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376743, "uuid": "29693e50-3431-45e9-b189-efc0e2b87966", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376743, "uuid": "3d9cba18-3ef2-4df8-a711-e1216f29e8dc", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcc5b37-ba45-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762346968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346968, "uuid": "04ceb2a7-fff6-4b31-89fe-b805bbd7edcb", "comment": "Malware payload (Rhadamanthys)", "value": "7e6c9bbfe069e4876e0cc48040893450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346968, "uuid": "3006b48d-e2a2-4808-8281-85fd11167948", "comment": "Malware payload (Rhadamanthys)", "value": "2e1ddb0efddef12d1fb7e7fc29fb8233a757a4d10a3fb0095ce82fa955720033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346968, "uuid": "0ef1f0d4-37f7-408b-984f-ba67410d0da9", "comment": "Malware payload (Rhadamanthys)", "value": "cc503120ac44e0d8c54c1a77f81b8af748ec466d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346968, "uuid": "dec79c61-86a4-4383-8770-78539e86d678", "comment": "Malware payload (Rhadamanthys)", "value": "673363aadab3d5ef8c0b5e01ffc9ecb197853f87029a26d3dab27231c52c4c3d36c514af3c02f1173091621d9fa9edab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346968, "uuid": "1f6f318d-f5b7-4790-8f2a-1d5e412f1c8b", "value": "T1A375231A73D16077E0A657788AF192A79730B0619FAE17AF6B80D4780E23EC0E975743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346968, "uuid": "4c174ea0-2cff-4aea-905f-e5856f3b977c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346968, "uuid": "b7773bd4-c771-45e2-b6c4-fa4ce1587799", "value": "49152:TjAUOXczzVEPblTgsiKXXHoDlgoUQQKUsknumMHQrmMw:A/UhWTL4DeoUQR+3MHsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762346968, "uuid": "80b9b928-acbb-4e15-aa79-ac389d97c4b6", "value": 1642496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762346968, "uuid": "1c89a413-6f7f-49c0-8b62-c8c1896059bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346968, "uuid": "51d6c552-f5b4-4331-a40d-a9a98710445c", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53712cc9-ba01-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762317530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317530, "uuid": "b15a2602-c66a-4c0f-8c87-c0fd67da8250", "comment": "Malware payload (Mirai)", "value": "adbff186932e59ed5f85008ae5127d1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317530, "uuid": "e02a3593-e764-4735-8006-5b40c259b692", "comment": "Malware payload (Mirai)", "value": "2e6fecefa3062d2306124e014643a14066981f4865dedbeffb8c1d057dc650b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317530, "uuid": "2c8a0eab-05d2-4b94-9372-e3dcf95c8446", "comment": "Malware payload (Mirai)", "value": "5a0cd31c2d6aa43db62e63525ae95131c4b684da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317530, "uuid": "348e59b8-0085-4cd2-be0c-44c355a2b26a", "comment": "Malware payload (Mirai)", "value": "8185df94b67878c2000b1f063182a11fe23e2f2c6a1b5345625431709dbc8badf24446ee40711cd460b84cad900880f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317530, "uuid": "8717b7d9-c67a-4d3f-8e27-7cf9c6c3379c", "value": "T1EBD47D59FF0E3C42D3DBE3389B4987A1622B75E4D32352727982421CD5D6AE8CFB1A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317530, "uuid": "7b156b95-3f42-4e19-9f9c-59eeef8797be", "value": "12288:lpMesKnOt0xiK0xKRaCcc+UhTn9wKVU7hyvviPs5TfJui3ah:3xsY2DCccphqkbfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762317530, "uuid": "e087b417-53c5-4297-bcea-5a73204e8809", "value": 641056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762317530, "uuid": "9d49f0c8-b2df-4ae5-938e-b4309063ab2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317530, "uuid": "50e4c0ed-b4b8-46f1-976e-bce886ed5267", "value": "Mddos.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6829c410-b9e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762307257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307257, "uuid": "28b9d1ee-c60b-4664-9636-5e317f492d44", "comment": "Malware payload (Mirai)", "value": "d48f71219f462a54a74f412da692d60b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307257, "uuid": "ad5fb7ec-2806-40a8-9a16-e4db04a22903", "comment": "Malware payload (Mirai)", "value": "2e7fc73709a8b94fd0917c73bf22dcb18fe4fafb111509cb0cd696d6d02720cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307257, "uuid": "30944625-2b4b-4a82-a78e-bc9fb859ec2b", "comment": "Malware payload (Mirai)", "value": "fad871e9b9aa473369adbd2f81e18808085d2f89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307257, "uuid": "62a7cc89-d291-47b7-b051-a4343cc78194", "comment": "Malware payload (Mirai)", "value": "5a1b610173d8468ea306d3ddc1f7a2fc81cf277167861138c7cfcb3f514cd218608e0c10b7d19a892d0a9c90fbcf4c09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307257, "uuid": "fd473f8a-c051-481a-9051-52e82e91dc69", "value": "T149432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307257, "uuid": "421542c2-3c3d-44b2-b0f6-d8df500cd611", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw0:RqtmZPuutfbltZFBSJsBcfDSTFI+BE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762307257, "uuid": "b37233ba-37c2-4c8e-9d76-2899de277375", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762307257, "uuid": "56546922-ed45-4c11-84b0-ccfc191eb463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307257, "uuid": "967d763f-0110-4d2d-b650-c495216d0ed7", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb9a741-ba6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762362990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362990, "uuid": "71c272c3-4c0a-49cc-8a8f-12e7c85a68a0", "comment": "Malware payload (Mirai)", "value": "cde17436f7d0e0e08b2a008d2170c440", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362990, "uuid": "87531f42-34d6-4192-b304-0fef4923d4f7", "comment": "Malware payload (Mirai)", "value": "2fb27769abe4a38ac26b7940983ac94b180d769c0f3a442ada21e57b4c4377ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362990, "uuid": "0891f55e-fe6d-454d-a211-ea0006473d53", "comment": "Malware payload (Mirai)", "value": "659032adb98c13e1a693a1434a577c2764b1816a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362990, "uuid": "a9076d67-d771-4446-b942-5eeef3147917", "comment": "Malware payload (Mirai)", "value": "65da943b2e747ed98f2d989f2a4a1cd90b1ad56a74af480fca5dcd5dc8aa52149f060779940893731f82140d10a18cc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362990, "uuid": "5621b437-bfda-455b-82cb-ebeb64f63a97", "value": "T1B2D47D59FE4E3C42D3D7E3389B4A83A1722B75E4D32352B27941520CD8D6AE9CFB1A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362990, "uuid": "e2d523a4-3488-48a6-bd4a-f6e81ecbfe14", "value": "12288:4YlqoyLBMtNSj8uO99D0TlMOb8VoAIdzR7qPs5RfJq3Ni:4EqoyJApD0TlMG8WXH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762362990, "uuid": "05489d50-6972-4da1-bbbb-23f61452cf63", "value": 645376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762362990, "uuid": "538f3b6d-d302-4ba6-b99a-50b2febb291d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362990, "uuid": "6680dc77-923b-45f7-8833-58bc36f68e00", "value": "Mddos.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098e03f1-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319983, "uuid": "4488066b-c8f2-4e5b-a308-979f664991a2", "comment": "Malware payload (Gafgyt)", "value": "15b0f3b8df8edc79a2b88b8e45794968", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319983, "uuid": "be204203-ba0f-4c29-920a-478c72ac58be", "comment": "Malware payload (Gafgyt)", "value": "30f203a23d5041314bb6569ac4fbc8ae968ed4aef3037696fc4c724384d10be1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319983, "uuid": "8c80d534-5d05-451b-81bb-2d006ac27595", "comment": "Malware payload (Gafgyt)", "value": "f9596c6284260b168bfbb5dd636f3b8bb010ad61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319983, "uuid": "efe20877-1a98-4fde-adfb-b8dbdd8681c1", "comment": "Malware payload (Gafgyt)", "value": "a1f8cc24346d6ac28b33adb87e05135fadcbff6e90e3119bbddd7509813e0d8d849c964437f6bf48f0dc9d0d776e9f2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319983, "uuid": "7d553e93-fe87-4d47-82bd-e10298ab2375", "value": "T18DA3F9F9F303C6B3C40301F2135EEA775E22B2FB5469A58AE3652D60EA734D22951F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319983, "uuid": "25f66ea0-8347-4822-8e8d-100406474c62", "value": "1536:hF7AKf9pT5fFhI+rGAii4V0gWFsHvMU78uD7d15hS7fG:gKf9bFhPrGAibAqHvMU78CX5hR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319983, "uuid": "a979b6cf-ee4e-42c7-83cd-5af418cda218", "value": 107304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319983, "uuid": "fd770fb7-aa44-4631-ad09-6d0f43685524", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319983, "uuid": "39ad5eb5-3dc8-4617-8a48-139263b71999", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74617146-ba49-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762348509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348509, "uuid": "02264e51-7804-400e-a7a6-0f209fe7534f", "comment": "Malware payload (Rhadamanthys)", "value": "f1d8fd0981921ff7f6142a5fca1bd85d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348509, "uuid": "df756c2d-3b5f-4c9d-aaf2-befad6330c0b", "comment": "Malware payload (Rhadamanthys)", "value": "312275c534c0e6c70aa7b116d6f011df1a2f01ab68eb5fa84ea047ac4b634708", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348509, "uuid": "37f0503d-70b7-43cb-82d4-512ee51a1bf6", "comment": "Malware payload (Rhadamanthys)", "value": "e9f6b9c5e02139228d4c558b8852dde34c31b84b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348509, "uuid": "2d939efb-8945-44d4-bbb3-72ff059a4fae", "comment": "Malware payload (Rhadamanthys)", "value": "fd70d9a8a2563814cbdb765d70ee35818b80248af073a9dc859f16a7ad7172572f4044ac41e3dba231352a05f4c14a46", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348509, "uuid": "251673fa-cb6b-4d87-87fd-c3bde852f5b7", "value": "T156A5331782EC9833EC7B1B7074F553432E39BEA01B74828B2259D9894672BC95E7274F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348509, "uuid": "050c5a65-2504-4ff6-a183-e948db63a5c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348509, "uuid": "362427ee-8b2b-4e54-9274-0b5c6c3cdeb0", "value": "49152:4IoprFkfl89i6bLoyg7K4rPW0HU+JRoQY/DBAX:cXkfl1WDgtPW0HPop9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348509, "uuid": "f89f0659-1964-4cd5-9e7a-d0ed1ce18d8e", "value": 2189200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348509, "uuid": "536b96f7-b5a2-44c9-842a-972b90ac9b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348509, "uuid": "f166be00-7980-47ae-af8a-181831cec947", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72fd550-ba66-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762361077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361077, "uuid": "87c3a2f0-af44-462d-85d3-117f72ad9cd8", "comment": "Malware payload", "value": "8c7cf407f058a42a0b7c98a960a7b2b1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361077, "uuid": "7c28d5a5-1f12-4f50-b751-8f41388332e6", "comment": "Malware payload", "value": "31d5415b69274dbdcca1e80d57d649b9c643b6fc028d0af383f5040375a45870", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361077, "uuid": "4ea69b67-cc32-4fd5-b73b-7af94a44e3c1", "comment": "Malware payload", "value": "2cf0fed5610fb465e5b8097572c087c72ed9f9e8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361077, "uuid": "9295e87c-56d7-4ad3-9dd7-508172c11c6e", "comment": "Malware payload", "value": "6281c093001cc02f2501d1887d55becee0ab6f3ef380ee972d73d5879cb78f6a300d257aa291484cf293c7406316e6cb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361077, "uuid": "0ed263ee-f910-4244-8c89-be5b4bf31e45", "value": "T1AE15CE79F6646993870733A0FA339AB50F073EADF1321964A160450B5E5D3C2BFCA5AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361077, "uuid": "f6ee4ae7-75d5-49ac-97b8-4e825e517bd0", "value": "12288:4SUaiFBsqSCmO8NP1hULXOiQbWTAgRuY6otxVnEkzEaV+7QQsyjANJvWpFfeEq:2aQBFfENhhUAWuY6GKIEtHjANJvmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762361077, "uuid": "91966a7c-4419-43ad-9c76-ddb7798651b7", "value": 908773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762361077, "uuid": "4c9512f2-730d-421a-b2a5-894a792593c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361077, "uuid": "3a66764e-6f48-440d-a08f-273cf8726fb0", "value": "NIM-2B-193007-EP.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3ed131-ba30-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762337706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337706, "uuid": "da2d82e7-2360-4d4e-a7e1-324c12fcab7a", "comment": "Malware payload", "value": "49bd706f689f1067fb5de679cd8acc4e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337706, "uuid": "e9404c3d-b7dc-4ca8-9a3b-94e56b5015a6", "comment": "Malware payload", "value": "33166eb79737407d15fd23d5644c3bc544ae4a63604712eefa72fb8d989cb3b5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337706, "uuid": "5a6d5fd3-5cf6-47d4-ac9a-b8e2efde5834", "comment": "Malware payload", "value": "e900d34e86663e2f6b0b49c02dc183e0ed450c98", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337706, "uuid": "84ddb7a7-7858-4bc5-bbd8-c9c9a2c7b4eb", "comment": "Malware payload", "value": "fd67dd60351f32811ccdf8daedd6c71d911aaadc4a914a744121c00ef67f3e834589d2d56afaf3f6f8783d95a80f11c0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337706, "uuid": "8cde72aa-f17d-481e-b5ce-1f4e375262e4", "value": "T1C786338052F5F9E3871326E0837CF26150ED9E1FEBB36504E46A8A05F47A8F8067F599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337706, "uuid": "eb5933f2-c730-4c2c-a33a-26cfbcece7de", "value": "196608:EV46s93CGhH8uGY8+iDdLQWfd9HI2eQMy/1EGh59tY:lCGpT8+i5LvFRI0My9EGtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337706, "uuid": "caad0306-ffb6-46ef-8379-9472dc4503f5", "value": 8395693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337706, "uuid": "99e84295-965d-49c9-ae0d-6007e447cf8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337706, "uuid": "5fe9b1b8-516e-4b1e-864c-d14f0772fb01", "value": "49bd706f689f1067fb5de679cd8acc4e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03abef88-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319544, "uuid": "eb4e988e-55ee-4371-894f-86d49ffc2c6f", "comment": "Malware payload (Mirai)", "value": "986083c5390087c7eab10a448218c67d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319544, "uuid": "d15255a9-d6c9-4dc4-9fa8-1fbd6948ef0a", "comment": "Malware payload (Mirai)", "value": "33a213833dabfeb04b6331a668f9953363776d1e045eec6425ccb05a93f14c6d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319544, "uuid": "bdc8fffa-cd89-4d3f-b716-78b52a898d77", "comment": "Malware payload (Mirai)", "value": "cabd1a60a12c1450c549265836ac767510a496ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319544, "uuid": "37ccb076-4025-4b46-9839-fed8b939ff04", "comment": "Malware payload (Mirai)", "value": "4a2bde4afd86539566d45bf0df3276b6e64570679d7b6ff49fe50d26a93f89560e8968f18b6c91679d00204b44d00b94", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319544, "uuid": "485f87a1-9ffc-48b2-b563-645934db9671", "value": "T1B601EDCE276D50A79B289EC8F06EC218669CDBC0B1B30951E3149872D4EC2017864B6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319544, "uuid": "65bd8648-2a3f-4417-8d84-2faafdd9d7b2", "value": "12:3J3N1jxN3qxNhNIl5zAxNq0LKjxXtaKAx3/2SExzCx5xdjx/JiAx/TfAx1iAUn:3J3N1/3+hNI7cxKdtBu/2ZaJLzY2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319544, "uuid": "72d8e4b7-86eb-42e0-94ba-eb34e1725665", "value": 759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319544, "uuid": "be8a23d6-c73c-4707-aa2d-6d422100c74e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319544, "uuid": "0d59f72a-1216-482b-b094-e71394343b84", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a561f9d1-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316809, "uuid": "0c1e57e3-ef00-45ee-a186-cbeaab2a4ff2", "comment": "Malware payload (Mirai)", "value": "019f797ac34d50d375092d90db9ac8c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316809, "uuid": "06487e6b-c1e3-423e-95d0-fef31c4bf7c4", "comment": "Malware payload (Mirai)", "value": "33a3c17ffc96cc6e3a23060e964b50cf2ab5cbba8a8e56ac8f075f0f16f08144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316809, "uuid": "58b02085-c2b2-4406-99f5-cb1ed1a93dfb", "comment": "Malware payload (Mirai)", "value": "ea44600790d310465fea98e8dfcf2c53424fb73c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316809, "uuid": "656b47b5-40d5-49ab-902d-8c7bf1c6376f", "comment": "Malware payload (Mirai)", "value": "8f984b237a933ba9d4e4523e4279629cc557637775e03cb27ea21e2de87ccfaa2fda44d11f94e1c1bc0508ea48ed3eb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316809, "uuid": "2a2185a9-ab9d-4ffb-9158-62e416f0f4e0", "value": "T135335A22A8791E1BC0D0F87A62F78729B2F50B0F25A88B1E7D620F4EFF215D0555B1B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316809, "uuid": "8b6de026-0c96-43ca-a5ef-241a5476a8ac", "value": "768:g+oSy7lGvzbq9Ghc1SuA+/5DugQk71squLXuO+hhQSfF29:g+IlGvvSGhcQuA+/5DVP712chu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316809, "uuid": "4d37c54f-d47f-48da-8e70-b34e4e525b33", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316809, "uuid": "f3107545-35d6-4229-82a7-e1f5a510b33c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316809, "uuid": "f49e36cc-e4af-4545-8b7c-1e3832b5b88f", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef96b350-ba12-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762325094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325094, "uuid": "0473942d-d3ca-43a2-910c-c7ae3722cdc2", "comment": "Malware payload (AgentTesla)", "value": "1c036a301cc0595143d1bfbcee079785", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325094, "uuid": "3052599c-0359-4117-9a46-d4a2ef881f98", "comment": "Malware payload (AgentTesla)", "value": "346049fd5522119bc6bf5b8198752725334a40c36d58906a4d7f8455214ead40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325094, "uuid": "38505934-06f2-4c65-a96d-f02b4ec74912", "comment": "Malware payload (AgentTesla)", "value": "d555bffd7f3c9d98078db69937f5e2cd685fd214", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325094, "uuid": "0a552801-bfe8-4535-b6b0-e9ddfe55ffc5", "comment": "Malware payload (AgentTesla)", "value": "b7acc1e259530212fd2351e1a5f7254ad881454040c53d39b911add5f76ce963eb2eb7cb7493967293dc0556dc001262", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325094, "uuid": "0d3c3c44-8871-45ac-a8c1-913eebdf28bb", "value": "T1A7D423A9F310A826D6D8543F8E681070DA92342A375D3B118E3775016FA476CE5AFE3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325094, "uuid": "a572430e-3e36-4e66-9cd8-13d0528a319b", "value": "12288:DakqGUeXOyGd6EnJhhrUvAyvrx2cP4enxLPgEe4cmrBr4OS:BqGVXlGdl9yAslZTRP1e4RrWOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325094, "uuid": "3d8e5d8e-f1ad-4c7c-aa8e-f5c033b7b1fd", "value": 620908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325094, "uuid": "289b7540-68b2-44ad-bc55-45bb7a71d097", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325094, "uuid": "d9de6222-d48a-4328-b7c2-fac37facc482", "value": "346049fd5522119bc6bf5b8198752725334a40c36d58906a4d7f8455214ead40.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab25f8b-ba51-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762351902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351902, "uuid": "22fb80ff-3ab3-47d6-a0b9-5a3effa29f5c", "comment": "Malware payload", "value": "53841ff89dafc9999b320a4df73396d5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351902, "uuid": "2f8ffce5-7b55-4fd1-b70c-072469b29168", "comment": "Malware payload", "value": "3480347f03544f35c32d7e78b8d366661a718ef340d0aa01bc9f0421c230cf97", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351902, "uuid": "235de72d-10b0-40a9-a226-fc523693cef3", "comment": "Malware payload", "value": "500240927156059c7e68198e229e71af9d85d6a0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351902, "uuid": "58cc6272-241c-4972-b06b-28456f9b25c8", "comment": "Malware payload", "value": "4802b85b11fdc15768117b04be7f516d73ab2aae17c91d808be7a524a1f9a388c5b2fb0698bd81492627fa0122b67b04", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762351902, "uuid": "9b135ab1-1194-4137-9a5c-a5fb513a81a7", "value": "T1E296AD79BD141CE6D6AF12BBC95B99C923B539614F53A6CB8590B7C20E333B6DE32400", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762351902, "uuid": "f26f8bb3-05ef-42e2-849b-d6d8d9627c47", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762351902, "uuid": "133e9b35-b70a-4cd1-b3d6-7bb9cfe680a4", "value": "24576:Wem2xh9fbYLwhmAlAzs3GHl0fBWnItt+DKGkGeej6I44bFW5lc7kWspuPUQydra4:Wem2b9f8LEjAll08IaqSjN7Loz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762351902, "uuid": "3952f0ee-339e-47cd-ad33-cd9488e5c18b", "value": 9309184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762351902, "uuid": "09ab1c9d-2052-4edb-a904-2789a0369e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762351902, "uuid": "cce70cae-3456-4698-b229-278d6530a664", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3bd575-ba51-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762352124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352124, "uuid": "32ce30d2-e34b-4500-8e9e-a6ae4d9cfb18", "comment": "Malware payload (PureLogsStealer)", "value": "a10f25081e9263a7275539fb95c69ce6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352124, "uuid": "d15c96bf-1cd7-41be-ba43-23cca3cf63cd", "comment": "Malware payload (PureLogsStealer)", "value": "35ce86f7b1671591135bc31143c7625ae6c3dbc3864cc8877640cc8cd9d12102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352124, "uuid": "e58a13c0-ff89-4f52-84e4-2416c9b97a9d", "comment": "Malware payload (PureLogsStealer)", "value": "2c4246e193251466f13b89576614c170a3761ac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352124, "uuid": "166e3f91-1a5f-4c79-9f68-5409b2183797", "comment": "Malware payload (PureLogsStealer)", "value": "814144ba6eaf0886fd18f22fcf96c48eadd4e6efc1c99211cd3e9f40c0ad6d79f5dd35d909e43c6774b0df27965f498b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352124, "uuid": "40300bac-a889-4b69-b5c5-3b868ecea5ac", "value": "T1CB5533A664E35371EA8913FD01AEF04F767C766FC89C95312324B32496CC99A436336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352124, "uuid": "71546902-9144-4291-b6f7-4f77d7aec9be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352124, "uuid": "be68e191-67ab-48f4-ae3e-8d2f3bd8fc59", "value": "24576:5K+runwFr78hEOMgpAzaFyLH/EKrguBgJtG7Sr6626NNefJ/bylHa3irTq:5K+kY0hEbgpAzaFY8Kr+JU2r62eBSHa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762352124, "uuid": "ec275bdb-0ac6-417c-aa69-1fecf28b299a", "value": 1403392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762352124, "uuid": "207efa2f-1fb3-482a-a022-5d6f965322f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352124, "uuid": "7f8d5bd3-b653-4dbc-b71b-6f3ff4e9a0cc", "value": "8461095400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f0120f-ba48-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762348034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348034, "uuid": "4dc37582-afa8-46f0-a604-25c374b95fbc", "comment": "Malware payload (DonutLoader)", "value": "0aabef02109c780e4004da44b11201e6", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348034, "uuid": "635f843d-6acd-41db-a8df-790809e5fca1", "comment": "Malware payload (DonutLoader)", "value": "377641496c57755d66598921f51011e5a3ab9293c9ff4179faec252fd2a01188", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348034, "uuid": "65bf9a4f-4e8d-4521-88ec-3d5eee6828af", "comment": "Malware payload (DonutLoader)", "value": "74d92b1569631b427eee11df3d07a8985c36c81e", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348034, "uuid": "2390a77a-b5a6-4701-a984-896bf1f4dbef", "comment": "Malware payload (DonutLoader)", "value": "1736bf41329b5a53d55df0cffab94047554b8e139c7b0c48f4481ec6968927421e2d0a7910d50e09db8ebc38c3141738", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348034, "uuid": "6091338e-1228-41b3-9860-df8f47443f12", "value": "T1F234AE5B73A530F8E177C13989910A46E7B278350B619BDF07A047BA1F276E08D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348034, "uuid": "787a597a-fa54-4493-9236-69eb3c91a126", "value": "23aa6ede111f6ac860a5e9008f9b9673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348034, "uuid": "1212a2ee-28ac-47f2-8ae5-c68fae0174d0", "value": "6144:uUluiEA00dmNOlmBDJ4SHKuLWru9d+FugVEsZjAZf:1cNJ4x8WrisOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348034, "uuid": "eddbd7c2-5bf6-44a8-b1cc-a7370a4048da", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348034, "uuid": "9e4a7fc0-0936-43e1-8bee-b88e9a25ce74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348034, "uuid": "fbf9b596-3384-47fa-aa84-15e3eb40624e", "value": "Maxonic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a767413d-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316812, "uuid": "d2aac0e8-7c1a-40e0-9e87-b64c9bba095c", "comment": "Malware payload (Mirai)", "value": "5e5e1ec0def99e09cdeb670c1c871fa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316812, "uuid": "c11575b1-a31b-4015-83e2-149b522c7c51", "comment": "Malware payload (Mirai)", "value": "37c34312ae1fac55f430632d1b19d1b2a0473b0f34475b3c04fe0cd91af9a6c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316812, "uuid": "cff7e68c-a966-4e17-8098-ab56bbcc9738", "comment": "Malware payload (Mirai)", "value": "a8e5e35ea7f82ffea1319b8744b5acd589adc8c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316812, "uuid": "721e8fa0-4d5a-4ba0-b0ff-ad803e94c248", "comment": "Malware payload (Mirai)", "value": "f3b2bf4bcad83607efba455d3dfeb75669b64caae559385277fc51e11bd4e32f3b04e2d3932b77c5f0203e19ae12b739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316812, "uuid": "8a9527d3-6eca-429c-be26-263e426bf4a8", "value": "T12A84E11AF24F3D83C9D7D835158AC2419796E89B33F393063B46A57B382927B8F28745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316812, "uuid": "6dfc9a04-7bcb-4694-a11f-8ffc808dc706", "value": "6144:MftFMb6PaGN694LIhwH2HIYggQK3ba8J++NemSWhmcvjK58prZR7:Mfe86eLLOZghK3jrPRmcvjI8prZR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316812, "uuid": "3cf7dfee-bed7-4e15-bb4b-43a71e18d723", "value": 399344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316812, "uuid": "d148555d-4bc6-4d62-9242-c17c159193e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316812, "uuid": "11812a0e-66fb-404a-9136-4c35f2494298", "value": "mirai.gnueabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dca023f-ba21-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1762331291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331291, "uuid": "4f47dd4f-6861-4ce0-b525-1db0611c5c2d", "comment": "Malware payload (VIPKeylogger)", "value": "3b30d347faffb56e219f5987352ae4ba", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331291, "uuid": "8fefb527-e048-4bd5-a9a6-1effa203d529", "comment": "Malware payload (VIPKeylogger)", "value": "37d3d1d69878c638d60442ad55c086a6e03204fcd8668c995b5be40ebf10c334", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331291, "uuid": "a7729daa-6a9c-4d7c-ae84-c64b3478e462", "comment": "Malware payload (VIPKeylogger)", "value": "506d37ea2f5609bec62d826230662edb0d262060", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331291, "uuid": "c6c74d6b-b81d-4476-9a7a-c4f1fc13f7ec", "comment": "Malware payload (VIPKeylogger)", "value": "5f4aed2969348ea1ba6dd410ed5123985c8821ae2e0a22602945a31f7836135127e1d7164878a3e13de31c39ce241469", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331291, "uuid": "78955046-0709-4c2d-99c5-005de0a8f3f7", "value": "T15F13F1F38D2C6E1CA84A975D40DE9EC44CF655F2784EC21E6A77480CC01979BA23E69F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331291, "uuid": "d2552153-4d1b-4598-a31c-7239d28d20ea", "value": "768:UtZYeWJY9+65ran7lbYyxhiNW1wmQdiIQCQQlJSxjhrehrOmtSAwMBD2TztKkV1r:UtqeWehGVPxhienOQGJCjhrua8SALDcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331291, "uuid": "7a173dc1-544f-4a0a-92c3-3fe89381f5fe", "value": 44897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331291, "uuid": "21cdd46b-e247-4ebd-9020-151dcaa42fe7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331291, "uuid": "58a85353-a2a9-42d2-9284-042571061cde", "value": "Purchase order_(P.O_T4787074)_KRONOSPAN APS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920bc0d1-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318494, "uuid": "08fdcacb-8ca6-4f20-b109-dfaebdfd3117", "comment": "Malware payload (Mirai)", "value": "03ebdfb5134192e2c42ec2e8989617e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318494, "uuid": "45e46dfb-2b84-4997-a023-0933acaab9ab", "comment": "Malware payload (Mirai)", "value": "381f2f47066415f088849a9b8fc24b46ff0b0540be64956c776e84d050d4f4b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318494, "uuid": "dd315dba-d629-46cc-8dc2-cbbcda0ece0e", "comment": "Malware payload (Mirai)", "value": "47f77bb891c87fc41d37e241446bc49adebeefa2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318494, "uuid": "2e5db50c-0f42-401d-9dc7-bb6c18ddadf1", "comment": "Malware payload (Mirai)", "value": "e04081ccb4752e7ac94cd700bae7e301d557a001a993ba72ac3ec5fcee0eda91a5ee89dccb8e7c7a1c043ef2886137ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318494, "uuid": "907b87f1-1519-4d48-9686-b90d0bf83af7", "value": "T13C03F18E56E10093FF8D3D39E57085A6789AA1C4FD2AA1702E10AC5D29FE6235FF3506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318494, "uuid": "e3191b6c-f974-4041-8dbb-58fbe0e4878c", "value": "768:UEpv8iBNVuC6jYlhHFXNECADT/yzK+YJGvhFU63xdZn:UEF8gNVp6j+PAP/yzKjGvhFX/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318494, "uuid": "2e2da6fb-b98c-43d8-afd3-b311dcd23143", "value": 40972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318494, "uuid": "98182fbd-2b83-469e-ba06-297c45b90440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318494, "uuid": "1a2817b9-d7f6-461c-b264-8c9b13a90ee8", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cf53cf-b9ea-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762307896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307896, "uuid": "7138bda3-d071-44d4-ae98-482d1ef06e92", "comment": "Malware payload", "value": "6b41f820f44529d44184d64badf8f438", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307896, "uuid": "5e00dc64-1960-4ea2-b64d-974db45ca108", "comment": "Malware payload", "value": "383a29a672893ac0a188dda994fbe1d155a81270242b4f569882f8ec3dfa5608", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307896, "uuid": "e543b36e-1258-4627-8ea9-7bcd0933b454", "comment": "Malware payload", "value": "ea98d8dc8b1284b14a2e18359eb5cbe0dffd1c04", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307896, "uuid": "bc495859-e1e1-40f7-af4e-0fc508779b6c", "comment": "Malware payload", "value": "69a1b87815842cac560380d4b3e3853beb51b811fecf1434eeef377e2570456fd748a3a0eb468ccf7333f5ebe95c590d", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307896, "uuid": "730ec9ab-f653-41a5-8398-c96b317e9c6f", "value": "T1D0F2596E0BE400F8DA9692F9CDB62957D7B1B0421EF05A8F4172D4C68F62ED3ED2D640", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307896, "uuid": "8a15924b-9662-468c-8d87-48b6e53d45c1", "value": "189cf46cc0b732f98586c68880e04cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307896, "uuid": "68ef786f-7fc3-4cd2-b245-dd278c0d2bd5", "value": "768:ANZfmeDdkjAzQRDrgGRp2RX3dNTG+XKzJ3Va0H67b36EtxM/u3:i3DyDRDrgGRQHdg3g6EtxMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762307896, "uuid": "4d06cec4-878e-4ab0-9f3e-a2d2b195c672", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762307896, "uuid": "f2dc6657-d1f0-4bb0-877d-d8cca636224d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307896, "uuid": "9dac5990-4ddc-4293-83be-d4dfec145dc5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bed8fbe-ba3c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762342804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342804, "uuid": "56299654-95fa-4208-8aea-45d19bbcd4fb", "comment": "Malware payload (Rhadamanthys)", "value": "47f3879f0e94a7165dae21e0438eac5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342804, "uuid": "0b7916ed-81a5-4a74-8679-2647e6035717", "comment": "Malware payload (Rhadamanthys)", "value": "390541226b54f5365b3e9f0cc115cc050be5d269d8ad5973ef48871300c0babb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342804, "uuid": "853d6e23-66b2-41ff-a4f1-e80220d15924", "comment": "Malware payload (Rhadamanthys)", "value": "0ab104ac65c3f304f2046ae7b5e2856323adc04b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342804, "uuid": "72c6869c-5e2b-4646-9049-2b32f609f4bb", "comment": "Malware payload (Rhadamanthys)", "value": "b4492a36cfc3f2aa4bb24ad6d031b22785db45771b53c94b85ce64d2d6ca1fc2e3c8c5aaca07632aae8951b4a9fd2527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342804, "uuid": "3ac7d58c-d122-4634-9796-bb2780719c24", "value": "T1FFE423FDC546DA88E41ECBF2B504F5EF96EC903E03D04E47F19D8F6A2A294272934856", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342804, "uuid": "f4337218-9c38-4207-a3b8-93a27dcc4c6d", "value": "af83b26e354bd634b6a8028b65c0a61f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342804, "uuid": "44ffc99d-718e-4a10-9b8f-982dc2531f2f", "value": "12288:T3I+xrVv8a4CqCHJ9Iu5C7kJ8ctS8QUiYemAxkoi2i3c5vCgj7F+KSJW1QVHNDei:0+9J83r2eOC7kJ8ctS/zi3c5vPjoa1ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342804, "uuid": "1a633582-1ff2-449f-a67e-714d3e37c7f5", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342804, "uuid": "df1487df-a734-4a3f-9d3f-4982da23e356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342804, "uuid": "d0821f1f-a01c-417f-bed7-e56c78b73177", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79644576-ba9b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762383736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383736, "uuid": "288f38d1-55a3-4b0b-abc9-c49cdf6825b6", "comment": "Malware payload", "value": "c6b16369ce79156d879c33359ecbe036", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383736, "uuid": "a554d21e-4cea-4810-b114-e3cde4f92a47", "comment": "Malware payload", "value": "390cfd939ca6f9da74e84f385ea1453b7496feb836bebd416bfd02d24df85708", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383736, "uuid": "9ba33603-a586-4ee6-a722-c850ad44b085", "comment": "Malware payload", "value": "0dd32579d42f98782751c184a9a1d66b46a8bdb7", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383736, "uuid": "ba9e4ad3-597a-484c-b6f4-a0f8f7968a98", "comment": "Malware payload", "value": "75f9e0518ae0de167af77234db185211f9d6649f1cb114205a9f7ff1c0f3d3c90c6d73c972c6c219ce2c7af6cd8b8a96", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762383736, "uuid": "368688e7-aaa8-4b45-98bb-214b8d6b0422", "value": "T1615412F61CE0ED3282E16E1B927C5FD6EB6D958C30623E892A3448E967405537D8237F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762383736, "uuid": "2a9ea8da-fef6-413f-9dc2-f511061ff325", "value": "6144:wgdqZtmfhnDf1EOUfi7oUcgdqZtmfhnDf1EOUfi7oUcgdqZtmfhnDf1EOUfi7oUz:wgQL8hnjzUfi7oUcgQL8hnjzUfi7oUcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762383736, "uuid": "2f52ddc4-53c9-4785-b7c2-d825fa1b8812", "value": 293853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762383736, "uuid": "60444d0b-f079-4c1e-bd3d-566f65c0d5e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762383736, "uuid": "9fe31230-ad0b-4702-be3d-fa96eccdd64e", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969d1134-ba55-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762353721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353721, "uuid": "7b40a27c-625b-46e7-b902-a48e993b7ca2", "comment": "Malware payload (Rhadamanthys)", "value": "b2ddf6fee2c2c5e462c776802536d37b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353721, "uuid": "ab7196bb-0364-4988-b086-e2758e9c95e8", "comment": "Malware payload (Rhadamanthys)", "value": "394dd7c084b569446416c16d5bb212dbd24c5cdc48dd9f066d687c9201e73b07", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353721, "uuid": "50f4f9a5-1f3a-47a4-b4cd-f11db1a945c5", "comment": "Malware payload (Rhadamanthys)", "value": "0ecfcb1455f3b2c3f9f871f0a3a60c4d3bd6375a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353721, "uuid": "c35db30c-d049-429f-9069-ad631d04a590", "comment": "Malware payload (Rhadamanthys)", "value": "2cb17ef3d17828e6dbb4d559315f03c8cd17eef86df7f4e7565791c53b62f0c1b48688cf6096c0a71e787db1aadc75b5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353721, "uuid": "e4b15144-a4d0-4f2d-bdce-decb5d3fd7d3", "value": "T147D633228FAD2EBD0B68972D307F5F2D2AE01F89808DFAD787D164C7126EB40555F468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353721, "uuid": "dee9f677-9681-4e1d-9a94-d850799bfe31", "value": "49152:nu4FmVZ1kZna5Lvs+i2mhDYRkqtKb4nbifREy8+NVxvTlr164BUx9lU5dwheqSvj:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762353721, "uuid": "647c5ac3-9481-4d61-97df-6607c99e3f99", "value": 13048439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762353721, "uuid": "ce7c33b9-1597-4326-a2ed-06952c7e43c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353721, "uuid": "806dd8c2-8058-460d-aafe-e09af18b0d6a", "value": "ltup.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5857eaa8-ba28-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762334289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334289, "uuid": "89a342b1-fa93-4136-8576-162cd59bb974", "comment": "Malware payload (DonutLoader)", "value": "35e3e75385a8d6cc2498667e98a91081", "object_relation": "md5", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334289, "uuid": "157c127c-b153-4600-9fa4-f331a5b3cda5", "comment": "Malware payload (DonutLoader)", "value": "3950a6cbb2aabaee0a76ab77f9fa66496f3e72d4a1565bffae2787820dacdf6d", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334289, "uuid": "5881f80f-b614-4ecf-81da-cbca22a54c25", "comment": "Malware payload (DonutLoader)", "value": "e04661fed39e4a77ff12878f9b1267c57de92d62", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334289, "uuid": "20b3b176-e347-4f3d-8526-719c50ea24fb", "comment": "Malware payload (DonutLoader)", "value": "45a8d928c49c3d914238b999c5a2023e75e4c7f82626de48990025a597f8019be1ce698c46a141cfcb7bb86b3f7e81f8", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334289, "uuid": "871358ab-c50b-4e7d-b2ad-f32f850140b5", "value": "T1B60833D25DF97D902231AAE1684EAC17BE032015762D5A72F63603C63082E1F6DF797E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334289, "uuid": "ffcc5771-acf5-4b3c-be35-295f2f0faa85", "value": "1572864:2KbTEjjRE0PXUDM/YksHWc4kmgr7Tztxpx11aJ:db4XG0PXUMYykmq7Tzv1UJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762334289, "uuid": "8a260163-b469-4de3-adc8-883bc4a784ad", "value": 79356063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762334289, "uuid": "ca65c28b-c262-4663-a6d8-6de4b5d19998", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334289, "uuid": "688deda8-bed5-4cc8-bc2c-4bf7f0008744", "value": "3950a6cbb2aabaee0a76ab77f9fa66496f3e72d4a1565bffae2787820dacdf6d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337d4f79-b9db-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1762301156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301156, "uuid": "13b68362-415f-41fb-808e-59b0923cdcce", "comment": "Malware payload (DarkCloud)", "value": "37c8269e339be5c440256d4adb187217", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301156, "uuid": "1e64c9b2-d28a-4245-ba36-7b441b4fc596", "comment": "Malware payload (DarkCloud)", "value": "39d894a43445e9c565e929ff4a83703c0db8e4b130aa0c40feb4fc1d836a4dc7", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301156, "uuid": "d115149c-83c3-4517-9107-2ba0496df4a7", "comment": "Malware payload (DarkCloud)", "value": "ff10a928f6eb00315ef904f70941e5099db0085b", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301156, "uuid": "7fc388f2-f743-4a97-97b4-98128d30e78f", "comment": "Malware payload (DarkCloud)", "value": "48f62162b1d0cdf0e945bd3a8897b4b44e958c60b5bc23006b71e3f4b6a4cbf8bd0270e4e716a3a6036bd3ca59c3fb61", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301156, "uuid": "6ab0b928-cd94-4542-a56f-ebd4f615c988", "value": "T1597217087FACC6A3C5BC56BC54A2038F1272D77BB492E74A5C8D9E5639173D028D22F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301156, "uuid": "437f129a-94c9-4176-a038-14515c4385f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301156, "uuid": "365fde25-4133-4993-a967-6bcd3868324d", "value": "384:yasWWEd+iEMqASMK4Gg1Vz7K2kOa0lsDoeIz:yknd+iuwzMDoe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762301156, "uuid": "e47c1fa9-c4da-4533-962e-fd56572f8f5b", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762301156, "uuid": "7c4f615c-c0e8-49e1-9f77-55a64fc0772d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301156, "uuid": "bffb6d25-6fc2-4842-831d-976ecd1c4d07", "value": "Factura modificada____53432324242331____pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27df7cb9-ba4b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762349240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349240, "uuid": "716e1e99-ebed-40d4-9eb6-203b6d8c9257", "comment": "Malware payload (Mirai)", "value": "2abf9b7a7779d29e08759b98b05acf7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349240, "uuid": "67628b7a-b461-4e85-aaf3-7bb401f4b3cb", "comment": "Malware payload (Mirai)", "value": "3a7c3aa5222c16d95ef5fb6b5299e76fe92b1aaab8531a5c7e3d5f79317c2588", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349240, "uuid": "f9658cda-44d6-4f16-af8e-7e532f0b988a", "comment": "Malware payload (Mirai)", "value": "d67315b66ced996b4145d6f90dbd5197099c37a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349240, "uuid": "5d85c91f-45ba-4fb5-ac2f-5b9f921ff920", "comment": "Malware payload (Mirai)", "value": "3bf875f09253219650af085fd45b4283cd4165dcdbf074ea140a84069145bc9978b877bd7fc748feeb109d000b8c51f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349240, "uuid": "14ff0bbe-3c36-4e98-b475-bc7a37da0667", "value": "T146255C5AF2B374FCC167C030436FDB62A835F46911226E7B26C4DA352D62DA01B29F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349240, "uuid": "158d923f-f6c6-482a-96d9-0f254f0fad37", "value": "24576:UXFbEB6nez/ghmWM/k30UVKc9VburN+quuMk:UF0/ghPM8kUVKcTurN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349240, "uuid": "12b059b4-ba92-4e6d-a9c3-88ce8c5bd35b", "value": 996416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349240, "uuid": "fed466a7-53a9-4962-acac-4af7b850b121", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349240, "uuid": "1540d437-1274-41bd-8679-d1f3eb3fda2c", "value": "Mddos.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846e8180-ba1b-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1762328779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762328779, "uuid": "7f2e10fc-f4a9-47b5-946f-00ecc1db530e", "comment": "Malware payload (SnakeKeylogger)", "value": "240ee2a123295e4680ba4b3a33b1a3ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762328779, "uuid": "c122a643-bf22-42f8-a033-9e6f6cb86fb8", "comment": "Malware payload (SnakeKeylogger)", "value": "3b58ece6a12f3fb6798bb73e6109decd2c8901962dc0db9d0cf22a13b87b21b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762328779, "uuid": "c86737a1-4b28-4446-b25d-d958196137c7", "comment": "Malware payload (SnakeKeylogger)", "value": "365cea2ce72f8cf376fa77dc4da66cc9f51860c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762328779, "uuid": "fa38b01b-4c60-4d5e-ae4f-c51d1b3e6996", "comment": "Malware payload (SnakeKeylogger)", "value": "56866d43d63a4b2004100a7e0054febe2b32f2b411ad5b2523b46ac2fca74cb718770019363e1fa9aac61bc85baf2072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762328779, "uuid": "88c7994e-d8bd-47f4-91a3-287610075268", "value": "T187E422672A58D313D4E19BF32EB2D67903B05E6D8592D38B8EFAEEDB34247125900353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762328779, "uuid": "3aa08d1b-e619-4c47-9c92-db4f94af83dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762328779, "uuid": "ba6a1730-b065-4135-97a7-d59892aca644", "value": "12288:0o2iNxeRPAZWuAvUZnvYVmDF1xmmr8lFjZrfmZ8O/OxTB09BBf:0o1b+SWuEBmDrroFj5fO8QYTi9Bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762328779, "uuid": "93c5c592-375c-4338-993e-8c22a485bf15", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762328779, "uuid": "cfff8709-3b0f-4d86-ba63-ef5d7717e5d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762328779, "uuid": "6b4caffc-48a4-4e35-b4d9-16ff81a3fc9d", "value": "factura.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bef0847-ba63-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762359555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359555, "uuid": "af3c0034-68be-4274-b092-1d86dcaa4818", "comment": "Malware payload", "value": "70e71de6a5d9ebc2fa77cf9081bd1f7c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359555, "uuid": "996e3343-2b8c-4a4a-afdd-7ed8abbb395e", "comment": "Malware payload", "value": "3baabf5d03f985d314b796a7b7addc1e47c5d2a66ff38500bd022b36a405c635", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359555, "uuid": "7f92cdb9-35c2-4435-9a42-d8f37bacb1fb", "comment": "Malware payload", "value": "56531f5f6c1981dba19b831904ac5cd6b7dafeae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359555, "uuid": "96f505f1-b35b-4f3b-be71-ce2fbd9aa755", "comment": "Malware payload", "value": "d659448f5c50ab52191fede807031236df30be1969699465a525123ca9bdf01dd95109414a9a0e25896d8489a410fafd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762359555, "uuid": "23b909a1-4ce6-436f-9f3f-4fce2deec40a", "value": "T1F4C08CA2453CC471627D0B6EB395E1F49942A8694BB03872D8188A90A1280740C8F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762359555, "uuid": "d599f5cf-d4a6-44ed-93c3-b28692c5a788", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfzuIIAGztUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfqIIFgebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762359555, "uuid": "9dde37c5-5e2f-45c1-9261-9f15cf311e65", "value": 169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762359555, "uuid": "55b3345b-08cc-45ba-be50-fb31aafae301", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762359555, "uuid": "49226d04-1ea9-46ad-90db-9c7a5495c008", "value": "a0euyu1n6a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ce3fe6-ba21-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762331300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331300, "uuid": "7d8b439b-21d8-4316-8ab8-f558f6b5b0eb", "comment": "Malware payload (RemcosRAT)", "value": "940d5c07121ac7603038bd84156dcacb", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331300, "uuid": "13e96590-91f1-456b-b9f0-252935893ad3", "comment": "Malware payload (RemcosRAT)", "value": "3c1544e55b582b25bac23ad483a641de6d016bb2db9ec956757e4afb93197f28", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331300, "uuid": "96293cd6-1dc0-4edf-95d5-1485c673d362", "comment": "Malware payload (RemcosRAT)", "value": "318660d388b49da18ed97bb2fd4a4aec6b84e5a7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331300, "uuid": "a6c79d06-9036-47bc-93b9-ca66cfd99a23", "comment": "Malware payload (RemcosRAT)", "value": "74ef9e8884497a31f43dab7ce9d8234bc839ecf8828c926098a6c1257c2b727a546da87a99e02eb01dabb6bfb290b4b9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331300, "uuid": "ec3686d6-8dbf-4898-828f-57f52eccab02", "value": "T137F423A7244D6191AC8099ED27FCF68707FC4C1E3C8EBEDF658A8129A57E758E00359C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331300, "uuid": "8341e822-61a8-460a-b9bf-5f9c6e391f7b", "value": "12288:gD3yCtl5nQdhDLYL6OzC7CFTqq4n5y9grcdhpTJex0hi16xqeJQ3:kT5GKL7LBwnY9gIox6xrQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331300, "uuid": "d65f92de-4082-4149-a203-a98863912dba", "value": 724268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331300, "uuid": "3bdc9368-0405-4e02-bd2c-e6986c4ebe45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331300, "uuid": "d3d7bfd5-36ee-4f89-ba15-1bd5378bf63a", "value": "Commission Policy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1544229-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318627, "uuid": "39275957-e941-47b1-83a4-885de5c7c59e", "comment": "Malware payload (Mirai)", "value": "71c9134b2677f8f89c2ff5035f520dc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318627, "uuid": "af65fe45-c76c-4b28-9239-7a26c73b59e2", "comment": "Malware payload (Mirai)", "value": "3d0df7f8c3c94f7f9ff9b1816cd6085324fba8891eb7710e9813e617bc54ec26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318627, "uuid": "634e2dfa-df15-4f10-bf98-dee2ddb450c4", "comment": "Malware payload (Mirai)", "value": "7db1bd4b18f89b96b32a66e2a510f7263a7ba500", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318627, "uuid": "6fa99e22-ffec-4a3c-8c12-7d828a9bc2f0", "comment": "Malware payload (Mirai)", "value": "116ae5e3ff87f3b0dc558e562c7975a0c73d2b229d2f728d1418ef9a8601ab892b843c8c2ad61488fa1ae974ddd1e33e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318627, "uuid": "1365e639-c4d9-4c8c-880c-6a2ce213fa94", "value": "T13CC39D32D8396DC4C1945434F8B1EE711FA1A5C441A25EBB1AD5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318627, "uuid": "b2ae3754-7c3f-4130-9023-8dcbf6ffdeb9", "value": "1536:6aZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKZYkYaXgDe6u8KSgnMwSMwm9rFHwh:6f5Z5Z98XdmVMJakaXvbjSqSMrHQwEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318627, "uuid": "759d1657-8d0c-4c60-80a9-a4bb9ce8a86a", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318627, "uuid": "618699cb-0bd9-45eb-903b-5a6e635f1618", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318627, "uuid": "8c6743b9-e6e5-4236-ad16-bde2f28c7842", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b9ecda-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316811, "uuid": "7e0f820a-bf13-498e-b1a2-106b025c93b2", "comment": "Malware payload (Mirai)", "value": "fd6b6fd46a861649d30541056f5ec677", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316811, "uuid": "88270e6e-615b-4efe-b5d7-566d9ac7ffd5", "comment": "Malware payload (Mirai)", "value": "3d3b6fd3f50a21695b969bf76e3e438617f8aa786d258364efd3ca8248a7b29e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316811, "uuid": "3008848b-9afe-4886-b52d-a12aa34a550a", "comment": "Malware payload (Mirai)", "value": "22835b4a20e5c96c6c4de9abbf304a95cce25049", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316811, "uuid": "d4fc8c07-7638-4075-97a4-6fc3a57ad218", "comment": "Malware payload (Mirai)", "value": "d839344b7dff2ebafa51e8db4de00b4340f5d83f6ddf84d056e3e9b5f7cb73118b899fb3a7ab3f13e586aa205adc64b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316811, "uuid": "4cb072ac-6a98-4d75-a01c-cf9130ea8259", "value": "T10F230852BC828A56C6D42376FA6E118E3322B3E9D1DF7267CC205B013AC991F4D77B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316811, "uuid": "cadd7e2d-4731-4b1a-9e83-2aece2bfcbca", "value": "768:9bf1CAITb1lI4z8g8IgrgEVm9YrLOHsXBuepi0eRqh1V+6og+cNiBNIE9w:hYAITvBbHgJLOWB9pi0eRuP+1wM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316811, "uuid": "1184b163-1d77-400c-8666-f0bad09efe36", "value": 46320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316811, "uuid": "59c8b211-0015-4d81-bb57-24b9d8c1f3bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316811, "uuid": "2bdaf5e4-9632-430b-a863-885af7cf93c6", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217b35b4-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376717, "uuid": "b582a221-85a5-4731-abf8-d8d526cc5f5f", "comment": "Malware payload (Mirai)", "value": "dacaee1e142a86ecd4869c131978b809", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376717, "uuid": "eb732b68-4eda-4d73-bc9a-c6a493250134", "comment": "Malware payload (Mirai)", "value": "3d4c1ed9b17e2152fa65bdf4fd8c93fe940f294b33d06aab815e14dc718c2da1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376717, "uuid": "0f3ff109-c499-402f-8194-895ac9bd1950", "comment": "Malware payload (Mirai)", "value": "37ec84672c656e5984801903ef31df4b141d177b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376717, "uuid": "03ff2cec-4a96-4b83-8d3b-432abddddc24", "comment": "Malware payload (Mirai)", "value": "f2bfa8722cd8040253fc252007257423fa51c6ded21463ee9a1f50ced4b982e01cc84ced5cdf7a3ef113160ec620a81b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376717, "uuid": "dec4f757-a4cc-4802-b030-b902e8dba78a", "value": "T108230271880E9EF125303C76DBD5D783B6E12AB1C6673023D6294A382F75B131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376717, "uuid": "b4095c8b-14f0-4588-8441-364a2b1078cd", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3n9q3UELbUXfi6nVMQHI4vcGpvn:DECFd+A6YHAx2LRQZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376717, "uuid": "0b56d2de-b083-4fb9-bf55-353305e0565c", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376717, "uuid": "61a0b5cc-2669-483f-933c-f6d9801b2dba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376717, "uuid": "1b2bd7bd-03da-4a05-984a-3f0deba6c89b", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9492fd-ba96-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381540, "uuid": "6008289a-beb9-471e-a947-c3b245373ce9", "comment": "Malware payload", "value": "33a9277057d1dd61abc2cb5205463c93", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381540, "uuid": "4dc04fcc-e0a9-4a3b-9145-729b397cd467", "comment": "Malware payload", "value": "3d6a310bf4f24fccf01cc12ba40788e14a63f3d3d9a7c8c118fa04774e68d3cc", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381540, "uuid": "8bcb3f45-1ad3-42e6-8cce-4ef9dd22a5d5", "comment": "Malware payload", "value": "9a7461440c74c3880caafeeb1c56688aaf246859", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381540, "uuid": "6984965d-40ff-4734-be1f-da4d8a02a57f", "comment": "Malware payload", "value": "de753b3c2340aa643908c043c288c77dfea603a9c53aeac1e7d214153459b6e3abf6ea6858bc722d1834bde7bab4230e", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381540, "uuid": "de9e3f06-f9ac-4cc0-b97e-3cfd404f56fe", "value": "T14F5402499B2AECCFAAD8F63F06480CFFFDD497941267615049F4240AE70E77672A4C92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381540, "uuid": "fab463af-1416-4042-93a7-f2e8ef68b127", "value": "6144:x62uh48Db4YEQBjp+62uh48Db4YEQBjp+62uh48Db4YEQBjpG:w2uS8oYEQdp32uS8oYEQdp32uS8oYEQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381540, "uuid": "9e6644dd-d0fa-4c87-b29c-1fe65d92f236", "value": 295047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381540, "uuid": "269ccd9a-5366-4de4-a613-d09b9bcc214d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381540, "uuid": "9d6b1e89-1242-4e0a-9707-535805283124", "value": "Ultimate_Guide_to_Contract_Deeds.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f7e8f9-ba37-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762340707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340707, "uuid": "dad39835-0831-4dfa-9ac9-1f6b7bff8203", "comment": "Malware payload", "value": "7e37cc199972f0ff86742bc690e55598", "object_relation": "md5", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "LLC-Tactics-N", "colour": "#11052D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340707, "uuid": "30687970-0be0-43ba-a8e2-c442c8863c4d", "comment": "Malware payload", "value": "3d8e2e52061f8b1d92487544d08a11e91c9d90a75fa7a381195618c88f0e75ed", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "LLC-Tactics-N", "colour": "#11052D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340707, "uuid": "af573980-95b6-4195-b256-c30e0272c28a", "comment": "Malware payload", "value": "00ba8d9b54c12da795c05b3183256d2c9583c0c3", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "LLC-Tactics-N", "colour": "#11052D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762340707, "uuid": "e39eab1c-f685-45c7-ba9c-9080e54392f0", "comment": "Malware payload", "value": "70c8407ff2e9f4ef4127804524321387ad09e54772d55943a487d56b04d458c254c1d830df830f4d264dfb866380bc5b", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "LLC-Tactics-N", "colour": "#11052D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762340707, "uuid": "baf459ba-7e85-4e5a-b57e-450eb3d9cb52", "value": "T19004122328855223CD0B0F328ACF929917716F44AF8544A67286F7ED7FB27E052562E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762340707, "uuid": "3c44f827-75f9-44d8-b133-7d6fa437575d", "value": "3072:Ky9gmhSBFR86oY06kmpvzLRfFREbwwGylSRB:3am0VoYompLlfFRE81B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762340707, "uuid": "6190d836-3441-4fd4-a670-feaff3b9ade4", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762340707, "uuid": "31188b12-3409-45ca-af0e-8450ddf75687", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762340707, "uuid": "d7ae299f-9ff4-48eb-a3f8-e3ba314bb92c", "value": "installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05acda0c-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319547, "uuid": "ff3aba53-1a96-41cf-ae6e-072b1be1226d", "comment": "Malware payload (Mirai)", "value": "451ed5ed77a0d6e6c2e536cbf1e1984b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319547, "uuid": "848aea13-a281-4897-a044-d05cbd1b5f99", "comment": "Malware payload (Mirai)", "value": "3f119af8a38034d479b64c0df1e968455ebe9ac252e99d343cbda6da4fb95cfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319547, "uuid": "85a278c5-f33e-4c89-8aa3-170b1cb43663", "comment": "Malware payload (Mirai)", "value": "95194a1b6177780663790a951ee596bc0785a237", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319547, "uuid": "98c1eaa6-5761-499c-ac14-b1afe05b4db4", "comment": "Malware payload (Mirai)", "value": "5908270e452b938f7770c38d08da3960a957ffd31d76e13ba88c0d749c04a33064734e7014475f1387ddb30cda7a9917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319547, "uuid": "1543e941-ac2b-42a8-afa7-fbbfd63385ed", "value": "T15113F2E85615AD00DA2080345BBC0D46DA457E78A03C39B205D45BFC1FE29A5EBBEBD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319547, "uuid": "5899d397-7070-4ebc-aef0-21b4a6788fe4", "value": "768:dQrWSb24lL4+N191t4LOGS9ClKKU+pB8sofHPnLfJ9iAnTKxbJe+THtF9q3UELfg:QWo4+N19LrGSUw2qPLrtTW7OL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319547, "uuid": "ca22591b-3b79-463a-90af-9a710a52ee9b", "value": 43696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319547, "uuid": "1af17541-9843-42cc-96fc-9919140514dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319547, "uuid": "f893d3fa-8aa3-44ce-b7fa-96a369ab3901", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c733c7d5-ba41-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762345212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345212, "uuid": "137556fb-eb3f-4c16-8f5b-193f7c36dde6", "comment": "Malware payload (Mirai)", "value": "576e2e61173e596db94c34dcdcd9a7a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345212, "uuid": "a9b1a56d-95a8-4426-9368-8c3eebd187d1", "comment": "Malware payload (Mirai)", "value": "3f6d388212e2e71eae577404b09c3639ccd0a334dfa842153fcc086de08deee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345212, "uuid": "76b367fe-536b-4da1-8e44-53024ab6463a", "comment": "Malware payload (Mirai)", "value": "268e985258e69f9b6fa5774f815363ff5bd051b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345212, "uuid": "0102d77b-655f-482c-9b2e-5dd4eb27a116", "comment": "Malware payload (Mirai)", "value": "9c0a0ddd4b8f5ed2886c0798bc7fa5f419a50f620f10b6dc23afdf2390166701afa70a7a6fe98caebf2ded755e9cd901", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345212, "uuid": "24d5628c-0ef3-46a7-8167-d53407470cc2", "value": "T1C5C43845F8809F61C6D539B6FB4D42A873074BB9D3EB72069A145B3037EB86B0F3A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345212, "uuid": "612773db-bdb9-4ef3-b954-05c889f04fc5", "value": "12288:+AJ2feoSHDDSRuwv4NGpP2AU/mNH7xiSoeP9/Rz4WQAZv55XJesm8pXkCk:+AKJv4sp37xLPxx45AZYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762345212, "uuid": "1ea9a4b8-427a-4569-9b8d-c7536c011b0d", "value": 596172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762345212, "uuid": "8d66db21-ccf9-487f-8464-6b123e68c873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345212, "uuid": "603aa595-3f6b-4e92-a0a8-2bfd3e0d8bcc", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9e6ff8-ba4c-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762349915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349915, "uuid": "2fadd71d-f422-4935-9db2-c78e8e767b18", "comment": "Malware payload (PureLogsStealer)", "value": "2879d9a7d8ecdaddc49cb33b1fd28584", "object_relation": "md5", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349915, "uuid": "876313ef-ad6a-4c86-bb25-6ee47063c94a", "comment": "Malware payload (PureLogsStealer)", "value": "3ff41a0977bfb4e4bbab83fa0d36864deb472e28cc5d55352e2e6617b68489ae", "object_relation": "sha256", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349915, "uuid": "61587da4-2adf-4064-a4cd-c276ced74c35", "comment": "Malware payload (PureLogsStealer)", "value": "f74c04ed601e9e20ffbb968ce09dc6ff2d6eef21", "object_relation": "sha1", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349915, "uuid": "6346efc0-9ad8-49f6-bef7-c2fdccafbb4c", "comment": "Malware payload (PureLogsStealer)", "value": "0bd39d05bab79556045839c5e1b84bcf6110dd48aaea6f505f46d9810469b9574350d007dfa8decb1b8c2e78571c611e", "object_relation": "sha3-384", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349915, "uuid": "1d9f1895-6f39-463d-8ee1-841c3b0c79f6", "value": "T18EA29D042BC84A32F67B437608F326109B35E351B87BDB6F1AD4942E6DB37085DA1F65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349915, "uuid": "7e860abc-021c-4fe3-9e60-9a9b11d5d46e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349915, "uuid": "461abac3-f2da-4ade-9c3c-1577321c1f9b", "value": "384:amR2I+3OvUg7Mvvrn1RBQROHQRd+42ejLcl45lcIn190S1K3g:amR2I9v7wvvrnvBUOHQnKl45l116SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349915, "uuid": "b3c8181f-0528-4993-b702-adfa086dda60", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349915, "uuid": "fe153823-af8d-4c6b-9ed7-fcba3ef846ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349915, "uuid": "b36008dc-363e-4b14-9bfb-427a330d3ab3", "value": "3ff41a0977bfb4e4bbab83fa0d36864deb472e28cc5d55352e2e6617b68489ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab48d477-ba3a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762342159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342159, "uuid": "81de8f25-9bb9-41fe-ac61-4ce24d1c36b0", "comment": "Malware payload", "value": "ab2285526f19b204b8b0f156f8bc4458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342159, "uuid": "ab830d86-8960-41b0-941a-ffd485d2b037", "comment": "Malware payload", "value": "407df507a5430529138f385e049b78b6f9d6f13674572e83e89b8c7975c55217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342159, "uuid": "548b2bff-b4fb-409c-acdb-742f4eb4de41", "comment": "Malware payload", "value": "9a713e7bbaa76d4202c5c7c264d569a7061449f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342159, "uuid": "c31aaf6a-0505-4cc6-a3c2-7e8e49448027", "comment": "Malware payload", "value": "882fea40a4bf0029ef44d3827c84b81b978eb703369f919d4e9ee8635064227f9696e9c37f34f74975bf7d539c4dde6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342159, "uuid": "bad3d6c2-4170-426c-92ea-f71924f59a99", "value": "T17EE633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342159, "uuid": "d44cb734-d1f3-4348-9a9a-63c8fae3cc20", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342159, "uuid": "f44f334a-5543-4c62-b8e7-67a121117206", "value": "393216:ATF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1z:GrRxvoC/7a0jUxX7h1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342159, "uuid": "821a42f3-6182-4c1a-a01b-ee70e23fa6b1", "value": 14781992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342159, "uuid": "0e447d33-5bab-423f-819d-0f2294c4a5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342159, "uuid": "500072d8-3a4b-4a24-accd-ebbca18fb4d1", "value": "agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5faf91b-ba5b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762356458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356458, "uuid": "0a61b5e8-4872-47da-b68b-b4c1cd5762d8", "comment": "Malware payload (Formbook)", "value": "1ea20c62bf74a94ee38ca47620d777d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356458, "uuid": "0dc54c9f-114c-4c63-b7b3-66d9a661968c", "comment": "Malware payload (Formbook)", "value": "4139421ed55c3e312d485d67869250d329a4f2e50407e0fcddd74ee419abf216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356458, "uuid": "b88d6902-a7c0-4df7-835e-92175f521d01", "comment": "Malware payload (Formbook)", "value": "183d5ac530612e1c42f2bb010dcf1a09ab21fff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356458, "uuid": "1841fc64-87d1-49a2-a29d-4f7358345f8b", "comment": "Malware payload (Formbook)", "value": "c19c8b55bb17cc8df78b3f36e6f6b2be9af7e43ffbd1d0d460708b7126a2619f103ec01d9a7d9c539cd422a7db32012e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356458, "uuid": "15c62b42-f502-49c3-9f48-199fd4515add", "value": "T1A045DF1373DE8361C3725273BA65B701BE7F782506B1F96B2F98093CE920162525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356458, "uuid": "083004b6-729d-4719-bf6b-4b2ba2547bcc", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356458, "uuid": "0887c041-2565-4bcd-8827-810ad174a729", "value": "24576:Ntb20pkaCqT5TBWgNQ7aXRwunPQL956A:+Vg5tQ7aXR9cv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762356458, "uuid": "61649c06-173f-43e2-8dfa-e4c42f0e8903", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762356458, "uuid": "ef67921e-9817-4899-bc09-c06f2017e9fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356458, "uuid": "7c7312e6-6395-4b30-8eb5-1c80495201b5", "value": "Payment Swift Bildirimi.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003e0dfc-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319538, "uuid": "0bffb425-cf50-485a-8242-1c042ea31ffa", "comment": "Malware payload (Mirai)", "value": "a4950d456df4747070f9b0e78fbbe417", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319538, "uuid": "85f04f85-3e6f-4f88-aa97-754ea5efc9cc", "comment": "Malware payload (Mirai)", "value": "41788139d7648f3575028597231d705cc9cd2a92ac29bd9ee4f8fee9d1fe5040", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319538, "uuid": "4ba70662-449b-4198-b754-bb90eb694a97", "comment": "Malware payload (Mirai)", "value": "4b64665ff81ad793588110d3fca2834aec96a1a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319538, "uuid": "afc14a8c-5289-4a4f-ab6e-26c01823002d", "comment": "Malware payload (Mirai)", "value": "e622a8adca2eb7144552791003dfef6319d2b7e0d1473d4aff432abc9f7b4614101eb8f8d4a9e6ac886dbb6143fe7fbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319538, "uuid": "b4d020fe-4e49-4b55-b617-ade2987226e7", "value": "T1E203F13FECB557F4D8574235409DBF1D682185237A5482A35A8420F72B72F6A372C3C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319538, "uuid": "e9cc3e5a-1166-4f75-81f5-3b535ba40029", "value": "768:oV3j7GeG72sv88/TNGQ+i3b99tq0o8vrndMybJ6GqiInip/h/KN671AE7nbcuyDR:6j7GeG7V08ZGqi0ouvbJsiInK/JPqknW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319538, "uuid": "9b02e35e-d973-4999-82d7-6c73781595c0", "value": 40552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319538, "uuid": "bbe8b0a8-e813-4d6b-8ced-b255f7b59706", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319538, "uuid": "0d20dc84-aa54-495c-befa-52865cdd0d81", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff7fa60-ba85-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762374137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374137, "uuid": "ccffe2a4-3c43-4c47-afb6-8755a8b3abc3", "comment": "Malware payload", "value": "83473a916546edd6229298e271532f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Trojan-ransomware", "colour": "#465932", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374137, "uuid": "8b51f461-4360-4c5c-af9c-149a20053b82", "comment": "Malware payload", "value": "41ed02e7903545bba8840e49367e188e6023cff2c1344e131caa44f33347c0c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Trojan-ransomware", "colour": "#465932", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374137, "uuid": "896c2b3a-a424-40b4-8934-1132aa3f5468", "comment": "Malware payload", "value": "325e86420d3a58c86029429a7127b199c39fdde5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Trojan-ransomware", "colour": "#465932", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374137, "uuid": "3d434caf-bfb6-4853-86f1-02214a5833e6", "comment": "Malware payload", "value": "8e66f2d704f22f1c82e4f8a8d4187e4ba88007feb03dd12aaf13adda7a6ac93a4df4be84e4fccc2599ef52ae266aa702", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Trojan-ransomware", "colour": "#465932", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762374137, "uuid": "0560c42f-4354-41d2-856c-e20e068d5924", "value": "T130C39E41F3E502F7E6F2053100A6753F9B3662289764E8EBC74C2D52A953AD0A73D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762374137, "uuid": "3425149f-c652-4c26-ad85-5f347e895f15", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762374137, "uuid": "413cfb96-7943-470d-9842-fe64291bb7c3", "value": "1536:47fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIftwWVwI/F3j5pYBu:W7DhdC6kzWypvaQ0FxyNTBft9Vj54w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762374137, "uuid": "c345f09a-440d-404e-bb6b-3dbdb7befbbc", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762374137, "uuid": "2fa4caa0-7875-44bc-97a4-69f7b1f72a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762374137, "uuid": "afe9b9d7-2c7f-41fc-b1df-8d22cc5855b9", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02289f9c-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319971, "uuid": "26a2c331-2f24-4952-8373-d80313174fb4", "comment": "Malware payload (Gafgyt)", "value": "66d9c6216c3700b84c410b867fafd355", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319971, "uuid": "e07299d1-e4b5-4b08-bb6b-f71dffce9b05", "comment": "Malware payload (Gafgyt)", "value": "43069f8817a6f5e3ee841555fc5b000bf3648e198a9af4aae689083abb206f10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319971, "uuid": "50c1f344-8753-44ae-8aed-583c10486143", "comment": "Malware payload (Gafgyt)", "value": "4f27019bde947fcfae227589f57d1f2bf0ad0ecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319971, "uuid": "d61adf02-9193-4e63-ada8-4aeedf58f0ce", "comment": "Malware payload (Gafgyt)", "value": "83503bbeee2733c32c93c3f330774516908d9e65b02cc4b5ef65403c369a58750552d45cf638acfb5dc552d2dfcd709b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319971, "uuid": "c56d4cb5-eb68-48be-836e-eda42ce637c7", "value": "T1FDC3E8B6F801CFA6F00796B100975C266D31ABE30F926566237734A7DDB60D63863E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319971, "uuid": "61faabd0-d710-43bc-9c16-39bc75f92e89", "value": "3072:yCnFsy++X9pWFCaptQ6RZKgQckIyi0SJ3tk:yCH1GtQ6RZKqyi7J3tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319971, "uuid": "f5a6b410-c191-494a-aed0-89933ca2ce07", "value": 120516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319971, "uuid": "569f50f9-14ab-418b-ac02-8629ba497950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319971, "uuid": "adfb7060-756c-44a0-a9d6-d2684e965265", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8bb4eb-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318622, "uuid": "74ab3a6c-6729-48c1-ac6e-fa26f5c60d5e", "comment": "Malware payload (Mirai)", "value": "c98a24513bfebeaec2c591ab72d4dd1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318622, "uuid": "b7914b79-ca24-483d-9fa2-15e24c2f5953", "comment": "Malware payload (Mirai)", "value": "43a0ce6912ca0bfacf388a4861a3716eaf3a10f4ffca74f23764c8ffb090cb62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318622, "uuid": "e3dddb67-abcd-459f-a18d-52a0862f383c", "comment": "Malware payload (Mirai)", "value": "fb2bc5a72b9afae7cec0d0873c780ec5e32191c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318622, "uuid": "59f34f35-fca3-4c82-be71-3628855c4287", "comment": "Malware payload (Mirai)", "value": "bb846f60f329d08596c2b7de63f554a15080051612a608000c3eacf16a95da7972f4b5bbc64a4587b70cfdc31531ed84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318622, "uuid": "e9334f35-3027-4414-b0ec-ee993a9efb59", "value": "T199041905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318622, "uuid": "63e37034-f2f1-4fe5-878a-1b80b28a03aa", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2woRKJLYV0fCtZ1SD39rsJzjM9fx49SY2S:t3nEr5dfHPq7UTocJsvR9X0l6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318622, "uuid": "d471cb55-f70d-44cc-8a36-b37599b60fd2", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318622, "uuid": "184c95fc-6b96-44c7-a35d-2caff1b31529", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318622, "uuid": "b2c05921-0e4d-4603-9024-9dd89bba8f4b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b05970-ba27-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762333962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333962, "uuid": "d5a81cb7-f4f0-4e2b-a386-9837cb456ea2", "comment": "Malware payload (DonutLoader)", "value": "14d5d11b6fee0066e3e5823b322816f9", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333962, "uuid": "829e2ee5-caf8-4249-8da0-f6b363df7e3d", "comment": "Malware payload (DonutLoader)", "value": "44cb1860c52d546c1d7d62f7a1e2519c5e34413801b20ca0c402eebf508c1026", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333962, "uuid": "edb2d16c-6fd5-46ae-b120-f42c432707d0", "comment": "Malware payload (DonutLoader)", "value": "79d520ba45e57813e7b00276fa1642857d524396", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333962, "uuid": "70226e9a-2616-48e7-80c1-e4475d344467", "comment": "Malware payload (DonutLoader)", "value": "7e2cc4dafb8ed8816dbc57474193bb19a759ed13d082a953f1043af60f692219fdf8fb6ce90e1c2a2a140ccab6fe1f89", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333962, "uuid": "71167cbb-2c08-4cf5-ba8e-003c00ac311e", "value": "T17EE72312DFCE886342622F6B94D94C2A5366FCF7A08E51AB916FFD5AC23140D047BDE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333962, "uuid": "151867b5-be7c-4fd8-ad1c-b4014871e1d4", "value": "1572864:ocLPjGZ2s6V+te4uwKKINg/v0Z/kKyaNtDRJT:okPjGZEQvUK3QMKHjRJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762333962, "uuid": "813c6255-0f72-4592-ab07-45a191342a53", "value": 67257233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762333962, "uuid": "c11c204b-ad8f-4d1b-8363-3d5a67507be1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333962, "uuid": "78ef1e8c-78f8-41d6-af98-5a66bd47cc71", "value": "f92f1ed1e5eced0559cf849650051ce5960eb647f952225b8a07f93753554b73.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8b5081-b9fa-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762314777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314777, "uuid": "e4cf3e0b-bf96-49d0-b388-318b53dac2e6", "comment": "Malware payload", "value": "10cf7d63ff272a2865eb844d09864c5f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314777, "uuid": "1059f86e-7452-40e1-86c6-39e9b7c7b6d1", "comment": "Malware payload", "value": "45aaa368d5844eec056a0de66315695fb7d91304a84992a5f506f9679579e031", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314777, "uuid": "7387dda9-815b-456e-afdd-e6ca4c8dfdb2", "comment": "Malware payload", "value": "79a95833c741e78c11be701b34afd507b67ef0bd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314777, "uuid": "3d777674-e05f-4355-adb0-338382bde170", "comment": "Malware payload", "value": "6980746edcb85963ed868abcbb32757f335703f8ae0e707d5646e68ad40137b99d5bff92d81431c87e041c75607e338c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314777, "uuid": "0382eb49-d8ae-4c5b-9c36-5edd9da28627", "value": "T1B3653304E92D5D78F0E993FA8821AC3F5AD9FD833033864F74D3A7D899268DC1152BA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314777, "uuid": "7c9aec9b-dcbc-42ce-b39b-d215c1beb7ec", "value": "24576:2ySoM20tSWDQFoLWZKTCB3OSmg+fhDlfa33cPTj5erDaHBBJgLC0H2oDu:2ySoM2BWDQ8WZKaOST+fY3STj5eHaHBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762314777, "uuid": "fb249f7d-5af1-4af5-a4b0-89e33438c017", "value": 1524736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762314777, "uuid": "5f3bf28b-98ca-4c10-b7f0-9728aaa1b0c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314777, "uuid": "fc840d13-8ec7-4932-a8cc-063ffd48f633", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04de7fc5-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319975, "uuid": "dfeccf2e-2806-4d01-a420-25fd5580d7af", "comment": "Malware payload (Gafgyt)", "value": "6f6b30400d41fa888fa81e6f2b35ab45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319975, "uuid": "086da776-cde5-498c-85f4-a4705cfcae70", "comment": "Malware payload (Gafgyt)", "value": "45d672836e17455b792acb8be6b0cdc1d6f18e8326f7e094f54f2a9b4e6d589d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319975, "uuid": "87cd5a6b-1c47-4cee-a155-957a21cdbe86", "comment": "Malware payload (Gafgyt)", "value": "5473185349d33febfa997211fe44710b508154b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319975, "uuid": "ddb8e02a-1361-49c5-b059-d6fea486907c", "comment": "Malware payload (Gafgyt)", "value": "88176493b6d6fb796f084de0ed0ade3d61c40b139b978288518b514a5e8776c618e394007b422ead6959a07f4297b77e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319975, "uuid": "c2414cac-2787-40ba-b434-9be837959b78", "value": "T17CC31964F801476BC3E362F6E65C86DD3E3507EB63DB30115A388EA067C2BD52865DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319975, "uuid": "d55eee2d-3049-4bb3-a2eb-84eb8437f5ce", "value": "1536:Y4OoIXZ2tkrJqFcrjkh/Yw090PCJzBN7FPlx0bU0/9O2zivI5hRO3r:SXEk6csh/F090mzzB0D8I5hRO3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319975, "uuid": "22496283-7bf7-459b-9855-d47eeb7c5205", "value": 123432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319975, "uuid": "7f86ac4e-c1fe-4bf3-b1a2-e437a67745de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319975, "uuid": "7f48ae24-213b-4273-93de-36e1e64b3113", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775463aa-ba8d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762377720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762377720, "uuid": "9cbdd843-ebed-435a-a729-9ca80a3097af", "comment": "Malware payload", "value": "64a260f7b5bd724d8782f371828a2bcb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762377720, "uuid": "bc3bba85-ca7d-4b18-8516-8c0743d81a9f", "comment": "Malware payload", "value": "4653c9115c8cb40430cb89e38440047efa8f44745d1d3b761ed936b63500949f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762377720, "uuid": "bfa535d9-4082-44b5-877c-8e184bbdfe3a", "comment": "Malware payload", "value": "357c51fee77d59b5fa5a9775202dceb833b1c8cc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762377720, "uuid": "7e84a5b9-dae6-4576-8379-41c01a337863", "comment": "Malware payload", "value": "f3c89a1cc7d865bc5a690212645642bfb346849b1162e1a97e724bce56721f33f2959eea37ba50983dec71dde6a58759", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762377720, "uuid": "eacd3a50-6133-4b91-a983-460fed2109f3", "value": "T1316633017BFC2001F2B7BFB26EFA5610497ABC2A2E7AD55D1591429F5A70EC05E6033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762377720, "uuid": "afb783f5-5d13-4f25-9a7b-2f6cc2095cde", "value": "4e46247358a7f206d2eb2373e1ec67ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762377720, "uuid": "9b22e91a-7f77-4dc4-9768-ece840f083b8", "value": "98304:VHp8KDPD82p5T7ENWLDmp1LrHJWRy0aMbndul5hL9BHRWCE5wn3kk3a4g9C5E+Ij:T8uPDJp5TPiHkEMbdc5X3kk3NVhDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762377720, "uuid": "210c6fa9-5e12-4746-ab1b-c03a4715e35c", "value": 6704816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762377720, "uuid": "66a37ee2-fdbe-46dc-be5e-f4abfa6e2c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762377720, "uuid": "099e0b66-6397-4a08-8dfb-0f7d4b806d8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd39e3b-ba08-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1762320608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320608, "uuid": "552fa547-9ad6-4421-abdd-9905e4dc6fda", "comment": "Malware payload (njrat)", "value": "c161c31fa7249d276ce0f93302e7eb0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320608, "uuid": "d7e8e009-d16d-4157-9bb6-87a1f8021649", "comment": "Malware payload (njrat)", "value": "4666046b2855686628c636e49ec6669b2c694e65f13862168b37f88a96588520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320608, "uuid": "e13df895-916d-483d-9a82-805698d1327b", "comment": "Malware payload (njrat)", "value": "99eee6db7916c334d268f45e048f1b74d00a7674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320608, "uuid": "1317ac41-12c6-4ca0-b793-be94978e3c07", "comment": "Malware payload (njrat)", "value": "f5102b61aa6055ee149772a377fd9898ec1a8f13dc7a5f99f1554955a2d75a127c8a7598bbe890a2c4cf9582d0116bcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762320608, "uuid": "e5d56568-8809-4faf-8845-634e63ed6e15", "value": "T121A3F1387E862133C67EC1F1A9E6768AABA9212F3191DDCE4C97028518F2F155EC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762320608, "uuid": "7e1e96dc-80c9-41ed-95a0-00868a5a4b02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762320608, "uuid": "ec34d9eb-3681-4323-af5b-434a0b473f59", "value": "1536:MYxlY23kGwgMBUQGum2U8aVCguHEvQEbFeDVC3woFRKpTdm6Q:DlY23kg3sguGDFaXmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762320608, "uuid": "58aefc65-d507-4637-876b-d43c4d8b09ae", "value": 104576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762320608, "uuid": "f113c9c9-4801-4754-b08a-bd6f846c2fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762320608, "uuid": "2a508c10-8c28-4f07-9acf-0cdd7cf7173c", "value": "C161C31FA7249D276CE0F93302E7EB0E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1ee18c-b9fa-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1762314402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314402, "uuid": "692c50af-4235-4d42-a429-ade8f85c9001", "comment": "Malware payload (GCleaner)", "value": "5757e496af8ec484f294eba16cde2e23", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314402, "uuid": "3f3075ef-d225-43a4-b6ee-82d3914730ac", "comment": "Malware payload (GCleaner)", "value": "46f7a66cb5d9c1d94d99a9bbf6e973a21d438b81ed722fcd73fb5c4e6ca08954", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314402, "uuid": "c135d717-54e4-4066-b571-d7b5b70fd442", "comment": "Malware payload (GCleaner)", "value": "318d4b8e019409217ebcfc8858052f5bbc52831b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314402, "uuid": "c595f818-ee7a-4df0-9c60-626feb2a5c0c", "comment": "Malware payload (GCleaner)", "value": "3fce3d1c6bed20a3fb0232aa3c439060b035a5a9dfb2f7c68959bc89e52238d5f64a7b5af382cf5068d33d26b66bc80f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314402, "uuid": "7e333480-7172-4f1f-a74b-61000a49638e", "value": "T1CAF5D153C2A3CB61CE0102FE5F7BB2C2D815652CFAA4A6FFEAEB9451393DD111356482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314402, "uuid": "63e5d1dc-dfca-4caa-b994-b13f92f6625f", "value": "c2ffaac75292c9510a72a45eee801fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314402, "uuid": "70c2d13b-e9d1-49f0-8d64-b4e0f23ff59f", "value": "98304:/jRCbPYTMNkduR2NytzqMizbsmw2m4jvFm3:AbAw6duR2NRcmw2m4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762314402, "uuid": "d3759fac-dc21-4de4-ab75-2a5a282227ff", "value": 3639568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762314402, "uuid": "960016de-fb6d-4b7a-8eb1-34abb9cbec7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314402, "uuid": "ecc48680-4f48-4f2e-8ebd-b188c49cc056", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f77e893-ba22-11f0-91c6-42010a9c0006", "comment": "Malware payload (SharkStealer)", "timestamp": 1762331751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331751, "uuid": "507058c6-8ab6-46ca-8cca-3cfea88b2422", "comment": "Malware payload (SharkStealer)", "value": "9b48679233f2f5ad150278c3a109a993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331751, "uuid": "cab35381-6094-4c50-9e1e-0330dabe513d", "comment": "Malware payload (SharkStealer)", "value": "46f822c735ccc3a89df946d36f26f7c218f6a89b9e0f0912211677c013f0016b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331751, "uuid": "dfacd12e-7212-4267-a9ee-f4b891b99dfd", "comment": "Malware payload (SharkStealer)", "value": "7022c3d55207f637ef0b2350dfed086d6c1abbc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331751, "uuid": "328c6d91-b8d6-4952-ba65-ceebfb089a85", "comment": "Malware payload (SharkStealer)", "value": "150fc8a1abd1ded1436b4325392b412947562cf7f6c2dd099ab07c5ebbfa246403dc325a32f98f8979dc9321afa8dabc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331751, "uuid": "dd5fc46a-d27c-42be-bbb7-0119c8871a26", "value": "T15BC61294629C01A5D0F5CB7DC6EA5803F63A7C144B7AEBFF02A196162D366E1CF39720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331751, "uuid": "3c459ab6-2751-4e0f-a5f6-86e1fe784007", "value": "da7c7889a9af299fe69cc0665690e327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331751, "uuid": "283899bf-58ba-423e-a0af-2108bc175857", "value": "196608:hzVi2yLEO7aYlY+K6U/lh8s7DkjOI3vZ26/MtmZ2JThn4U7rrSbgrEyjCyhpBMR:q2QB9K6OhpDkic26ktzJhvSMrEyxBMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331751, "uuid": "07d4fbe6-6fe8-4324-b1a1-cd17efc95ea1", "value": 11927320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331751, "uuid": "dd4bb904-1797-4bdc-bdd6-c6567b846a9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331751, "uuid": "e414d7d4-9fae-4859-8009-7ffc75ff6d67", "value": "46f822c735ccc3a89df946d36f26f7c218f6a89b9e0f0912211677c013f0016b.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b73eb45-ba48-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762348118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348118, "uuid": "11cb43a0-a8e4-4fcf-8a88-192bb4b597a7", "comment": "Malware payload (DonutLoader)", "value": "134f4ee4f18edca95014078fdadcd71c", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348118, "uuid": "96c63c33-ba8c-4590-b5bc-f92a2ee80026", "comment": "Malware payload (DonutLoader)", "value": "46f9004cc34451595563b4446868ffed73e2a07ff9c17bee0fc43606feb7d6c6", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348118, "uuid": "4abde049-4779-4469-9671-eb478d8e7662", "comment": "Malware payload (DonutLoader)", "value": "ce60de5728e04af19df0477fdfde5e4a366a9e89", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348118, "uuid": "d6644809-93db-48f2-8660-74567329d6ed", "comment": "Malware payload (DonutLoader)", "value": "a3118b853963ee3bb5d7b29c7445cc2308e9b6c06fd6acaeca85ddd51f96f40d0c2656adc44dbb57f3e5fc498e092176", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348118, "uuid": "2493300d-0196-4556-a370-884a684f7075", "value": "T1CD86E6002BE0249E52E79E72EB2F61D0EC0E2D2B39864C4BB125FDA6757D51EF660D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348118, "uuid": "00ed5201-98c0-4513-8c29-97fba7dfaf22", "value": "98304:w2Y18RtLvzWsgyxk2Mx21dsbIbn06WGAk+PHz0PFicT:E18Rt2/ymRxoibQn0CAk+PHzET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348118, "uuid": "6bf80ec2-1262-4e69-bf7c-9ffc0acdd17d", "value": 8136298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348118, "uuid": "44c94e05-cd2b-4902-9aa8-9def03d332a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348118, "uuid": "03b77706-c3a0-4fb4-8971-5d65c3a3ca19", "value": "46f9004cc34451595563b4446868ffed73e2a07ff9c17bee0fc43606feb7d6c6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cb8917-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319646, "uuid": "fb83ea24-3710-48f2-af9a-2f9bbc846b71", "comment": "Malware payload (Mirai)", "value": "acc26ee6b486ac9cc3d8d99253c16f35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319646, "uuid": "8b968420-d5bf-4ee5-8898-ca648f1a993b", "comment": "Malware payload (Mirai)", "value": "472d42c0f39fc870c9a0b764fa49ce7d36e94629f67357ce6a41e081dd63ad3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319646, "uuid": "1c89eb29-c3d1-474d-acef-4c4dd7e1e908", "comment": "Malware payload (Mirai)", "value": "466c76dcb74ca707c2f155062386b72322151df6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319646, "uuid": "931a6f17-f67a-4560-b7dd-127a6b2d6592", "comment": "Malware payload (Mirai)", "value": "64a6b374b41856998f39547b4102bbe6a5ad5ee6a6e982c2468374ae824104c7d79ab64c2d947ecde1fa7dd14fe2120e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319646, "uuid": "84fad41f-c1d6-450e-ad5a-b9b513ff800b", "value": "T122B3C85E7E218F7DF768C63047B34B21A35923D626E1D685E26CD9041F6038E245FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319646, "uuid": "daabe68a-be8d-4b63-8bfe-6df95fd8149d", "value": "1536:pTtgJlCSYhqbLLqDridBiA8NVKCNrx39W/RGpYTKGNeRL1HDJ7ABRw:EJ8Ob6DNVKCNrx3qRG6LOt7Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319646, "uuid": "bb8af10a-a9bc-4a66-8d57-a41d96e0dfbe", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319646, "uuid": "11ff1898-e5e0-4c4a-a183-b71178287b6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319646, "uuid": "aa16170c-f40c-47da-9e60-56e3fa2582df", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb411cd-ba6d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762363935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363935, "uuid": "5f8928f2-b132-4837-961b-bdc76356b2b7", "comment": "Malware payload (Formbook)", "value": "e2e7f8dc4b37168d567a6a89cf992660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363935, "uuid": "c7f0d97f-f3f6-4684-ac3e-81af414d6ee0", "comment": "Malware payload (Formbook)", "value": "4733feaca04e871d4e0bb052f2437a2f46f10852602ea4f8b2f0170f4838dd87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363935, "uuid": "11658796-3ea9-424b-a86c-402b53102180", "comment": "Malware payload (Formbook)", "value": "08ecca7b36aab2745437ccc97cbc298ec020a5fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363935, "uuid": "1e1beb4a-aaf8-4264-8f72-4181ed74da1d", "comment": "Malware payload (Formbook)", "value": "892d768505acf12f395930cb38e163365cbe90967650c62c2bb555828834880d0fae0bee3c37e3ec191187dba2e879e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363935, "uuid": "ca15697c-561b-450a-b2a2-90e9ca8a403d", "value": "T1E9653300ED7C69B6037C833CB4AF6B4E006A4A46C4D4EDA7D3D8B687231FB565727862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363935, "uuid": "18a7cc0c-20bc-42de-8597-3ef44d53e6ae", "value": "24576:zozSqNNkfpd9XS07Q0moluXvY7lqhnjuyi5DMG1IPIAUQaLD:/qJhH/QxUFofIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762363935, "uuid": "ca9e1763-9709-4e9e-a91c-c561a7efdae5", "value": 1463349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762363935, "uuid": "c5777ebc-23bb-4590-8a4b-c44ad44eba82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363935, "uuid": "461b80cd-2900-4bf5-af29-3a309377270d", "value": "MillServer_Encrypted.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef4ed53-ba4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762348930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348930, "uuid": "538f6449-d7c0-45c4-aa54-3ffeac4b5dc0", "comment": "Malware payload (RemcosRAT)", "value": "5a963299407726e8a833741ac33bec96", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348930, "uuid": "34e2f50a-c759-4842-b509-c13da2c28d40", "comment": "Malware payload (RemcosRAT)", "value": "475360348f8340c619f840bd1de80a7bfc36025c329c68a29f842e4abd0ec9db", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348930, "uuid": "86bd8615-d039-4075-8ed1-513385d9c7bc", "comment": "Malware payload (RemcosRAT)", "value": "d7c3312178fd7a1a24be725ab65ebceac9d6177c", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348930, "uuid": "59c07690-c8c3-41ee-8125-51634369848d", "comment": "Malware payload (RemcosRAT)", "value": "34efd36a0425dcd9fa1f8fe4bebbde4e2be52d6395039d7b9fbfe0a2e876d8cbb4bd0faf7edb2040c9322b20372d407d", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348930, "uuid": "3b77bda5-0af2-4078-8e72-26f73b4057c6", "value": "T14F65BF69A183B8F2C01F1578AC0FB3D8F7293B505A2476CE39FC5ECB5A34699E466143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348930, "uuid": "1cbf78ff-e441-479c-8155-2949c5ec3ec1", "value": "c8642566937ec4d692b01ed458f3c870", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348930, "uuid": "5f1a98e0-c87f-4897-8eb0-6a6e73e5327c", "value": "24576:WjZnm6pSHfZPXTLXMMMMMMMMMMMMMMMMMMMMMvQ2q0H7Jc1U2+taCsIXjVKl+VZG:Wj1VSBMMMMMMMMMMMMMMMMMMMMMvQ2qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348930, "uuid": "cfd4e8af-69b0-4038-83cc-d52c85121550", "value": 1547776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348930, "uuid": "ca020c05-b912-48cd-b652-eeb66b3b4faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348930, "uuid": "ca2f102a-b596-4ad3-8e9c-08d2a2841c09", "value": "475360348f8340c619f840bd1de80a7bfc36025c329c68a29f842e4abd0ec9db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac7b127-ba26-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762333541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333541, "uuid": "6a8f2707-153b-4f92-b426-6f7709658d8a", "comment": "Malware payload", "value": "c301f28c3c15f56ff205a9405b7dfffe", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirelyww-com", "colour": "#A7A132", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333541, "uuid": "c3ede51f-a549-4690-9868-389df5295bce", "comment": "Malware payload", "value": "481958699c6572f8e9fd8cafdc02b585d32ddbaacb40562a09417d7b2921d1cd", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirelyww-com", "colour": "#A7A132", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333541, "uuid": "f09d8980-07db-4f63-a746-19b597fb8003", "comment": "Malware payload", "value": "612d345490cd44c866ceecb48dda739fa7313b48", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirelyww-com", "colour": "#A7A132", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333541, "uuid": "7bd670ad-d602-4373-853a-a1ad2c341edb", "comment": "Malware payload", "value": "2bead2b2b99a95da5c0b78b117ff6803d53f8084688f0942a0ad76c8c159dfc023dacace09f3a5fc7ebad65048ba4b19", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirelyww-com", "colour": "#A7A132", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333541, "uuid": "f0346afa-14a5-47ef-8917-fdd7a3ad89ac", "value": "T16A56AD15A3E500B4E42BEB74CA55D333CAB0B8964735D24F0A99E6452F33A61AF3F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333541, "uuid": "3430290f-cba6-4caa-8830-28f098e32334", "value": "c94c40afa0e0818db0e44e2cd7ad451c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333541, "uuid": "9893c4e2-613e-4748-986d-389bd75802b9", "value": "49152:YyEjyfTA+LhXyx/Xr8SOU8cwrbIwbSfiSNlXaMo+wPXOGWE0/128iJRfwhyQwGIu:j8ZEVrcclPYE0A8QRkFG7Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762333541, "uuid": "11ff778a-9d91-4eb6-9555-745c16354c26", "value": 6114816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762333541, "uuid": "3052adf1-7a5d-4ab5-9dcc-18737a004fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333541, "uuid": "c33be9d9-aee4-453e-a095-9fbdf3e49c42", "value": "MSVCP140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d93dcd-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762376931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376931, "uuid": "2134dcd9-2f7b-4988-b489-d95e0783afe8", "comment": "Malware payload", "value": "b22d0d829eab9650bb7c5232dde48117", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376931, "uuid": "d8137e55-355c-4c98-b7f8-cb4b3274c316", "comment": "Malware payload", "value": "485c900049b78a23c80f6c1bf541203804054b168215d4db2cac4c8167e0789b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376931, "uuid": "c459e802-1db8-450a-9344-edfbb0d432aa", "comment": "Malware payload", "value": "dd7ab2b1dc1462b3d07cb6314c362159c1a96126", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376931, "uuid": "3ff14105-7acf-4fa3-9355-4f7f3a434f3d", "comment": "Malware payload", "value": "72eea94d4e1cabaa406a08e1bf39f85e26b058ce37f021baaed64a2658e4e2a8eb21ded351867267735feeef684b0708", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376931, "uuid": "bee1b5bd-34e7-4ffe-8cdb-eb4c8eb2e9e3", "value": "T19F1275856A5277377008DC3D900F5ACF456A44EBEE15E0B0992A74B97C6127027BF27A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376931, "uuid": "db1a46c8-6961-4f26-ba4c-ff6b2dcc8141", "value": "192:BqMxxCkXmjQsFz4p8sLKYt40YhQWPSOkD:BqMxxfBH4NhgOkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376931, "uuid": "363d4bd2-f660-4fc6-ac69-faf810560a36", "value": 9031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376931, "uuid": "add04fe0-774a-47ec-9de6-2ca6087e273b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376931, "uuid": "ccdbd3d4-beeb-4433-9443-f9bb49c2a0ee", "value": "PO00009226.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa0ab27-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762319663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319663, "uuid": "482ea32c-67bc-4b2a-9b7f-e94241e1b75c", "comment": "Malware payload", "value": "3ad27ba9523b5a160775d9114458ce2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319663, "uuid": "f5feb21f-1d8a-4fe3-bb4b-6e20ebb8752f", "comment": "Malware payload", "value": "48ffb8ff3ec6df6a15261f1cdc8da698a3b99f7370d231dec133687946c79ea6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319663, "uuid": "c934dd27-696b-41a2-a0b4-feec106a819d", "comment": "Malware payload", "value": "553de23ff1a4ebba8e5ec2c884c334f171b6f7cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319663, "uuid": "f908c005-d525-4fa4-a512-3ae78a06c515", "comment": "Malware payload", "value": "a319b7e09caa28ddd60452e6d2f869327cf77290afd4a43052fe2862612d22c128ea1c39dd0cf6c68ad44bdf57f9e6a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319663, "uuid": "81bd002a-eec9-4764-ac61-4196b44bb356", "value": "T1DB934C02B30C0A47E1571DF02A3F27D1D3EE9EA120F4F6C5691EBA8591B6E361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319663, "uuid": "d87ecf97-e2b4-4fc2-9f3f-025e08163413", "value": "1536:oEdTMIiB2ofT7urfl+W+qaXDS8IylcOaON+xVTBJHZyK86uYmA2xprvYer:oEdhxETRSQrNmjZ86x2UO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319663, "uuid": "e222f35a-c9f2-4243-a003-9765e072ac24", "value": 89448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319663, "uuid": "dd72117e-529a-4cb8-8a21-8af9c3e69629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319663, "uuid": "60795dc3-59ae-452e-8395-5f16512c8a3d", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9a7b01-ba96-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381463, "uuid": "46c47baf-109e-4c38-b4df-de4433ba803d", "comment": "Malware payload", "value": "f6c5ad7b04f41f64f1fe3659b9ce487a", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381463, "uuid": "43d72b8b-ca54-4bfd-b6c4-93e14c712c23", "comment": "Malware payload", "value": "49bde7a75139bbf4d7efe936c9421d6954e6807533e4ba0be9df40eaa0b31ac9", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381463, "uuid": "5346eb20-6de0-49dc-a219-b0ad22442dd9", "comment": "Malware payload", "value": "7ffde3f9e0b8eba122dc44821c8dff1c6fb6919d", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381463, "uuid": "539028d0-3b07-4ad4-910f-30abb4c8dbb5", "comment": "Malware payload", "value": "6d45256f24c25fd4dbcf4db4cce5e7c55c7171cee89d081124305238046fff371dc68a75fbf2ccc35f492a33c8c6575e", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381463, "uuid": "e5959747-d7ff-4d69-9eab-f0664218cb83", "value": "T114541256E7045D0A7DBC1F91A0FFC6262191E76FC680063F672CEC1AD71722225FA609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381463, "uuid": "5c5772d2-8010-4712-af05-f8011b79bc96", "value": "6144:qtyV8qsV/SIbJOt5tyV8qsV/SIbJOt5tyV8qsV/SIbJOtU:JVDsV/S9tCVDsV/S9tCVDsV/S9tU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381463, "uuid": "ca5d8ee4-1a71-4d8c-aae1-0576fbe1d615", "value": 294450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381463, "uuid": "df8f620c-f388-44f2-9d80-df6fb6975dc7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381463, "uuid": "5d1f2be4-e690-4240-8d04-aa254086086e", "value": "Ultimate_Guide_to_Contract_Deeds.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a0fb93-ba01-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762317534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317534, "uuid": "c553829a-a045-4c6e-bebd-dba545ca24a7", "comment": "Malware payload (Mirai)", "value": "d09873afd15ec9dafb29e7612fa6818e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317534, "uuid": "608ad108-3641-4299-bbfa-696a3faa7a4e", "comment": "Malware payload (Mirai)", "value": "4ad4fe754acde2f79ced013d7dc7260e111ea23c7a47001e3fb16aa5d268852a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317534, "uuid": "e2dbd6ed-8fe6-4f0f-a727-fdd3194f9df0", "comment": "Malware payload (Mirai)", "value": "70c5d880d9f7bc0a06b5921df11551bc9df80ad1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317534, "uuid": "fadfac91-9732-4c4a-87fb-4dda449bf3f8", "comment": "Malware payload (Mirai)", "value": "5a78a959a9d842a9e43fc3d21aa57b161158b8359c7d1f5e5000dbc1e350ca1aef9120d086d397406dc36062291f798c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317534, "uuid": "d622a8ca-29f1-4fe4-ab91-3dfd2c8f8d30", "value": "T1A0256C5AF2B370FCC067C030436FDB62A835F46911226E7B25C4EA352D66DB01B69F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317534, "uuid": "d80de898-a3fa-4673-9b5a-9c07865000f1", "value": "24576:z9ufrwGD15T0W9Fkb2ehnNZf0i+6Mc60T:zSh90W9ibfhnNZsi+6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762317534, "uuid": "ee5b4c21-4649-43bc-ac97-4b7cd43c702b", "value": 992320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762317534, "uuid": "6207f731-62c5-421b-952c-9fa03a816114", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317534, "uuid": "93a0b8f6-9cf7-40a1-97ad-3a3f60566010", "value": "Mddos.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6567a12e-ba28-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1762334311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334311, "uuid": "b4a5611a-7572-4c25-ba3a-d1946b0fb935", "comment": "Malware payload (Adware.Techsnab)", "value": "520475d663b7f5bca83b7a58e25b5519", "object_relation": "md5", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334311, "uuid": "143c968c-bd4a-49b1-ba5d-6e65950e6673", "comment": "Malware payload (Adware.Techsnab)", "value": "4c2f148b6d05f6ddcd21b6e83f48b0daabef6fa326db32b793424bee86f4a7b1", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334311, "uuid": "a77155af-b86a-4216-a9cc-4032c9be583a", "comment": "Malware payload (Adware.Techsnab)", "value": "23c6f63db0e943cd71b1b1880918c1f33dd0009f", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334311, "uuid": "97b90f2f-628d-4bad-b522-36591877d3fc", "comment": "Malware payload (Adware.Techsnab)", "value": "6104958f8b6cca08794849dd38fbb82d9cdf0dd0354e9191b85a654bbb2e1c824d272e33c41bad47854102a1563f4806", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334311, "uuid": "1d9d8ff4-d178-48d2-a6bc-129ea4689671", "value": "T1C7B52A0FD6984E09C66A5A39C9E35124E2327D86377082CF2054C6FD6F5E7F7AA79308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334311, "uuid": "5927a8e8-e37e-44dc-9e01-ed685262d9a0", "value": "49152:2XQlpszh1cNHqGdEBaB3NNME1SmPYjG+jeWtFK7rufHyjuAdHU9J72BFwKeV+qM9:0QlGP8RF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762334311, "uuid": "da4afca4-343f-41b9-897a-00ab4626a0d5", "value": 2290176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762334311, "uuid": "51c0151a-06cc-42a6-a19c-0a5d3d895434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334311, "uuid": "32de78a7-03d2-40cb-a8f4-1f20cae79868", "value": "4c2f148b6d05f6ddcd21b6e83f48b0daabef6fa326db32b793424bee86f4a7b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e58127-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319539, "uuid": "0a57ba59-2347-4d82-8c6a-e3a187bb7b94", "comment": "Malware payload (Mirai)", "value": "4dbb4b0bdef77d98d521ffff1fad816b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319539, "uuid": "cdcebe7d-3150-44e6-bb3c-ae9e4ec5023c", "comment": "Malware payload (Mirai)", "value": "4cca40a378396d30956ac1732764cc02a5500699e8a5352f51220be1960ca981", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319539, "uuid": "690f6137-5de8-4c50-91eb-ad3793ff2308", "comment": "Malware payload (Mirai)", "value": "4ccb3675afe3bb2c5f756edd019401e92f1b2c7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319539, "uuid": "eb74ecf0-6734-4cad-a984-75c0ce508d29", "comment": "Malware payload (Mirai)", "value": "39e6a834a6608c748196e838c1b4e471dc88e7b7cc827ac4cc025c9e8fc124096f62a069bb26d20b014512284a19d744", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319539, "uuid": "1783f3a9-5f51-463a-99de-bacb4ef1b9a3", "value": "T1BDA338D7F801DDBDF84ADB7744530506F571E3A219831F36636BB8A7AC361A81826EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319539, "uuid": "f5571fae-b42f-4257-a0b9-3ee6bb9574b0", "value": "1536:Og3pWv1rObbgQvWlY1byRCYx8Ixyage+lBEOZbfz2iMtgCdoq1IS:Hb8l4byRCYK5BNZLvCdoqSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319539, "uuid": "46ed838e-c54a-4cac-b990-20c0b20681e0", "value": 98624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319539, "uuid": "98db54a2-f660-4bf8-b9de-f239538b7f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319539, "uuid": "e6e08f0d-b29e-4015-b23a-e770afb5b342", "value": "nwfaiehg4ewijfgriehgirehaughrarg.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dac26e9-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762335908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335908, "uuid": "5535247f-caee-47d9-b651-8fb28828d8d5", "comment": "Malware payload (CastleLoader)", "value": "de4bea25ca93e98bfd289250347a18ca", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335908, "uuid": "0c85bf4d-a289-4752-adc4-9b73332b609d", "comment": "Malware payload (CastleLoader)", "value": "4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335908, "uuid": "bdc7b387-d23b-44aa-88e9-d5ab928dc47d", "comment": "Malware payload (CastleLoader)", "value": "aea89f11b7914f44bce9cc35bc33965dd7ec85b6", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335908, "uuid": "bcded2e8-b151-4c5b-bbef-03ebbd5cd616", "comment": "Malware payload (CastleLoader)", "value": "c09c015de31423b7f4dc38be2682ae56d2096a781427e397708be48ff40318e07f010fe53edae9c28d56a81f23db5933", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335908, "uuid": "fb2426cf-38c7-4934-8990-848596ec6716", "value": "T15FF6233BF2A8913EC5AE0B3241B39710493BBE656A068C9F53FC784DDF325A11E36615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335908, "uuid": "84b9522c-0dbd-486e-921f-2e3ce21dd2ce", "value": "196608:X+xwjpbi3gdIN4c28yLVw2CgYCqUCAmDS1hcmIEcgZ:X+x484l8cVhCgYHUhmYhcXMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335908, "uuid": "9f71fc3b-174f-4efe-a293-b36333bf7877", "value": 15605760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335908, "uuid": "3f867d6d-abf0-4da0-a547-a35bf48078a8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335908, "uuid": "70c53275-22f0-4442-80fb-ccb53dba85c9", "value": "4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0(3)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c67373-ba57-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762354543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354543, "uuid": "3668e2f7-55f8-40c0-aebd-06c22f268035", "comment": "Malware payload", "value": "8e8c117f7cf64e0f1755340073c6ad4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354543, "uuid": "218f543c-7a00-4bca-938f-4a8db05bdcb8", "comment": "Malware payload", "value": "4d29b92cb7989e35a24a70ff367d5c78a035a90ae3c6826548009ec4efd3233e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354543, "uuid": "ee3ae9de-7c45-4e91-b5d0-f43efa4e0ed2", "comment": "Malware payload", "value": "b3f66df4685f24fae3d16e5e79b90bb00b915c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354543, "uuid": "55e285bc-7a83-48a3-8856-5a489da9c2cc", "comment": "Malware payload", "value": "1299a4bf46d4a51f69844211b4fb966a2a685920e43947f817d80d1cd21ca02c74842983b9d48d1721ab3acd772c6f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354543, "uuid": "9a91ff46-6eb2-4a54-9419-3a9f7c2f84d7", "value": "T1C9069D15E39A01B5D42BDA38C6559333EAB17C566735C14F0A88F64A2F33B908B3F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354543, "uuid": "a2d18016-2d05-4464-9fef-b53f71916313", "value": "45ee8863462f14edd004410d748545e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354543, "uuid": "e5068923-f8e4-4482-a613-3f0041749a7f", "value": "49152:HY/nWFr6QaXT1tyIyKnbN52WL+rfRzby6Cr+zVo1yKwlMT:H/rK1wbMQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354543, "uuid": "44379baa-e59d-476c-8130-7f2a8e9bbc29", "value": 3742208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354543, "uuid": "809176f1-fef6-4df4-bbf6-b1df8e3acf2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354543, "uuid": "6ab04227-d8ec-435e-84a3-b71095be3130", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e816127-ba49-11f0-91c6-42010a9c0006", "comment": "Malware payload (Kamasers)", "timestamp": 1762348419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348419, "uuid": "29ed2c2d-5721-4546-9416-0c9201fca82f", "comment": "Malware payload (Kamasers)", "value": "4f7429c7135e65cc0650b1334486a580", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348419, "uuid": "61c069a5-7967-46fc-b24d-6653202c615a", "comment": "Malware payload (Kamasers)", "value": "4d69e1c88a9ca803fd7f02395dc2f3a737c32a13fe6ee801cb908fb075cd0e86", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348419, "uuid": "19c03708-6a9c-45b8-a586-f8c486cf259c", "comment": "Malware payload (Kamasers)", "value": "7927489235730c977894f20d41b0f107ed6a5286", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348419, "uuid": "14bb859c-b864-40ca-810c-7b44addafe7c", "comment": "Malware payload (Kamasers)", "value": "0c7e8b80cb3a63d4f18eeb8d0980a166f5b8ded640bd382fcfb61d2fb63fc1f6a7393b517223195d855e352a240dea5f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348419, "uuid": "35c12630-6df5-4888-88ac-28419ff395f1", "value": "T1F745231E17E43597E83AA37996F50697AB337AE22B3906FF51E494B40E131D8263070F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348419, "uuid": "63b7e7cc-e91c-44e6-b6ec-c55a82511931", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348419, "uuid": "bcbf1890-06f0-41cb-8dff-87896f77bed6", "value": "24576:ajIOHvCjQkPFxu+o31qBPs76ItlU1AyVVOcXLCR6B/oTRV:ajIekPT7BMlU1AA7Xu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348419, "uuid": "7146b64c-e76a-4262-b540-611cf01be942", "value": 1212048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348419, "uuid": "17aac4dc-cb44-4c48-a874-2f0a358aee74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348419, "uuid": "1507e80f-8c5e-4407-8fee-69818bf8d9d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224e6ddd-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376718, "uuid": "8d64d16c-d0a8-4440-9072-9aa3df98682c", "comment": "Malware payload (Mirai)", "value": "3f44f1457e01ab5e07e0aa52763f12cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376718, "uuid": "c42e8d83-816a-4d33-9cef-695f7ddd31d7", "comment": "Malware payload (Mirai)", "value": "4d6bc89b9a132c599018664307da6003d6a4a24766fecf6826f6e6a93af91c27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376718, "uuid": "f56f6d1e-2ad5-486d-9851-296275c10c1a", "comment": "Malware payload (Mirai)", "value": "a4a707574f9ff4a5636ed96494efa5d50c15be42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376718, "uuid": "558339de-e546-4f07-8e9d-f9a22de7123b", "comment": "Malware payload (Mirai)", "value": "b45380e3e43c1a7715ca1ca840b518b35af21c34073fae06a2a651cc255089cb043c75d7e919f319c11febcbfe69b2ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376718, "uuid": "dec32a92-a95f-43c2-8891-7cbaef3bcc09", "value": "T15EA2D029BF68828BC832797455D9E5D21297FCA1F29DCC4A2940C15FF0A33A96474E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376718, "uuid": "c0c6c96e-5494-4467-b12e-288081e8d58c", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTm:798o08kxofBE+ZkXaITbp2F2TWul0c5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376718, "uuid": "a46ece68-241d-4a64-a731-9a7fc73b06bb", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376718, "uuid": "77bbbc6d-efb9-482d-a9c2-70a4a32d38b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376718, "uuid": "1a33f3a4-6b47-4b7e-a15d-df319e8f3606", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc1ad10-ba6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762362992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362992, "uuid": "96dd2d82-b723-41e8-8640-2784db662750", "comment": "Malware payload (Mirai)", "value": "ce2e29262b8633444f1ba71bfb34ff6e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362992, "uuid": "fcc412e6-272e-42c0-9d05-9f358cc0ff1b", "comment": "Malware payload (Mirai)", "value": "4e27e0a50c2e828644da7f0478a0c9a6e4a4afafd78905305310d43f25771de0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362992, "uuid": "f585e3ba-1f57-493a-92bf-dd4c8572717f", "comment": "Malware payload (Mirai)", "value": "1a85176cfdaaba14323ec17d1f5599f1d012ad73", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362992, "uuid": "0674c07c-0281-4e35-b397-2b109cef18f8", "comment": "Malware payload (Mirai)", "value": "98b800206586bea5576927f03a9ac2bef2f79dd67dd26e6a9cf2765e6fd707d6caa60fdc417dbfefdff00f37279feeaf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362992, "uuid": "2373e426-988e-40b7-a096-3b026ba1bb53", "value": "T1981170505C95158768DBFE1C712A53F231412C74E590123DD2A7EE16C87EE32B50E671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362992, "uuid": "c3c6518a-b071-499a-926a-a59f0b096faa", "value": "24:XjI/syYzZ3OhXvuS9dLa+Jdz7+y5yswTm6:XU/J430vu4usdzzoJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762362992, "uuid": "efa7fb61-db9c-42aa-89e3-81952c4cb031", "value": 911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762362992, "uuid": "ea5ddb78-c61e-40fd-992e-bcd7d8d1b572", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362992, "uuid": "2503b5d9-adcd-4dc2-8325-241294d838be", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd26ae8-ba56-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762354212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354212, "uuid": "c66c9000-9a68-48e5-acd7-1ef7094036f9", "comment": "Malware payload (Mirai)", "value": "edbb4df30c24619771fd1554ebc1953a", "object_relation": "md5", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354212, "uuid": "c65d97e1-5a05-49ff-981d-7d9d352de7b3", "comment": "Malware payload (Mirai)", "value": "4ec8555c83f91e16871cb4a1e9024114afe311dbe67552f6cedcee164558d3f7", "object_relation": "sha256", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354212, "uuid": "a074d477-6756-47ff-ae34-8cea54f9a42a", "comment": "Malware payload (Mirai)", "value": "ddf935167ed88cd2e289db96aaf4cc73c8201006", "object_relation": "sha1", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354212, "uuid": "4222c76f-cb55-47b6-95a7-b8c58c33e7da", "comment": "Malware payload (Mirai)", "value": "148434c94c233903276cbb57dc723edea539cfc4a95e8941e36b564a6789fb06563e2ef1c8310202e32b333766521fa6", "object_relation": "sha3-384", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354212, "uuid": "570d79a3-df4e-4f44-9760-76ae94ed0f7b", "value": "T1E1D46C59FF4E3C42D2DBE3389B4A83A1722B75E4D32351B27941520CD9D6AE8CFE1A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354212, "uuid": "0f39995d-7fa9-47df-bdbb-2c39d279783c", "value": "12288:QeMeLsgst2zQ8asUZ3x1mjlrbyIBHJDFPs57fJRW39N:QzeLR/03x1mlf5o6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354212, "uuid": "93da365b-3539-4def-baae-de06828e4685", "value": 645376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354212, "uuid": "4d969527-78fe-4c2a-9466-22d793d585de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354212, "uuid": "99f0e67c-a2a6-4b57-9644-d89459579308", "value": "Mddos.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2baf666-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318630, "uuid": "6522058a-ba7c-4d9c-b451-0eee5c42d549", "comment": "Malware payload (Mirai)", "value": "8c7fae80972f7e2b1112766bde4d026c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318630, "uuid": "b5d3b685-3a5c-490d-92c6-3fe3391f189b", "comment": "Malware payload (Mirai)", "value": "4edc9b4519fd7a7b72b829340a1c05fa30d8b582f1ada19bcb50ae8814a83eeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318630, "uuid": "cca8b34e-e53e-4c4b-90ae-56cfd400ec66", "comment": "Malware payload (Mirai)", "value": "b6adfb10963c3b932e4e4f399ce182b33132ebad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318630, "uuid": "0914d0ed-8891-460b-98c5-abdf0394ecfd", "comment": "Malware payload (Mirai)", "value": "46f1a7ee4398f9c39e5c8ce86f34faea20dc739da92da988e8bff45520c244c8f6213eb7b209ba878cd646519ac624ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318630, "uuid": "d47d56de-ad3a-4146-bc9e-20c62b815a56", "value": "T1F7343B45EA418A13C4D117BAF5AF418A3332A795D3DF730699286FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318630, "uuid": "7c9cc54f-5ee4-4e2c-8392-706bc04c799c", "value": "6144:sQYf71uTCfH/a7KKck/l9Inplzf6f9ihM/9eAU:sjxKqH/a7KKcktOpxPG/wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318630, "uuid": "60924dfa-4b9a-4ec5-a9ac-32fb6f38595e", "value": 230968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318630, "uuid": "a899d526-4180-4503-813d-412bd801f0aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318630, "uuid": "81e620a6-f4e4-4651-a046-87231f06a004", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad450ca8-ba32-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762338726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762338726, "uuid": "ee47ffb6-bbb4-4e0b-896e-41383b8dab67", "comment": "Malware payload", "value": "fbc3e92928e7d34e3844ccebd4204764", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762338726, "uuid": "5f43514c-d28e-451a-9ed8-9019469273a1", "comment": "Malware payload", "value": "4f3162d17af4e022b3accb4a582a1e9902e6062dbed0b6aa99c2d2d7c4c23454", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762338726, "uuid": "c2e0f19c-a96f-499e-9c53-fc65d11a110d", "comment": "Malware payload", "value": "03ec71b74f87d4b85b872a03f30e58c02c9b35a7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762338726, "uuid": "757c7843-eb33-46b1-8d27-51ae42ca3861", "comment": "Malware payload", "value": "beeb428e814c5b4b65c201f7238eec96b5f7c8a1ed594f752253e23142446d3400b9f8b9a493408db659c38b7d3fdab8", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762338726, "uuid": "95fc4662-3758-4718-b3f0-6661895ebc8f", "value": "T13F5122041EE611D8E2738B396BEDB2775676F854E926EBFF004062404A24A50EC31F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762338726, "uuid": "00a99cf4-277a-422e-ba69-d1dcb6911e15", "value": "48:8T1AtvwEPO0Np/sRB/LfM8XXj7vkD9fMobale:8T1Atvwq/sHxXX/8D9kU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762338726, "uuid": "b09ef785-814a-4c2f-9179-327b96975ee4", "value": 2827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762338726, "uuid": "cc3bab77-6ae8-4cac-9dc8-478702426629", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762338726, "uuid": "46fcf417-0a29-4a0c-8eaa-3939373a5afe", "value": "Vecierok2025.doc.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccc7974-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316928, "uuid": "44eecd09-02b0-49be-9a87-f84ce5434d2d", "comment": "Malware payload (Mirai)", "value": "13f4b0a28b1e5b08bdac6bedcd0acd57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316928, "uuid": "31a89c38-aae7-49b2-814f-522e6e185471", "comment": "Malware payload (Mirai)", "value": "4f3de52ed263ee374741fc38bb64cc08c7bba38e59333c251eebc5b691c6255c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316928, "uuid": "590736a7-03d4-492f-8ea8-c28b841418b6", "comment": "Malware payload (Mirai)", "value": "8d900eef06b80428c84566ab2e29221518777bfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316928, "uuid": "654d5bb1-a013-4ea2-9dda-dc68c87674ed", "comment": "Malware payload (Mirai)", "value": "8cb8f9cce3c8521d5f38591eaf21a80e4d4bf590a7cd97dee1d330a5013cbc7120a6aa73ab6dca8f38d2cde1514cb894", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316928, "uuid": "ef8f0d6d-a71c-4245-b326-3ce6454363c6", "value": "T1AB73830ABF650FF7E8AFCC3789E91B45248D641A21993B797D34D818B24B64F49E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316928, "uuid": "d2d36f2d-08db-43b4-8388-6d0ab78e43bd", "value": "1536:JEGFfut1WjhZRcogB2UHqsZMDuPSwtOA3B:J7Ffut14hLgB2U/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316928, "uuid": "ed67df31-9cc8-4e32-ba7c-a9530a1ec33b", "value": 79884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316928, "uuid": "4dca1a5e-9cda-4623-9a88-154156fa9859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316928, "uuid": "e916da54-40ce-4ded-bba8-4ba3a5d2dd22", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d7749f-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319972, "uuid": "920a0386-91f6-46cb-93e4-68e8997bfb58", "comment": "Malware payload (Gafgyt)", "value": "90f0c11c893786427d30c70288694fd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319972, "uuid": "4cb57512-6f5c-4a09-86e1-bd7961b608c7", "comment": "Malware payload (Gafgyt)", "value": "50e266ff4a2365b37ad52c1f0e14a78db5738f00c17ab880abc786743bf8e416", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319972, "uuid": "957ce8ac-68d3-4c42-9815-ceaad14992e2", "comment": "Malware payload (Gafgyt)", "value": "4276c220d6494f1d489d50d8eae99bd4faea4ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319972, "uuid": "99785dd3-6e4c-40c7-88da-e00b73804e55", "comment": "Malware payload (Gafgyt)", "value": "a867b57041eef8d746453e9ee5ac61034ccf4f3ed6105bcbcd4ffae96c2993617a67ee87452a306c263d4e466d48e138", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319972, "uuid": "5af80de5-0e9f-46a1-bcb7-6d5051c87ee2", "value": "T180F3833E7E22AB3EF268827007F66F71DB5511D333A29292E17CDA544DB124E188FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319972, "uuid": "5673191b-373b-4414-b60d-6e18a2e9726a", "value": "1536:3DAeYQquNCA4+LiX/2rKOoegIeDetexL2rKOSev/61ePe5efeo6me26oTenDaCA8:M17Gzn5KnDaCnvymG5hb+US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319972, "uuid": "167d84b8-cf9f-40e9-95c2-251a30291b49", "value": 168340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319972, "uuid": "1a265e3a-b8fd-4fc0-90ff-c9f5979ef248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319972, "uuid": "932fde06-a998-4599-abd1-a8037f412d00", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a12c1c6-ba11-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1762324279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324279, "uuid": "37a8362f-16c8-47d4-afde-3fe840fab589", "comment": "Malware payload (GuLoader)", "value": "58c0a31d42952ddfbb3f9db3a262b1b3", "object_relation": "md5", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324279, "uuid": "63127fd4-9606-45be-86d8-f9f60f4ec848", "comment": "Malware payload (GuLoader)", "value": "5209f5cfedb14d3f5fe7e51a26560d2665c898706747120d8ad44c0c2667181e", "object_relation": "sha256", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324279, "uuid": "dfbe7aca-daf4-4abf-b0f7-3e0b1b694e34", "comment": "Malware payload (GuLoader)", "value": "a639e77e5b0dfb5e80662fdd8dd7b5d3410bdc15", "object_relation": "sha1", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324279, "uuid": "15891e57-c364-4d74-97d6-223d6fe336aa", "comment": "Malware payload (GuLoader)", "value": "37bb77c538378ef73b6c3d6442c5e5315869d6641ba9be9bf56e654940b3dc4964fcd453647a0b6104aa72b68732524c", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324279, "uuid": "c09660f0-15d2-4652-8019-b3b82a3e7d73", "value": "T15B6523E1BE54D5F5C57552B08B77A698CE22ADA661412923360E338F3F7B1018B1F38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324279, "uuid": "f7a2518e-527f-46a5-b116-06458f063b3f", "value": "24576:8yG1qpfQfJtOutBz+sTrMEnPaS9Jv8MPtquN:v8qeRg8BzPMEyS3LPfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762324279, "uuid": "17fd6c13-2ffe-4287-9fba-6a2a3c738943", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762324279, "uuid": "da6fac36-efec-4c46-9ae1-103e75d7e068", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324279, "uuid": "535b024d-cd70-4952-bfc3-1f3dbe30d3fe", "value": "5209f5cfedb14d3f5fe7e51a26560d2665c898706747120d8ad44c0c2667181e.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464d4b0f-ba25-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762332970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332970, "uuid": "9c285a7e-8a77-415a-86ba-ac55085e1939", "comment": "Malware payload (Mirai)", "value": "39e594689c3ca95cc8023a9ea4645546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332970, "uuid": "f5810001-b679-4f5e-b4a1-e8f11538203b", "comment": "Malware payload (Mirai)", "value": "5226e3b42cb934bcaab4e614cbe96dc4106a33b07451f56abf0ecf6e8fc9fc6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332970, "uuid": "f08377f1-2a16-424f-ac18-97cbd8600c5e", "comment": "Malware payload (Mirai)", "value": "fa10f5939b2ed2d3f2a5e0be041c433d77a0bd07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332970, "uuid": "2c15f995-7eb7-4d1c-b128-c4d9cd98416c", "comment": "Malware payload (Mirai)", "value": "45e6cb4b6f69b6a39c397388bfb76b8e62093c20db814dad561a05428ee759d2ef147a8539781df47044219af6fba0f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332970, "uuid": "80b71d9e-ee79-439c-85d4-cd39593a41e7", "value": "T1FEA2E01462632D66E3EC1C3DC96A835BF9A70BFC90F6327679415620C94D60A3E3CA4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332970, "uuid": "8f14f137-6a9d-476c-9636-d69e52bb391d", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjgEFwhymdGUop5hb:TvQn4j+ZO5fKAlxVws3Uoz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762332970, "uuid": "f9afe6db-25b9-4f62-a312-d09328b4d33f", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762332970, "uuid": "775f14df-07bc-410d-91bc-3e1925605b88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332970, "uuid": "4fb92dc3-612f-4b83-b350-714340529a99", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3de007-ba4b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762349333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349333, "uuid": "a640b242-b4e3-4688-958a-773e7943aeea", "comment": "Malware payload", "value": "11ee6a0fdaa5e3097831fb124076fecb", "object_relation": "md5", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349333, "uuid": "eb4fb808-1008-4a0a-8c22-4fbc1d1a836d", "comment": "Malware payload", "value": "5310cbf5067a34b198535c5245be1a08296ce9525ce7748fa9ffc91f246fe9db", "object_relation": "sha256", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349333, "uuid": "66d5c6b3-2752-4839-88b9-7397ff3ae6ad", "comment": "Malware payload", "value": "f43ec410286e33c8244686df8e3703f7f5006883", "object_relation": "sha1", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349333, "uuid": "c7a7feca-f589-49b0-b3d0-7be2579d8aed", "comment": "Malware payload", "value": "09620b76c9d63ee1e94f3acdbd3f7f3bdfb87ed42cd6d5cedbdbcc3e8ff67c4daae5d730a260d0d02b7784d81573b3d4", "object_relation": "sha3-384", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349333, "uuid": "767dbeaf-0452-407a-9203-8995c70fd1b9", "value": "T12C3523952928D212E2E59BF11DA3DB3903BC6C6DD2E4E66B4DFC9FDB38117229900353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349333, "uuid": "6399c24a-2c9a-44a5-81ab-a81009ca3648", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349333, "uuid": "a7d7dfaf-7f2a-4c9e-ab4b-1a42737d490f", "value": "24576:Lk1b+W4ROsT5Z5iUPvhBYcjVob9J/hoEvE9eYfci4Y394YTi9BZ:494ROY56UPvHTjiRDzYki/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349333, "uuid": "8868e164-20f4-4760-8014-1f729e1996c2", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349333, "uuid": "ed2e1761-7649-4257-9ca7-3273ccc58582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349333, "uuid": "4a758d16-7f89-44c1-94c5-7b9253dfa076", "value": "vrc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b19578-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762335940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335940, "uuid": "3be5b717-00dd-4e1a-9fda-f652086e6fbd", "comment": "Malware payload (CastleLoader)", "value": "22b5bf2931140fae49228ced1d1dd3d7", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335940, "uuid": "1c23f463-2ff1-4c3c-8440-b512ca329936", "comment": "Malware payload (CastleLoader)", "value": "53dddae886017fbfbb43ef236996b9a4d9fb670833dfa0c3eac982815dc8d2a5", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335940, "uuid": "047a0547-57a9-47cf-a006-8e55547c39a7", "comment": "Malware payload (CastleLoader)", "value": "c690cf054b0e29ac37bd2ad703e25caa734730fe", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335940, "uuid": "c0077c5b-72b2-4390-ae98-d19031468dd5", "comment": "Malware payload (CastleLoader)", "value": "5107fdd6abeb616108bca55ae175994a3d7ceac3bb9f0d55b9d7f8832303db1b1e0edeb82252450794fd69a21abfe187", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335940, "uuid": "83a7a110-208d-449a-8b50-6f702ac58ba2", "value": "T189843CA8841600CCF5ED743C8C54D19584BA2C65916D6A27B3EFB37AFCC4209DED7AE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335940, "uuid": "641f53c2-e439-4d45-97d3-d4e47f6876d4", "value": "b2634dc70895e8501bb2c9333ac90351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335940, "uuid": "81410f09-313a-4eae-87f4-0c8ecc3bd561", "value": "3072:ZfAJNCghJSUKX8DSp7sMzhEKQHBVbB+kU2DepV3xBSRaQJ91d2AU2jNWNjSEl:ZoHCgheZsmYlUbERaK9mpjSEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335940, "uuid": "a08d1f07-0a28-4f42-85d5-ebc8d983eee6", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335940, "uuid": "74b936c0-3716-417b-85d8-3006ce59df10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335940, "uuid": "bd97d060-cd50-45b7-8961-61b8bff2cff3", "value": "53dddae886017fbfbb43ef236996b9a4d9fb670833dfa0c3eac982815dc8d2a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b39053-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316801, "uuid": "983afdd3-0814-4c62-8029-446e0c0cb9b0", "comment": "Malware payload (Mirai)", "value": "d67172037f2d521d46a94fdd28feed91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316801, "uuid": "de7d6b97-841d-43f8-b927-f056db37d6dc", "comment": "Malware payload (Mirai)", "value": "53fc7411a3e6a075c22c9af5d61ceb7e5c7c2dc53a81cba9e7d93aa96fe639b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316801, "uuid": "19180e6f-b8cb-41eb-88f3-040184247ef4", "comment": "Malware payload (Mirai)", "value": "a839d128c48216531012f16294824012f0af2bfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316801, "uuid": "6c30982b-d75a-46ba-843a-222c148d325f", "comment": "Malware payload (Mirai)", "value": "77fb225b821a972ffb3889ea987d448dddd502c0af4ba91d915fab49c5fffba8b40dd87a30dadc00408cc38ec92544b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316801, "uuid": "9ea945a8-97fb-42d6-9801-56e43ee23d20", "value": "T10B639209BF611FF7EC6FDC374AE91B4525DD641A21A83B397930E818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316801, "uuid": "da088bcd-1da8-4d95-98a3-10918f934146", "value": "768:zlDScD5GY2ne8i2Sxt9yYExR15I3I5vTemle5Re5brvuX5XiANe1j9sE:zlDSC5G9eb249FKeI5fl8RWb7Sq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316801, "uuid": "379f6092-42ea-4886-ba56-032e11f4e485", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316801, "uuid": "6be62b2b-84e9-497c-a3e7-a2aed47a3d42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316801, "uuid": "63d5f6bc-b0d1-40fb-b736-d572015d6072", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae57620-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316818, "uuid": "de0775d7-ed42-43bc-bed7-a0bbc1a86910", "comment": "Malware payload (Mirai)", "value": "18f4a12f5bb8887c51c8c4e183e9b28b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316818, "uuid": "f874b058-23fb-460a-a42f-a2f6c62c2e9a", "comment": "Malware payload (Mirai)", "value": "5503bf330b43d6a4de09c7bcb9d9713d767f3561b4324e4706a910429eeb9c47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316818, "uuid": "0dcf6110-1a30-45d6-9af0-dcb1592d7af2", "comment": "Malware payload (Mirai)", "value": "c0e028b7a2290f2191f0154a3e5e3af81b094158", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316818, "uuid": "2c153a5d-7abb-4798-bac4-d83d137d67eb", "comment": "Malware payload (Mirai)", "value": "88c2120de059496bc8d11f856c576bde0223d695dfee5f4ea8550c11bb1f67aaa34e5e01f11c7ff78224ab27b2a27976", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316818, "uuid": "d8bcf694-448d-47ed-8975-7040c00fb8bc", "value": "T1B563854E6E719FBCFBAC863447B75F209248339626E1C684E15CEA011E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316818, "uuid": "be9a1f62-a39f-4796-8253-74873301f819", "value": "1536:w8aCKgyaDrIjtb3stmjpYpt13vQCbaOF81UQ+eM:THB0Jb3vyptJQcaOF81RHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316818, "uuid": "2725ad1d-188a-4ffe-b14b-f4de5ab72d16", "value": 68256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316818, "uuid": "85f1f7bb-ffc8-45d4-930b-5ad9eca9d2a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316818, "uuid": "27adaa1b-2484-4dbb-9f08-d243af638eed", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef0ed85-baa3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762387128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762387128, "uuid": "dae7b0f8-4f1d-48af-a8d9-b856efc6b4a2", "comment": "Malware payload", "value": "63fd30ca16c15600abd7acb8fad038b5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762387128, "uuid": "bf6ef632-019e-48c8-9dcc-38bbccb5a167", "comment": "Malware payload", "value": "5535e8292136aff3c6f3eb2637d3b921673e8372a3f8c2b4c75ea61433137306", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762387128, "uuid": "a5dc0c26-2543-43a4-af80-22567ab11416", "comment": "Malware payload", "value": "7c297fda3acab1d5523ffc1f6d0b753f8c6b56d3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762387128, "uuid": "49ea0e97-2af6-461a-b0bb-b7b4df62842f", "comment": "Malware payload", "value": "dc5972c57b0e61e79179f4218fbe58a6b218b3f4e88350b3303a3d838f4f428561641bc9e6832791eccbe45df5f89231", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762387128, "uuid": "fa6e6437-fb67-4c6a-860c-4ca29228d2e4", "value": "T15C657C1BA7B801E5D1BBC138C542661BFAB1749693309BDB17A08B571F23BF19A3E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762387128, "uuid": "a9153936-5093-4dc4-9b34-6e4ae4e6278e", "value": "6e37050815cd8ea66c05b239e6f346d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762387128, "uuid": "b0933ba1-f58f-489e-b6cf-d23d1427c44f", "value": "24576:ZhDkDkF3we50j5hx0IRbDHOuWFrsFlat3euwuGXHlFm+zpySHkrvDA:b1weU5hx5ZzOuWpsFlat3FUysir8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762387128, "uuid": "6c57970f-e200-4472-bb3d-c199939aad6e", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762387128, "uuid": "01487fa0-e413-4fe3-b747-52209f22164e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762387128, "uuid": "083dac88-b4f4-4811-872f-bdd89bb915bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d78686-ba72-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762366044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366044, "uuid": "3566e212-8b06-4ecb-a7c6-f6da77e9eee8", "comment": "Malware payload", "value": "a5e7c0904f9a4cc7c0cb67c3acd84b96", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366044, "uuid": "c359129a-98ed-44f9-9a7e-de0f46ab46b0", "comment": "Malware payload", "value": "553b1172f2586c3d4751d7ff411cc6f59551fe9eca471306e171c9985a94f29e", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366044, "uuid": "b7935e0f-97c9-4f5e-af03-c5e90748570c", "comment": "Malware payload", "value": "bdd62e65b04c771d55a60ac9b971abc665d31722", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366044, "uuid": "09364925-038f-4e66-b30a-db21e8df7dba", "comment": "Malware payload", "value": "5a9f8e65c3f17ef21825b1fdb7953be74c02cefbb68139df1b42450f19a7c927c1b8e6057dd7d473bbbf590d07f51865", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762366044, "uuid": "44bd8b02-29c7-40fc-9ae5-8c5f351f417b", "value": "T1D8A1B7E7E2F8DA5F305410E8952A320B60E1C2BE4CAF834455D2250FE52F851AF2B7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762366044, "uuid": "460a30b7-5230-4f48-8e16-e4d49811729b", "value": "96:0eShGbr/bbbognW6yuE2jfR/ubkMCotxMT1RytxMT18AC/20dVDaOzp0rAPY/up:0zGbTbbbogW6yuE2jZCksteT1RyteT14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762366044, "uuid": "d1a1cc08-e3bd-4f2e-ba4f-962014026374", "value": 4916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762366044, "uuid": "bffe2749-69c0-48ac-82d0-103d79d151c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762366044, "uuid": "808bafae-324e-42aa-84ca-1b3ecd5948e5", "value": "frt44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2808b9-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318620, "uuid": "10a95b11-c90a-487b-8679-87c641d3eb55", "comment": "Malware payload (Mirai)", "value": "0a5bc1cfae3f133a0f6b69c4cd657304", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318620, "uuid": "87884607-744f-44eb-8e86-9d69a58d70c9", "comment": "Malware payload (Mirai)", "value": "557c1a4e119e7ca565fd759324bcac817c843b162eee9738fe77bfb3fac46c8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318620, "uuid": "e247cb9c-7ed3-4ce6-a786-dd10e190204f", "comment": "Malware payload (Mirai)", "value": "4a49e23587ed485a4c229bb255316b8e3fed5e56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318620, "uuid": "53dbe8c7-8b93-419c-b35d-9014ce8cc463", "comment": "Malware payload (Mirai)", "value": "41a03892b253870c6287c804392f0cb1b694b59cdb27ce20146bb533193620fd7100660dd6e87d81f2c11d4d8c09cdb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318620, "uuid": "bcd5449e-b6bf-45a4-a185-0bcf91dea34e", "value": "T12BE34A55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318620, "uuid": "00591a5a-c694-49a5-9bdf-6efaaeead1d4", "value": "3072:ENUkePbhroLLoLTPDADuOu1sya89LjPEKe2+IOkr:weRoLLofPD2u6yawpe2Akr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318620, "uuid": "35673143-d8d7-4f35-94da-4587f44605bf", "value": 145544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318620, "uuid": "7b2e6337-d0ee-427d-a760-fee803a99cfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318620, "uuid": "f27dd93f-5c57-4307-b148-dd416c89fe6d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea08660-ba14-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762325844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325844, "uuid": "86bb59ef-f871-4581-9619-fa4b75cc7f41", "comment": "Malware payload (Mirai)", "value": "31400dbd5a84a6bc12d522aa3909be4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325844, "uuid": "9257af4a-a556-4c11-9856-285c3e6c9478", "comment": "Malware payload (Mirai)", "value": "55c7bbcc7ea8797f2484fa06186313b85d0bfd834fa851d2ac7f3ea688c5ae13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325844, "uuid": "cac7c62e-ff5c-4bb0-8754-bf7adebfec15", "comment": "Malware payload (Mirai)", "value": "308980a3f3458faea0d024d0103bdf0a554e983f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325844, "uuid": "c766f7a4-2806-4c81-bc81-582408d34fe1", "comment": "Malware payload (Mirai)", "value": "7752c386f2677b69c15166aec30b78e37e82a6954f626f5bae8c2782f264e597665c03d1562cd11f2c8c823b58ddffba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325844, "uuid": "5dda95ff-dd90-4a94-9729-d43bdbc0fc9c", "value": "T15013F1729B61D2A2C3316DB76F9400457CF9C40CA2645D95BCF6AEE06AB03C1133AB77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325844, "uuid": "d6291cf8-2b10-43a5-98c2-422b0f65bf08", "value": "768:Qmj26DXGOKDyt2IL9Rhiya/AZdgqabJt7S/slvRr369reaX6+Ey/5rQtr1rcHIFR:bjVyOf59W/Bqg5O9reaXVi1YHeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325844, "uuid": "c9dad1a5-5e69-495a-8f19-48b5663538a9", "value": 42216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325844, "uuid": "c4268342-eddc-47bd-87f1-4f684fb97a40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325844, "uuid": "ffa14ebd-05cc-4a01-b4aa-4b75b4692333", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e360e796-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318631, "uuid": "34a045b4-252e-4f92-ac80-37203cec23b5", "comment": "Malware payload (Mirai)", "value": "ec0bb6454566195187bcc8095561ab5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318631, "uuid": "b311f22f-319b-4594-acda-29ce615cb5b3", "comment": "Malware payload (Mirai)", "value": "56e9531906023a89d7a9f5387071b14c474065f7250ccc612dffa5f37c64eb3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318631, "uuid": "66db8f25-21be-44bc-922b-1b818caad781", "comment": "Malware payload (Mirai)", "value": "278226a8751a396d8d282ee45b9ba1a93e75eeb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318631, "uuid": "4e51fcf8-e94c-4e9d-8fdd-35a15f544e29", "comment": "Malware payload (Mirai)", "value": "0ba141beedb10d817a059b9aa3eeee5730ed075f648aee1b6e9c08ffca4ff0aa8671ba16a4ab709be213b39d61dd0ea4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318631, "uuid": "e42e5230-db8c-4a7a-85a8-581593d28009", "value": "T16313F15138C4C4FBFD46A43C9720C111EF97392AE7646A452DD46E48693F4029BBBF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318631, "uuid": "b642cffd-b2f4-4409-a3a8-1a0b64abb844", "value": "768:vAOIC6VRqqY9bFX7z4sUwDNPTt+rfKbR8Px4eFN5XjmB9qFsJNAcc1XbMM3XtC5A:IvlVEqMp/4PwhPTEZPx4eFXXqBAyJNAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318631, "uuid": "2775d687-2011-4ca9-b4cb-00d9409bc327", "value": 43824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318631, "uuid": "be188223-0b7c-44d8-8833-b92db28ca107", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318631, "uuid": "80c5bd5d-6873-4f18-ab4e-bec698841085", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3700c6-ba95-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381379, "uuid": "d6f42164-22f3-40cc-8bdb-7294abac9f33", "comment": "Malware payload", "value": "2ce6275f5ffdef3f4a7ca43a2c4e318e", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381379, "uuid": "a7aae5a6-ce1e-4b7e-981e-de3a1036b246", "comment": "Malware payload", "value": "5708abf69a3953d1f9ed9c407e3ecf646a022aa400a13149e25cf54cdaba914f", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381379, "uuid": "3a2ba300-243f-4020-9de1-602274c386f7", "comment": "Malware payload", "value": "39477bece0e8b4b06ad07ed1bb31a5ad1d67b7f5", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381379, "uuid": "060b6247-8a93-419a-9afc-5acdbd6e3350", "comment": "Malware payload", "value": "d2f2a1ec485230213cc49a0d537ea794bf2f2aaef953d4420d64f48b8871f3f84b9506c6cd67ed4f378c5ed8c362495c", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381379, "uuid": "77a16ddb-ca15-4b63-a845-4d54cba8b6c4", "value": "T11A5402A8727D6E4F84F948B617B69378B7D19E0FB30B396404A981657C6C1F253084AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381379, "uuid": "703ebf6e-5e4e-4b1f-b43c-59007711095a", "value": "6144:fe1BGEbOyZRL1jufDe1BGEbOyZRL1jufDe1BGEbOyZRL1jufD:2pbrZRduypbrZRduypbrZRduL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381379, "uuid": "c041fbf6-0555-43f3-93b0-ff80ae4a4ce5", "value": 294768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381379, "uuid": "418c7ec0-d310-4aa6-9922-af6aea5e4b28", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381379, "uuid": "049d923f-af2e-45fc-af7f-2cb1bc8d2664", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37242c7a-ba43-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762345829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345829, "uuid": "988d8f8d-3243-4365-ac5f-cf82d28f3cbc", "comment": "Malware payload (Mirai)", "value": "a10484c594162a2f32d26a01a419ac40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345829, "uuid": "7354222e-7008-4e7d-a26b-a1769a0b568c", "comment": "Malware payload (Mirai)", "value": "581020250615b2f71058ef26a62a4b4a274a5b9649c3fb260e5b80e25c309613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345829, "uuid": "3143185d-0e80-4caf-af40-3759c99eb399", "comment": "Malware payload (Mirai)", "value": "27ddb47900cbcbc912b60ce1c3c3794da11a1801", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345829, "uuid": "2134c2dd-8230-41f7-acbf-b1f84962b294", "comment": "Malware payload (Mirai)", "value": "ca790fb71559d082cdd5bfc1bcea99d4edaf0e64c74c0d3e292f99a27e4a312d8de91ad814495f2c89c70e7721803a24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345829, "uuid": "082aae9b-d4ae-4521-b113-59a369dc61b6", "value": "T17DE45A06EF440FEBC4AFCE30852E835B15ED9D9706C1A678A0BC8D9CBA9D1594FD3448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345829, "uuid": "632c72a3-9bd4-493b-b24d-14739b2191d2", "value": "12288:bGTNnrLKb6hOfrXUrbOjRlOU1M+iZk3RERjWfPf+iHMxDSUk43rKRqiEr3Ind3FI:mOrnrM4HXxXIARqYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762345829, "uuid": "f2f9936c-e2f9-45de-86a9-baedd4e6072b", "value": 710268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762345829, "uuid": "bf382a1b-3aaa-46c6-82fa-9d16f2d76224", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345829, "uuid": "83e14f25-c118-4b1d-9e44-782bc5e0f74a", "value": "Mddos.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058af037-ba11-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762324271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324271, "uuid": "56237e55-e9bf-4337-8335-b85b4a0cd089", "comment": "Malware payload (AgentTesla)", "value": "d048c2504e900c93e0fa73f6d85a056a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324271, "uuid": "e6117c80-57c2-4a6c-a887-df93fa9944e2", "comment": "Malware payload (AgentTesla)", "value": "582e661abe0557dddc886bbb324901c191504549cd1c3a1b4a0c8438d69ea098", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324271, "uuid": "0f0ec475-c5b0-44d0-a446-e98b13f9a67e", "comment": "Malware payload (AgentTesla)", "value": "3c6eb256058038c498f5ea436472719a4b5b1a69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324271, "uuid": "979d0b10-ad05-4eee-9f50-76ce7d3f3766", "comment": "Malware payload (AgentTesla)", "value": "5be9249d9467f591ac278d819815dd70ca1ebf0162aecdf4b7cbcaeceef26c414df1a956385bb3e397958220b53f2718", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324271, "uuid": "e99ff213-42a9-427f-9946-ab2c39f8d338", "value": "T1835523B4F694C832E80959301BBE5BDA1DB27D0341A6260F7B4C23F5BFD6E95DA09123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324271, "uuid": "8c674e58-117a-43f0-af5a-be4295cf3a01", "value": "12288:PXK8DythedguoxIqZGqug1b8oVcjrqb97aVFh/uTUGgImjdbg4pMCVTar:PX3Medg4qZGquc8Xjuu3uT7glzMCVur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762324271, "uuid": "d6333cbd-fdcb-4895-a32f-f09db742d161", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762324271, "uuid": "0d195471-e045-44c8-bf78-446d1e8a54d4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324271, "uuid": "f22cd317-50a7-4264-baf2-10cf8d291596", "value": "582e661abe0557dddc886bbb324901c191504549cd1c3a1b4a0c8438d69ea098.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0b529d-ba4c-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762349923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349923, "uuid": "2b5c70c6-b4f6-431b-be68-a0580f5cbc57", "comment": "Malware payload (PureLogsStealer)", "value": "855bf16e88810592d993592e4552b065", "object_relation": "md5", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349923, "uuid": "f016ded8-4883-4763-9866-2cd9cd1f3124", "comment": "Malware payload (PureLogsStealer)", "value": "5866086aabad6058bc0f6fda58ea98a3bccad73cfc1c2a992851a8e97e2e9181", "object_relation": "sha256", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349923, "uuid": "798e3c36-8bd3-485a-a231-05c09d9711ed", "comment": "Malware payload (PureLogsStealer)", "value": "cf95978e528305c35cc3e39d08cd0fe70bd6df76", "object_relation": "sha1", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349923, "uuid": "9f0c2da5-b259-4404-aa69-aea532961dcc", "comment": "Malware payload (PureLogsStealer)", "value": "8cb685676bf907bf768fb2d58f1410188f8134b9739e564dd08c191ebddc1896d90e37dd38a28886e3d26f81a5837aa5", "object_relation": "sha3-384", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349923, "uuid": "47462d14-1fe3-492f-ad06-943a136d8fdc", "value": "T1D22512913359DA16D62567F42DB2F57203FA2E2EE421E2976FC66CEB3532F005A00B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349923, "uuid": "8133deed-6067-403e-8acb-c3f387735450", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349923, "uuid": "19ff2fa9-400e-40e4-af2b-f5e1b52f4d39", "value": "24576:ptmOqFIXwnE0rfJZNcANWFNgIt646gFr1VpOOUDIt:pMD2Xwdf3NAFj6iFrZUDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349923, "uuid": "ab7ef15b-b42f-4ac0-845a-6a40c4844b85", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349923, "uuid": "f53304af-88ff-4809-8ed0-7c168006c2c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349923, "uuid": "4254bcf1-dad9-4f3d-aee4-6a4b31052c68", "value": "5866086aabad6058bc0f6fda58ea98a3bccad73cfc1c2a992851a8e97e2e9181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b82b39-ba10-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762324250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324250, "uuid": "4aecacfe-8372-4ae6-be65-b17712e76197", "comment": "Malware payload", "value": "0786b9989361549ac1bf5bfa8c64aed2", "object_relation": "md5", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324250, "uuid": "900a78b7-07d3-443d-a501-54fa5ea782b3", "comment": "Malware payload", "value": "589a6a982ba231f86022a258db0ec763042945ad6e147bc301f3c6860c7cda30", "object_relation": "sha256", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324250, "uuid": "bfe210c9-3bf8-49c9-bb77-05da8124ef79", "comment": "Malware payload", "value": "15469a4d780fb310cec6e58041569a298d3aab0b", "object_relation": "sha1", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324250, "uuid": "b21d4366-949c-4a28-9f2b-4de81ae171c4", "comment": "Malware payload", "value": "9d1f4dcd1cfde0fffc8bfefc3a0fdd0524d36bbe11c1afd2c5fd002a0e6d7466cef8325712a49c6dcdb1a53e2cf30941", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324250, "uuid": "3828ed23-1159-4f60-af02-63b9b69219bb", "value": "T1005501D036817491D968A331087998A7477FFD34AC75C20EF78C7B6E6B7138E856AC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324250, "uuid": "c3ef01c0-ceae-4557-aa9e-f413a49218b0", "value": "12288:BuoS1Rnqm/L+t1lVTXcDwD6fd+Z4XTOGiRnz35cTe13:cT1Rqm/k1lxXcQp4TiB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762324250, "uuid": "d2a0db26-b014-480c-bc3d-1dd6b1fea5f8", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762324250, "uuid": "d8c3b481-a24f-47d9-a3b2-0d1f4cde16a5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324250, "uuid": "962846a8-6d08-44b5-8e83-2bac84d0a2d7", "value": "589a6a982ba231f86022a258db0ec763042945ad6e147bc301f3c6860c7cda30.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cacc8d9-ba4b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762349355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349355, "uuid": "c6eec727-15b6-487a-9c4f-d16a4ab74292", "comment": "Malware payload", "value": "7e76dde042f79b2216713b2d86110d75", "object_relation": "md5", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349355, "uuid": "cc02cdac-a622-4a00-a69b-4c4e82c2ee34", "comment": "Malware payload", "value": "58ce063b0d0fd247f0bd4386bcd11523c72d5d9845157ef6c9b9f206ca16cd7b", "object_relation": "sha256", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349355, "uuid": "2bd7d2f6-60a1-4a5c-b4bd-3316e681c4e5", "comment": "Malware payload", "value": "dfa4f708534f56df03b96572cc9bdfcfbbc3a795", "object_relation": "sha1", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349355, "uuid": "f4cf0e2b-bcc2-4061-9998-b1736e064455", "comment": "Malware payload", "value": "88c9d1c802067114ede26b714e2c16d8c2d4121a84cde0eab16a95635e78c3a96512737c1979aa27c6e227def86397c1", "object_relation": "sha3-384", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349355, "uuid": "83c8a5b9-7474-4c59-83ea-69ae06395485", "value": "T16C33BD99D38F05A5CF54A77B132A4A0946FCB33EB30841B174AC933037EEC2D59A5578", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349355, "uuid": "2cadbe32-ae40-4937-90bd-d411b97bf748", "value": "768:h6VaqiO/zSMxMZ1TMEY9eUb75FlBJowgDdJHU:2a6/zS2IZa5LondW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349355, "uuid": "7c06895e-90ec-4868-af35-11f07a28528f", "value": 54066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349355, "uuid": "6e3c97a3-1196-4302-8a39-aad59738493c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349355, "uuid": "c7487e79-1bab-4a19-a482-a495387caeab", "value": "58ce063b0d0fd247f0bd4386bcd11523c72d5d9845157ef6c9b9f206ca16cd7b.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c7be2a-ba4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762348943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348943, "uuid": "5c484c6e-9768-4520-91b0-386837f0cd9d", "comment": "Malware payload (AsyncRAT)", "value": "ec9809d21cd498835f5159f4e5fb67b4", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348943, "uuid": "1ab0760c-1bdc-4809-8003-99620b0d3d0c", "comment": "Malware payload (AsyncRAT)", "value": "58feec056844480f2d8dcd5ef9569cb914e333647fae523eeee5dbbd4190db0b", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348943, "uuid": "d352aefd-0a31-439a-858e-cea4db3486e3", "comment": "Malware payload (AsyncRAT)", "value": "6de303ea3ca8afc3fe8083e0a13b7ce94372f528", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348943, "uuid": "85fdf1c6-fa20-46eb-9ab5-0db2730690c3", "comment": "Malware payload (AsyncRAT)", "value": "913703366134deed6b0a4f2d0407eb89f8dca53d0d1a1454ef8d14f7f2ee3b02e45e41c16c8353ad27de49bccdb3f305", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348943, "uuid": "8ec41b0e-d248-4e0b-a823-30f9c3e8f5c6", "value": "T178C39E003BD8A59AF43DCFB49CF2A2850679DF562553C29C3CD0AABF6742A85C901FE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348943, "uuid": "d05fe47c-deac-4725-b97d-0426da858f65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348943, "uuid": "38035815-2a94-41e3-80f4-3aa83a2a3e7b", "value": "3072:vukhT0ML2IX8UboHNiy1e5BV0WUniyimyzW:vukvaXUbeNle5v0WURyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348943, "uuid": "b1432166-c94f-4abb-9583-727818361568", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348943, "uuid": "64cd37a1-adb5-42e5-97c8-2820bfd4e7f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348943, "uuid": "fe953d40-50b1-4db1-bb31-00d22696db05", "value": "58feec056844480f2d8dcd5ef9569cb914e333647fae523eeee5dbbd4190db0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d21a60-ba72-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762366334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366334, "uuid": "bfd826af-03c6-4e91-99c1-4297c1cebd7c", "comment": "Malware payload", "value": "d430cd1780b2668a0e4e30dad463dcac", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366334, "uuid": "fea99819-9040-4960-a95f-2dba593ac1f6", "comment": "Malware payload", "value": "590f3e583d8f900ad3c2b2e24fdcde62f3b73bcdb6d97749ce62bac77d21d6ff", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366334, "uuid": "bbfbdc79-1b72-4ce5-aeab-3b3a0854f2c1", "comment": "Malware payload", "value": "8c3495fbde9a5240be52e4f45e5f5f407c794172", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366334, "uuid": "9bfcc4f0-ed1c-4ca1-9ad9-fc007fcd256c", "comment": "Malware payload", "value": "f0104f1a4dbcbbd8e1f2423c9d9b990049882494608be4f85a0d8ec709f32b4cd44ca5fe130e92a882da24e98132e42b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762366334, "uuid": "c9bf7071-4edb-443e-bcaa-943a9ba9f514", "value": "T1AF0533CDCD3E355E5A3823920F6F1131684D7F9B48CAE1ACA35E7794A068B874B5F029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762366334, "uuid": "464d3d5b-4856-41c6-92ea-4a76c2872eb1", "value": "12288:lAOBFwLyBRE5Ny1MUCvnpFGzgc67yPpiZ7a8WyU3deUfKB2+UfokmtTMU+ouviw:lFH+4MUknGzgA070tevBYfo5WoSiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762366334, "uuid": "a835f940-051c-4f6f-89ba-3cd9bf0bffff", "value": 812454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762366334, "uuid": "ab5cac6b-9420-402b-8ef8-2bb1a228131c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762366334, "uuid": "261879e4-6d7b-4d5a-ad7c-5f6444f69796", "value": "Quote.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6165e674-ba28-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762334304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334304, "uuid": "4e025f84-c8c5-48c2-810b-0aeadc936c0c", "comment": "Malware payload (RemcosRAT)", "value": "99282b06c0e6555cdd326255ecfb0566", "object_relation": "md5", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334304, "uuid": "c4576687-01f0-4480-adbf-28f6db52fdb4", "comment": "Malware payload (RemcosRAT)", "value": "59f1760fc1453b193d1707d8dbc1aa8acab2c375d1df0dc4992b5b2cb3487954", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334304, "uuid": "f8f2a798-bd6f-426f-9f17-715df7be3cfa", "comment": "Malware payload (RemcosRAT)", "value": "58b699764503a9c237fdf19ae489dd6e1263ae15", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334304, "uuid": "86b0ae24-4b7c-438c-81a8-55a3479bacc2", "comment": "Malware payload (RemcosRAT)", "value": "87a826c473ce6bc1c2ad5831a3309ce3d0e0a0c7988df1f8694b9cd7a7ae115b73b182d43dac7646061a35a081b9b1e7", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334304, "uuid": "e4bcd115-4850-444f-a686-81f71723401f", "value": "T16A0723C496938833C4480638E59466856C63FDB25BF2125A3C77FF0E6FB4282A973D76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334304, "uuid": "bea7e86a-e64e-438a-af2d-fa99a746cf7d", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334304, "uuid": "0800e2a9-f915-4190-816a-3cb421a367ad", "value": "98304:ULlqADZQlM75vfJGpgUeUd2ODZQlM75vfJGpgUZ:+Th5B6h5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762334304, "uuid": "88c43d74-b26f-45f7-a846-cdedf5b781fc", "value": 18266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762334304, "uuid": "15e47427-ac12-4b98-9dbf-fdf7ceb8acf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334304, "uuid": "f047d827-9929-4dc4-960d-e5f192ebef13", "value": "59f1760fc1453b193d1707d8dbc1aa8acab2c375d1df0dc4992b5b2cb3487954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bf39c3-ba10-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1762324240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324240, "uuid": "44696673-133b-44d8-a4d6-fad9d3153c57", "comment": "Malware payload (GuLoader)", "value": "5641e02cdef77ea20efb4003533c74ac", "object_relation": "md5", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324240, "uuid": "86850a6a-03af-4306-a303-0805aae05261", "comment": "Malware payload (GuLoader)", "value": "5a4f84c60fece4f8ffdccfc11eede551f1e06d71a544c64606630dfa68a5a149", "object_relation": "sha256", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324240, "uuid": "64802c49-cd3c-4700-a192-d2d49ec2df92", "comment": "Malware payload (GuLoader)", "value": "34f33b63dff4e2f80f394fd3dbfc58c1efeb9978", "object_relation": "sha1", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324240, "uuid": "6599d309-0d01-482b-970f-b23bc54ecd42", "comment": "Malware payload (GuLoader)", "value": "798385c17f12aadef8a77496e9f001c26b82f96356b55a69fc13194e0f5a46d6202f031a8f58f86a6ad35ee2501cf77e", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324240, "uuid": "2ff33caf-8577-4519-b2ce-9c4fe93a5549", "value": "T1377523048664B923EA52773009335B3529F9DE792D12C8A3BB2C77862F397696D4F31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324240, "uuid": "595b4182-0630-47dd-8ea2-c648e32c3579", "value": "24576:b34zyneaZ5H+BljpP97TVKehyK5X65f7n9YEM9E9yuJRG6Hs9p0Ai:b3yyne0+BljpV7T1oK5X65ff179sIAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762324240, "uuid": "cdeb828d-356c-4fed-a620-c48ac57c04ea", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762324240, "uuid": "f824f5fa-7c65-4708-b540-b8217cd6d9d2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324240, "uuid": "ad718312-d554-48fd-adb2-7627c9f9153c", "value": "5a4f84c60fece4f8ffdccfc11eede551f1e06d71a544c64606630dfa68a5a149.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41af61a7-ba30-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762337687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337687, "uuid": "020b66f1-7be7-4deb-a1b0-b96a9989e3ec", "comment": "Malware payload (Formbook)", "value": "7bb83d32203f1604785ddc909bcce6da", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337687, "uuid": "9d42e684-c45c-47e6-bb27-54863436a6ac", "comment": "Malware payload (Formbook)", "value": "5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337687, "uuid": "df70d168-afad-4062-9d42-bd8e63c20f06", "comment": "Malware payload (Formbook)", "value": "8a07a33bce7f381e17b8bad17454d5409128fdf3", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337687, "uuid": "87d52962-bc52-458d-8b4d-201af57243c7", "comment": "Malware payload (Formbook)", "value": "b577193db21e741335cc95864db92e48b29a93a0f0797085029097b37231634e829cfb633d03bd88354cb9b064f5bf6c", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337687, "uuid": "0628b982-cae6-448a-af94-4d72a6aeacbb", "value": "T11674E022FA9098EDD50BC0F4C1659AA7B575B4CD0B366AFF139841342E29AF12F3CB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337687, "uuid": "bf3e74f3-526d-42a5-8002-11e2a5dc7971", "value": "a58674b7d32a44b3f935a595e1cb967e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337687, "uuid": "f40c69b6-b8d3-4d67-a1d4-399d335175cf", "value": "6144:kxNWe5E6piKcA1k8lG+L4aIYio6LkeBmBTmi/9Qf19+dm/WTXzgU:kxYeaKtk80+LvIDfkeBw/W99+UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337687, "uuid": "c591a48c-78ab-4f62-9b02-faa961be08d4", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337687, "uuid": "f15ae518-6373-4ea9-a562-7e1a913d6f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337687, "uuid": "4d02d527-9a9b-4f13-9e8a-1648cb7ed7df", "value": "5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9d2344-ba5a-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762355821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355821, "uuid": "68207c6c-f1e1-4175-9f44-79b4d8c40673", "comment": "Malware payload (RemcosRAT)", "value": "50a3776333008cc877170dd993082fc4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355821, "uuid": "1e2d6767-5bc9-457f-a1f5-d5b1fe826ebc", "comment": "Malware payload (RemcosRAT)", "value": "5abb430a9a370206fdba8c9ad16d4cdcdcdbd27fc6d3e1eca0ac9a6619b416fc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355821, "uuid": "9a84c5f5-4d06-4b81-80d5-4b3dd6c98e29", "comment": "Malware payload (RemcosRAT)", "value": "b7bb6aac6ea5e5b1a15c21a8ee487199836c5d3d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355821, "uuid": "79b0e6ad-bc6c-4db8-a5de-d8bb1a23be2b", "comment": "Malware payload (RemcosRAT)", "value": "15c4526f32dc2df45540465dd2a472526a1dd4da583d86c59f2d11ede12bbe51d8e4751a0df6d69ca3b16671f9219fc5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762355821, "uuid": "94e6f03d-9602-4140-9004-45f2f697c054", "value": "T1F9C4339B0A676C1C7E7E8D8B0A9FA3075D14F246A4D3DA1B277C2E07CE0538DB8B5509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762355821, "uuid": "48c652ce-8f34-4d09-8479-55d765ede811", "value": "12288:Bx/qZghbGzIeksnO4GhX+BFXrp178IZHxVJdKFcVmhPt:2CGzIe9O4GhX+XbpNPxVj8U6Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762355821, "uuid": "d977b3ef-b25e-408b-8c09-bdaf432fdc2e", "value": 578091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762355821, "uuid": "d602aa3d-b5ae-4e3d-9413-6b5d9a66b368", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762355821, "uuid": "c472e87a-6a09-4f6a-bd18-ae6d79e178bd", "value": "PO NOV2025_1762289702.xls.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868d42cc-ba11-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762324488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324488, "uuid": "0dcff6cd-8eff-4364-9e5c-c056baa62e9a", "comment": "Malware payload", "value": "d65ddf38ff1d28b82be965460559f427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324488, "uuid": "3417b209-6d25-4377-b639-d01d1138de59", "comment": "Malware payload", "value": "5ae8fe067055f58ba29dab328072b66998579920c0823a0f556985519d014133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324488, "uuid": "3024c0d3-5960-4ecc-8960-67ba58fe40a4", "comment": "Malware payload", "value": "97cf4f29c776d419c107915b747aa6c51ecf915f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324488, "uuid": "ef67348b-e3db-462a-bb48-a328f2964048", "comment": "Malware payload", "value": "be04b827117f87dfc3b7c171c58e84c915ad5aa43f2960f3ddb13f2b6626e32f9e830d6168178a84df52732483d9682b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324488, "uuid": "b58a1733-94d6-408f-ba98-e97ccfeb7d35", "value": "T1C9E412D036817490D968A331483998E7477FFD34AC75C20EF7847B6E6B7139E856AC82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324488, "uuid": "08cc33e4-456f-4572-95bf-5ce3757a7058", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324488, "uuid": "056029de-46d2-4e4b-ad43-a04076605545", "value": "12288:QuoS1Rnqm/L+t1lVTXcDwD6fd+Z4XTOGiRnz35cTe13I:HT1Rqm/k1lxXcQp4TiB36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762324488, "uuid": "087e8ff5-1e30-4b00-96ff-71d26262ae4c", "value": 712578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762324488, "uuid": "fd341f97-b184-470a-89d0-3a6a44dd289f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324488, "uuid": "15b94ca8-d10e-4bd4-be93-4cf72f00b849", "value": "doc20242205125126.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0181613f-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319970, "uuid": "d562d6e5-827e-4f89-9cc5-bfafd0813a36", "comment": "Malware payload (Gafgyt)", "value": "3044da58db48138ccea2484ec5b12a0e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319970, "uuid": "bd79087f-c729-4028-8939-4385b806446b", "comment": "Malware payload (Gafgyt)", "value": "5b0eb62618c40d79687346e940c311728bc127c372d4ee6427c4017e686b745d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319970, "uuid": "0c86015d-96d9-4516-960b-2a0f5bd31afe", "comment": "Malware payload (Gafgyt)", "value": "85f0b97cfd3500a826c52a82b7aa44ffcc13bd6f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319970, "uuid": "db81af5d-db9a-4ebe-848b-af86b8aac796", "comment": "Malware payload (Gafgyt)", "value": "18617b8d6c9d60fdf582481aabc32dd1d2d12ed9a86f2b05a13cf2e40b89590f4eab484fbe82e48f8a7661f77712c27d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319970, "uuid": "11ad6a05-382c-4393-8734-2b353b5f83f3", "value": "T1F231A5CAB2B244B0ADA1ACAB3565CC4475D1D6CBA4C6EF992CDC38D9008DF18B012693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319970, "uuid": "3e4c6b9b-5011-4fa8-91b9-ac41b22f3f7e", "value": "12:Gn0FbEki0FBONei0F6c43Iu0FDeQgv0F+NNIhW0FQ0Fo1F10F9m0F9Ev0Fw0FhuP:1Q60E6c4EDJKNItBo69TVhhrUwgKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319970, "uuid": "65b46f1d-5ce5-4452-ba5f-94c077ca7e98", "value": 1731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319970, "uuid": "6843b01b-6458-4b5d-9392-070c77c56cdf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319970, "uuid": "a9edb2d2-77a0-4a99-99b9-f341676d67d1", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7baa377-ba56-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762354286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354286, "uuid": "a72514bc-b9ff-4893-a698-4102e0831509", "comment": "Malware payload", "value": "959b33de7d7a7dff43b8b0ec06cc65c4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354286, "uuid": "830df372-fbb0-41ea-a4af-1e39975a4abc", "comment": "Malware payload", "value": "5b41d6937357f73f0544524303c0a1a4bffbe74aed22f8321e12cca6e50927fe", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354286, "uuid": "3a35a6d0-eb7c-4c92-a48d-d27978d17717", "comment": "Malware payload", "value": "428c82141de3abdac873c51fe68784119a287c8e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354286, "uuid": "77a76826-d684-4dfc-a8de-55a0897ad7fd", "comment": "Malware payload", "value": "5d1a039d9bbb964c609cfa9491ed9199e0d0aa9d889d32143f80f3fbb0999f2968f2de70fe5164ada7d69537e6948333", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354286, "uuid": "25264517-c4a1-424d-9b28-a334d2a2222f", "value": "T19A92BF5BF8E06D69D13284FEC19601E5F22CA260EA0A514C3885FA0E57533DB97FF4B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354286, "uuid": "6b700637-4d10-4ac4-8de2-dbae064526a7", "value": "384:wc3rjd3T/hYEax3J0GTBP33ZJ3COQysm/f9U7k4UlM9zTfP/BktIPkS:w61/OEa9JdvJJkyd/f9U7Vx/H/6IPkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354286, "uuid": "5141eb08-9fae-47f5-a8b2-9fe323a6f57a", "value": 19575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354286, "uuid": "a551c283-3cb8-4f99-8ed6-f437fa9054fe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354286, "uuid": "5af0abff-0e1e-4368-b7d4-17be19de9306", "value": "Champagne _ChristmasSelection_chf.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cc2abc-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762320237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320237, "uuid": "d2fa9626-113e-4908-b478-37cd53634816", "comment": "Malware payload (Mirai)", "value": "f27cdd93b37e733106eddf46672033fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320237, "uuid": "1946b012-e5fb-4758-a764-d09ec45aa1e7", "comment": "Malware payload (Mirai)", "value": "5bef14bfc6333f55bce1979bf71c113587810b4e238bf3f93b77bf17b3678d4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320237, "uuid": "e84d0d76-42d7-40db-aee8-337242ed362a", "comment": "Malware payload (Mirai)", "value": "35f17a15fa08f89d4dd5c60e669927cd715822d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320237, "uuid": "76bd72b2-e0ab-4428-b00c-63d29d40024b", "comment": "Malware payload (Mirai)", "value": "a1f959872affd8adbcd0c1e99203783c2ba03d954c2df6eaf06196cd1281d411cf1b293716235c2ba1ae39389cda5c9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762320237, "uuid": "3019e542-71fa-4348-a7ec-003a60170c17", "value": "T181732B42731C0A47D5B39DB4253F27E0C3FFA59120F4BA84651E9B4A93B6E325186FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762320237, "uuid": "ee42c35a-5540-4d1c-9ea7-7318f4fb81df", "value": "1536:GbBi3mW+iGRAY2UrOdf+j7tXy7ZEKddrGct2H3qOYoo:GFiT5wD2jdf+A79dN7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762320237, "uuid": "f31d45fc-c645-4eb2-95e6-085550d0f985", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762320237, "uuid": "487d1506-a0f9-43da-9f4b-923b28d7ca67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762320237, "uuid": "aaedf91b-2283-4374-bf81-6fd2cd82adcc", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8751c58e-ba53-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762352836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352836, "uuid": "0f3b1814-39ba-4a06-9838-bf62cf0eb430", "comment": "Malware payload", "value": "e215b9efac716ee02de8af05870e304d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352836, "uuid": "250643d3-e328-48b7-aa28-4fd3f8461fc6", "comment": "Malware payload", "value": "5cf38d814405ed6d803447aa833c4ab25c6361b39a3b9bcb9fc8aef0f86b9f6c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352836, "uuid": "9a33a065-8b35-4876-907e-49a5788867ab", "comment": "Malware payload", "value": "15e86523a75ed44815327ef263e5ce19411795a0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352836, "uuid": "1260d1b3-0b96-409c-9bba-600a7ad45879", "comment": "Malware payload", "value": "fbf4ca73e9caa6080e1ec9a48d3c887c93f0bdd9ade43f92a7089b2110b029f6eaea3225c0616cc977b45a3ee72b4768", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352836, "uuid": "034f349d-2aad-445c-b7d0-85b6f1991060", "value": "T1E3B5335C702209F9CA8E22F25DAA73053C364F0557F8DFA86A0CB9AE1B4765D83943B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352836, "uuid": "4f82c4b4-48ee-40f8-86a4-25887c164ae6", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352836, "uuid": "de1fdfd1-20aa-433f-bc28-daa894e370d2", "value": "49152:S6SlzkhV4V2LfxRm+Ul8tWfM48AXGMjwltFNPtFi:NS1khVzxY+UlIT5AXLjetFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762352836, "uuid": "66b98266-75a8-4279-a029-3a9ecf438bbd", "value": 2478592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762352836, "uuid": "b4309126-ed34-4bc0-af2b-f447870e4489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352836, "uuid": "427cb880-f3dc-4378-96f6-b7a016cd1bf6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042eaf3f-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319974, "uuid": "09357bdb-cd15-4f6d-b9db-db53cc721e6d", "comment": "Malware payload (Gafgyt)", "value": "7b496801858222d996fb77d1773921d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319974, "uuid": "3df4420c-9950-4c21-a3c0-f6cb34b17cc6", "comment": "Malware payload (Gafgyt)", "value": "5d1c1f54c5aacbf56df437c9f608d90b10310414db11c6734b1c0bee881ed728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319974, "uuid": "a553c6f6-3e35-411e-8acb-bc0458fae965", "comment": "Malware payload (Gafgyt)", "value": "acd8a0c68f1260cabfe44e5b8490380e64ead8d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319974, "uuid": "5aa9c1bc-b20d-4e9e-ac46-494ba6d02d5f", "comment": "Malware payload (Gafgyt)", "value": "a30a3b6dd8b4c01a7d7b0187d425dc4dd16b5f22ce7df8757800a77340bee190fd04fc950b564f11e3877d3e683545f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319974, "uuid": "a3302f65-bade-40a8-8450-cbc590947e44", "value": "T143E30B28F8505B16C3E322F9FB4D469D3E220BEA63EB70118A348F6057C6B9719B5D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319974, "uuid": "33d5ef9d-c072-45a0-bb63-548380443340", "value": "3072:V12drUYgM72cagUUm6HOyhHW4w6gkGg5hqS6T:VQP2cagUUmk1h46gkP5hqZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319974, "uuid": "064937c9-038b-4369-ac1f-544929797f8e", "value": 150424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319974, "uuid": "73b56340-6db4-43b2-b95a-6233b67a75fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319974, "uuid": "01d1be05-9d4d-4c84-acc9-63400abfb5b6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bd4e4f-ba7d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762371001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762371001, "uuid": "0596b53f-308c-4466-bc19-db6973e2eccf", "comment": "Malware payload", "value": "4a1dd0cfdbe0ed0927e9f1b79aceda6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762371001, "uuid": "b3e06522-d53f-4fee-9678-c2164ac98213", "comment": "Malware payload", "value": "5d34ef8e5e13beabffd20a38b4b478cb357e853e29518fd5f3a53628625e88f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762371001, "uuid": "ed5857b9-3a85-4dd9-8d01-c0fb42368ea2", "comment": "Malware payload", "value": "ee2317107f438b6524bccbb557af4cfed8b72780", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762371001, "uuid": "0d513971-1d05-423e-844c-7758092125a1", "comment": "Malware payload", "value": "c4e68a0e997131056a67e0b3edf3088db60114bbac43e21975e3ca29beaf72bb8857f5215f49b614a27619ba6f2be01b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762371001, "uuid": "5571f619-338e-437a-aa58-15a559703d22", "value": "T142862847F89041E8C0EED174CA669263BA707C895B3063D72B50F7B82F72BD46A7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762371001, "uuid": "aabe03e8-41c8-4baa-9030-198381a0d45d", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPX2:glRJXp8L/KyZcCb793Eew+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762371001, "uuid": "78944821-1f08-4b92-b813-dedd1fa1e76e", "value": 7864320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762371001, "uuid": "06fc5b65-1bcb-41cb-8dd9-40d2328e372c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762371001, "uuid": "980e2ec8-0695-4158-87dd-fbf75dac71d4", "value": "memfd_a (deleted)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee13301c-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316931, "uuid": "e5ca5c85-6945-4ab5-9c8a-c1ac3d9125bb", "comment": "Malware payload (Mirai)", "value": "2cc9beff40ae504632c37efe8498264b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316931, "uuid": "1febb600-ca4c-4ea7-b192-d7f961a5f4b0", "comment": "Malware payload (Mirai)", "value": "5d65d515015324ae3e3492595cd3b90baaeb4b8a7301a7d695e02a54c5ee71e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316931, "uuid": "ffde76d8-41a4-4ebb-ae74-d739ed8dbb4e", "comment": "Malware payload (Mirai)", "value": "dcb31cc4449c74f2af1f818e82cfe33dcf73e71a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316931, "uuid": "4cd979a9-dc9a-4271-81b1-3994ed47f03e", "comment": "Malware payload (Mirai)", "value": "ee61fba5e5e1dcfedbc040f7e8976f4b6640e88f25b78b1c4ca78dfed1de61d38b3fcb85f43124654284b20f092b2715", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316931, "uuid": "cc6f4373-498c-498d-9cb3-041132dc2b4a", "value": "T13F533922A9792E17C0D5F57B21F38328B2F5670E24A8CB2D7D720E8EFF1855065472B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316931, "uuid": "b3301294-3fc8-4eeb-9b28-04dc49408fe3", "value": "768:cnol7i1qTSCq9r7Cw7p1oY8dwJONpn+d9E5mp5Zi0K6SGO+h9sTF40:cnEiwGCSr7CSpiY8dwJwpn+d9xWEha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316931, "uuid": "80521e68-4b62-44e9-aa9b-bae6e2df2672", "value": 62484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316931, "uuid": "66b476ed-8897-4b20-b398-a9a4a05cb1ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316931, "uuid": "ce0a5c25-d74c-4869-a39c-573cbb1def19", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6af246-ba91-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762379262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379262, "uuid": "9f30e834-3bf1-4166-810e-ab83d09b4150", "comment": "Malware payload (Mirai)", "value": "07597a715a47c16b550435343300a28e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379262, "uuid": "6ddd688a-9f19-4130-a224-9c556b1e1f90", "comment": "Malware payload (Mirai)", "value": "5e3fd0103190b64e1e7a344773e72f9506bae6b07e6366637d57b0d0bacc1736", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379262, "uuid": "7dff7431-b7d0-43f3-86e0-b7733ff9858f", "comment": "Malware payload (Mirai)", "value": "ea143eff1395290b621bbad037733be09eb72e56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379262, "uuid": "b959f826-0dc5-466e-86aa-d16920bb4a37", "comment": "Malware payload (Mirai)", "value": "c9e5f3e6e51c1860a83c17ce4211693bf8557f4d9068320fe453ab09eed852d97e33d7bab015c245c809cc46225ffda0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379262, "uuid": "d08a7c53-882f-4c55-a838-23947472096a", "value": "T1E303F1D2D42EAC52E11F4337006FBE9E5D0AA869F22CC675CE8021B65D3A7763138387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379262, "uuid": "02c2f463-7295-41b6-b2bb-6e83a8acac46", "value": "768:nyynOUCYpqAl3clB4EBaC7nCRk9PlXGW4/ASe1tz5pnbcuyD7UGQRjO3:yynOUCVDWEBa8n4MWhA915nouy8GyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762379262, "uuid": "af55311f-68c5-4719-9fb9-ada7ff912826", "value": 37716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762379262, "uuid": "dc240ef9-2b8c-4e9a-9cb3-cc4a073963dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379262, "uuid": "0fd25fd0-202a-4acc-80b7-05800a7f72d6", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d92040a-ba28-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1762334297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334297, "uuid": "0c5d875c-6f5a-4d0a-8941-dd2991a82ab4", "comment": "Malware payload (Adware.Techsnab)", "value": "42bc220a5b9d22648ff4df62f49668d7", "object_relation": "md5", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334297, "uuid": "56638221-1710-4d77-ae12-0f95de5c3b56", "comment": "Malware payload (Adware.Techsnab)", "value": "5e91d5090065819da3e5789b13e3a9bea66c59d8d3c05f16500f7a2349635f98", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334297, "uuid": "d5d9f0f1-5ed8-4888-9764-08424a901ed6", "comment": "Malware payload (Adware.Techsnab)", "value": "c0ba2023d7f60db0698af15de8d2de07ef840b91", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334297, "uuid": "25dfef69-7dea-400c-bdcf-572f600b8704", "comment": "Malware payload (Adware.Techsnab)", "value": "465b39826fcd23ab4d169a975794f062611f85c1cd6d2c49a5852a388e021d06ade2162f31c1ea9a0b75c988af670f57", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334297, "uuid": "2431e34b-2504-428d-bc91-5fc386b910db", "value": "T1DBE6331B31D14DF8374ADF80DD1B8B9072E788B1EAF6A2B610754EE328CED4E465469C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334297, "uuid": "500f7cc2-fd3f-452b-82a7-65dce0883986", "value": "393216:CIB+xbGeFRpX3LqYYxAFoRmmiQzcViH6Fxm6FWha9pl+RvPvn:Cg+rFnHfEmmH9O46sanl+JHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762334297, "uuid": "219caea4-009c-42eb-a0f4-97b09e552227", "value": 15191674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762334297, "uuid": "7afecc74-ae1c-426d-9040-c45a46998e42", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334297, "uuid": "24f46cf0-9ad6-4ec0-b384-28e811d068e9", "value": "5e91d5090065819da3e5789b13e3a9bea66c59d8d3c05f16500f7a2349635f98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80af2846-ba4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762348959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348959, "uuid": "579ec465-6024-4829-a3f6-44e9e312dc18", "comment": "Malware payload (RemcosRAT)", "value": "560682cdcf395b5eb95487c7ef65c63e", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348959, "uuid": "ff9dc7f6-6687-4625-bb10-4a5a778463c7", "comment": "Malware payload (RemcosRAT)", "value": "5ec8268a5995a1fac3530acafe4a10eab73c08b03cabb5d76154a7d693085cc2", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348959, "uuid": "feaf5dc7-d3be-4cfb-af82-2a4ea9d29a4b", "comment": "Malware payload (RemcosRAT)", "value": "e444d001f2b69259f7845a5ffe9a44113d90e382", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348959, "uuid": "a94f64cc-96ad-490e-b99c-406b693d7900", "comment": "Malware payload (RemcosRAT)", "value": "dce69518dfdd249d3b05ae0df6779ae9b98d076286a9c151cf69d714eb4e45b95e43559eb6c452ec0171a5a6e7f52e74", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348959, "uuid": "e90ee0e2-e044-4035-bc55-37ec87c11de2", "value": "T10775E059A6D1BD32C03726B4CC1FC3D8B46DBE301E34B6876AE9AE1D1B3469C6463193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348959, "uuid": "4d6eb56c-9d5a-4936-b8fd-396d98dbc2de", "value": "473184179e16801f35d2ca43f04f77be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348959, "uuid": "63186689-9a44-4730-9821-8d8fc603d256", "value": "24576:sjPj9RX8zrBzuTSt7+5a9XCQ2q0fawD2nlcLG6WTNN08oUDD9DmA3PMlAjrR:6TXapxCQ2q0iwDuGZWD08oU3h7FvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348959, "uuid": "b8cf160c-96c8-4971-b394-e0fc5eab629e", "value": 1630720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348959, "uuid": "f36176fc-eba2-463c-a464-33eb754fcb9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348959, "uuid": "98b7bcee-918d-4f0b-a95a-282677819664", "value": "5ec8268a5995a1fac3530acafe4a10eab73c08b03cabb5d76154a7d693085cc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcbf643-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318618, "uuid": "92195f1d-41e4-420b-867e-ff720dd874cd", "comment": "Malware payload (Mirai)", "value": "4f464b7a291afda75171cbc170ad90e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318618, "uuid": "1fe7cfcd-1d44-40e7-90b7-584d8af1873a", "comment": "Malware payload (Mirai)", "value": "5fa55018c14a1e106a80684ed54b781aa57f243b84370bdd62661afed9a288ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318618, "uuid": "bbd543e4-8cba-4a5f-82e6-3a3f362ef624", "comment": "Malware payload (Mirai)", "value": "622e73eb25db896ce92c2b80ff8db156c2f23011", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318618, "uuid": "e0ce79d7-9e30-485e-a6c0-2a17ba2cdc2f", "comment": "Malware payload (Mirai)", "value": "edc05dfbef48392d63a5b170191c0995c159b5eeed4733244965c730e61e49fb8d02f5d96ffcac9a737fcd7e87e7eb25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318618, "uuid": "f48c6530-07d2-4edd-9e55-d704c856fe6c", "value": "T166B339C1BA43D4F5EC1641307177F73B9A32F0791239DA87E7A49E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318618, "uuid": "8ab665ec-a58e-472b-9b3e-660f4a3ada95", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wOzSr9bMFfl2:Pbj4doYGFB0/45gda9ul2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318618, "uuid": "104826f3-cce2-4580-893c-3e4d27ce2a3d", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318618, "uuid": "6d81cb9b-f76b-4968-81bb-fdbe9206d529", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318618, "uuid": "165d6190-36c1-4445-80aa-7bf0d87394e0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fe6455-ba4d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762350034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350034, "uuid": "10ba4fb4-32c5-4f60-9e00-54b8205d3924", "comment": "Malware payload", "value": "70564646d183e2c839b69cb1c602727b", "object_relation": "md5", "Tag": [ { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350034, "uuid": "9323dc28-38ba-4875-b93c-e8c92de933c1", "comment": "Malware payload", "value": "5fcd815ad13dcb25e44638c868f926036383496f88ce1340bdf232bf185a0fbc", "object_relation": "sha256", "Tag": [ { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350034, "uuid": "878542cc-2d5e-49d7-ae10-d022e810ecf9", "comment": "Malware payload", "value": "1b265bdb62f78aaf73a5550addf5d15296c4a283", "object_relation": "sha1", "Tag": [ { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350034, "uuid": "6e110cfb-2f0b-4926-b641-ab3aae4ff010", "comment": "Malware payload", "value": "0e6f674188a9bc317d837ec293dbde93675fa8c66d736f14269c7a0037d7292926949ef2c0f3e71b4de03c5b9a87b2d4", "object_relation": "sha3-384", "Tag": [ { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350034, "uuid": "0ed4a124-7bcb-4da9-ac49-93cbb9e36b77", "value": "T19A163343EE9C330BF8B8E9E05725912743B710CB17A8F4E0A4A64D45A9152C7CEE6D6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350034, "uuid": "c2241a7a-d719-44b2-bbe5-2057668c56ad", "value": "98304:IL+lPPaFSHTDC5/at70jO5QpiA3EsrtA/Ix/T+ss:E+THvg/jO5Qpp3bAAxLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762350034, "uuid": "e7b04ae0-b396-4368-a49a-7d79c5080d9e", "value": 4406024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762350034, "uuid": "b64a2903-f3a3-48c4-841a-ade54b9a6f29", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350034, "uuid": "85aae8ff-9867-41de-b945-ea974b50decb", "value": "5fcd815ad13dcb25e44638c868f926036383496f88ce1340bdf232bf185a0fbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae56904-ba5e-11f0-91c6-42010a9c0006", "comment": "Malware payload (HijackLoader)", "timestamp": 1762357459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357459, "uuid": "b6d1bbb2-862e-4177-a360-0471769ad701", "comment": "Malware payload (HijackLoader)", "value": "a972df6a4bf4678b1d5da7b3e8dad3f2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357459, "uuid": "02f64c51-2480-46a6-9f1b-eebcb08d09b5", "comment": "Malware payload (HijackLoader)", "value": "5ff80525a82906925e6a5f00d6647ad4fb3c372ef7318b09a1298b218b5a4930", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357459, "uuid": "44174351-c29f-4bc0-8339-324f81f082d1", "comment": "Malware payload (HijackLoader)", "value": "cfd482a2487ff31a4990cd3c5e34f039abb55f24", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357459, "uuid": "4153873f-0fe0-421c-a45d-420e9c7e53fb", "comment": "Malware payload (HijackLoader)", "value": "3c142016589e99ef81f7f2fe9e91c6195d243bc76a3c3ce832f6472935853fc53754530d740e7e4a13fc7b73b65dde7d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762357459, "uuid": "77b0b6e1-13ac-4aa4-bbee-2f6e29d41b43", "value": "T111A62323F64E673EE06A553659729A10543FAE50650A8CB38AEC3E4CCE390A01D7FF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762357459, "uuid": "3868d413-d328-4eec-86ee-e7c8a4782b83", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762357459, "uuid": "a34e0d8f-370a-4da8-a933-27089090520b", "value": "196608:rDby0Tbyj47tDL6p/QrlLXfPBDKjHLK8ZiHEDtWzYApsyfXvZ9pKScaq:rDXn7tDLs/Ul3o/K8ZiHM0zY149p9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762357459, "uuid": "287829f6-1549-4957-abcb-af0f98665311", "value": 10146008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762357459, "uuid": "bafcd61c-fabc-479f-b6a3-28780c1bd317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762357459, "uuid": "493dc3dc-1d59-47fe-9863-fddfff4d7d32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7469b28d-ba72-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762366119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366119, "uuid": "10e0fd2b-e37f-4caf-90d3-b8c7c4ebd75a", "comment": "Malware payload (Mirai)", "value": "4f1a1fecc017f9640514bc30cb8fad18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366119, "uuid": "c87ee240-7498-416b-8156-62688a50eedb", "comment": "Malware payload (Mirai)", "value": "6031a38382a666fc56f86aabd93a1fb6fe3319e3a5e707e576ffd875a62f6a3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366119, "uuid": "27102c8a-396c-45e8-af93-e9e338940936", "comment": "Malware payload (Mirai)", "value": "d0c2fee0f1a68f54bc26d27a9c8d51b35717a02a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762366119, "uuid": "053e301d-f6fe-4a05-b410-0b36d60f2214", "comment": "Malware payload (Mirai)", "value": "dd67ea0714542eb9f1aa8e32d623b713c5a4b0021a1f237080d63b8ff9a1a3d68cb67b170128dc92f55ccb7022c95f4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762366119, "uuid": "bd0a1a0d-4b7a-4210-b88b-d04cfcf50aef", "value": "T1CCE44A06EF440FEBC4AFCD30852E835B15ED9D8702D1A779A1BC894CBA9D2694FD3948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762366119, "uuid": "61866296-6bfc-44e2-9bdf-264fddcc2f22", "value": "12288:86HSmwdKbK9WC6f5gglvjXI0+FLNa84WqfC+SH7BDmNt4XdKznmaHPInxb/MF/Oy:hOrlHGJMPHeBbxvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762366119, "uuid": "4524005e-f6ca-4c4d-8a37-1bc20c6c9a50", "value": 722588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762366119, "uuid": "2e1760f7-b8e3-4656-8987-4556a84d5bc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762366119, "uuid": "19a955a2-9242-40cf-b2eb-26a57b59780d", "value": "Mddos.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d2b7c5-ba96-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381440, "uuid": "5e6babce-6243-4e5e-8a30-398988f793d1", "comment": "Malware payload", "value": "cd0574f2984d8fb708b5d2534de4000a", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381440, "uuid": "b7847687-8a43-49d9-b69d-53801d6155c9", "comment": "Malware payload", "value": "60c1382a6b4426983fecfa1334c353de81655cde3988a475ed5ade821d1a174f", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381440, "uuid": "072da60a-b1c3-42c1-835b-40679c3edfb1", "comment": "Malware payload", "value": "9bea02e2b48fb4e695d64f9f115ad2743e0bad65", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381440, "uuid": "8fe5ee7f-ed9e-4e73-9ef5-62cba0c310c0", "comment": "Malware payload", "value": "d5a8260e27301bd7f19347e37b9142734c0c9aa1db9982ab0a403ab86885e18bc6ad4f7c0288ed4aaa254bc365f94bbe", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381440, "uuid": "f4f5ba06-ae12-49d2-8965-f2ddd00971e2", "value": "T1F15401729E675300283C41F7C24574C3A9D8E342A2EB706A757116EF2A97F9043E90FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381440, "uuid": "3b8a80d1-a692-40f4-8d2e-df89e99af200", "value": "6144:+tEiwMn8UD2WytshtEiwMn8UD2WytshtEiwMn8UD2Wytsu:+Sle8UD2WTSle8UD2WTSle8UD2Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381440, "uuid": "c3fa95ee-5d4d-4666-841f-ee1e34a2696f", "value": 294840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381440, "uuid": "3a850da3-a241-4849-8442-25dc1ffc2398", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381440, "uuid": "538596f5-20e5-4259-a8b7-648952cfec59", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f17c82-ba4b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1762349470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349470, "uuid": "fc841535-fe3e-4412-a0e7-7b0340578444", "comment": "Malware payload (Vidar)", "value": "529eda78954ac715c4de4f75dfde8e5b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349470, "uuid": "88986709-2ba4-4d48-8bfa-370a631254e5", "comment": "Malware payload (Vidar)", "value": "61722eb8fa05bc092a7944a030103adf69d2194ac91d8c00f61310b449703c53", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349470, "uuid": "590064ee-2f56-4883-97b3-1fefd5bec461", "comment": "Malware payload (Vidar)", "value": "57bd209ea0ebe92a32bf216e9733bf83c3b7482d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349470, "uuid": "d919258b-e2e0-4051-9e71-fe67e2469e04", "comment": "Malware payload (Vidar)", "value": "55e28c049efe79d27d06b876bc69a3ff78f2ec1d5501d1f8e7e22889e44fa7b2bae558965193d12c0b6ffd40bc66c88a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349470, "uuid": "7b4526b4-5422-4b80-8783-59fe11fc6cba", "value": "T1395423B99299A06BEB04C9B73DCE6F8DD4094E59233E9DC8982E0DFD37C36F66118110", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349470, "uuid": "bd2d0e27-cb2f-49b3-a227-d4c04de7380b", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349470, "uuid": "58df6cca-cdda-4945-bb84-0aab74a1dc36", "value": "6144:e87Q4hzwuHbYBbIcleEo2UQ+q6B/j7YDAU0qa5pNqSSr6JNhOOml:e88uU85bEsJMJ0h5nqS/5OL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349470, "uuid": "ad04ccbf-5f70-4a2a-b76d-abd69f36161e", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349470, "uuid": "a644bc0f-f2fc-4713-a92b-7cf066aeeba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349470, "uuid": "63c3684e-005f-4dd8-8e6a-a6e7925089ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9dd53d2-ba22-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762331848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331848, "uuid": "f3d83204-94a1-45b0-bf2c-461f293e59d7", "comment": "Malware payload", "value": "02ae89f6764223174c08d164ecc0702e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331848, "uuid": "e77c32cb-34fb-4b31-921e-9773770c685b", "comment": "Malware payload", "value": "62527290e716611142b7c98166589e21aae91c2616163c38aa29d4e5155d13bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331848, "uuid": "8f62729a-4651-4354-80e4-f2a8b5656160", "comment": "Malware payload", "value": "b60565a6892a1fd9da208e14db348db6d799e518", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331848, "uuid": "ce211bda-bc55-44d1-9e7d-403024ed4630", "comment": "Malware payload", "value": "1e850b41b5a7d280337aa966646e400f240c06b1bbdb252b2b1c307c153b0bfb97deaf28d8e86a77d6535bd07ec7a1d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331848, "uuid": "ebf3abc1-ce32-447d-aed5-93aef1d7bccc", "value": "T14B96019562DC00A4C0F5C779C6EA5813F63A7C144B3AEBFF06A196162D366E1DF39B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331848, "uuid": "85d49cc3-153d-4d4e-a87a-02bc2900d011", "value": "da7c7889a9af299fe69cc0665690e327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331848, "uuid": "614b1887-01d8-45bd-81be-141feb57db8a", "value": "196608:5zVi6NKZp8Fix8mq2cDUWzvgeSR0+QzdC83Ixae+qPMR3:S6NKX8asbbHGPMR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331848, "uuid": "a3538c2d-80b2-4b49-bf8d-52566f64c18e", "value": 9130400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331848, "uuid": "80044596-9c2a-4ae5-9406-d45584ec6549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331848, "uuid": "2cb49b59-2e03-42d3-bfa5-93acf34c3fa6", "value": "02ae89f6764223174c08d164ecc0702e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15bbb45-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316802, "uuid": "a0b00d98-7aaa-4f73-ab01-c52e68bb9444", "comment": "Malware payload (Mirai)", "value": "b7c61ec85e1624fc8d522f515d05d70d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316802, "uuid": "092ce335-476a-4094-bf2f-ebd46cd05576", "comment": "Malware payload (Mirai)", "value": "6261aa1c192e4236f433c96432b69670036ac880f69939a35befecbd370e3c77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316802, "uuid": "91ed7d0f-bb49-4331-a695-0741b6b20afe", "comment": "Malware payload (Mirai)", "value": "4d846192a28abffd40db581249df1ed28bf1b5b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316802, "uuid": "af41667b-2f63-40be-a3f3-95d8f89fd7d3", "comment": "Malware payload (Mirai)", "value": "14a8952f1e21ce24da1ef725fee0c2463f75d10bf36212d13630d5708a56dd798d38ecf83ab85e1049c6c22139b3b0ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316802, "uuid": "6dd98a75-18f2-4d7e-981b-c29dbe03e965", "value": "T111235CC5A447D9FCEC190A712177FF319AF6E83E1198DA83C3599D72E942602E9032AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316802, "uuid": "ef6fff29-5bd7-48d4-8fe4-ed659b50a67c", "value": "768:r+WtjNuFWGttXEsLk+sd6bVHUzFm/BZWfd/046SDZk8yI:r+csttXEsY+sdWVHUyWV/046OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316802, "uuid": "5929a94d-0716-470e-b3ab-9a385cac3da8", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316802, "uuid": "1ab218e6-6e74-4bd9-9de7-136c9a4f4308", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316802, "uuid": "8975cda3-0c1e-42db-815d-d294f88c177a", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258d031e-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319601, "uuid": "3d1feecf-1d2a-4ac1-9779-e3f281632a69", "comment": "Malware payload (Mirai)", "value": "932cee65e3418e42ccbac6a1ba610e97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319601, "uuid": "af5dbfa0-588b-43ea-b82d-b11dd0690e9b", "comment": "Malware payload (Mirai)", "value": "628a60b65033bf8925654b5e904880e243f6da8f352cbe327617f31dbc60710e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319601, "uuid": "95ea18b9-0a63-4a06-b8bd-fc7486e710b1", "comment": "Malware payload (Mirai)", "value": "5786ac62d3911827696a854d447f3545315a2802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319601, "uuid": "ca2e27c7-bcd3-427b-a4ad-84824040db47", "comment": "Malware payload (Mirai)", "value": "3642b21b758a402a4a410e6f0c8c1a2fb1e39314a586e9ed71ba8d5eaee3a3fa2fd2a471923e93112e5789f121a3fbe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319601, "uuid": "1af0961f-b379-4339-9206-aed114009045", "value": "T1FF043A46EB418A13C4D227B5BA9F424533239B64D3EB730699287FB43F87B9E4E63501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319601, "uuid": "ea79a143-41d7-40db-8c1b-7c6413e400ae", "value": "3072:jckY26qoACt1aN4xrvfZlvB5e7MYQUpf683s2iSpbWM/9fAMOU:4kYq41aGxrvfZlXe7tpS882iSpqM/9dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319601, "uuid": "779d8c1f-ff8c-4bea-8015-19ed07a4f3b8", "value": 177819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319601, "uuid": "b62a5ed6-245c-4fcb-a75b-c238f4572c73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319601, "uuid": "c4464b8a-8492-4920-9df1-85f3b9d7cfa1", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4c27d3-ba3b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762342721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342721, "uuid": "7a36068e-bbaa-45e7-91a1-880d47ac3be1", "comment": "Malware payload (Rhadamanthys)", "value": "81a2c6b0006a80486a501b884331a9d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342721, "uuid": "3bae16cd-eabb-45d1-a08d-c85a1c23190e", "comment": "Malware payload (Rhadamanthys)", "value": "64055f44f9b67670d699e337500d6178a2eca5c52aa530a3d0220dae65548eb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342721, "uuid": "0514ac92-9b6d-4e99-8d12-655e95f1b090", "comment": "Malware payload (Rhadamanthys)", "value": "2e732415659dc082139c58577149ca44c14873e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342721, "uuid": "73b01ca7-dd6c-4350-8c16-142b153cc675", "comment": "Malware payload (Rhadamanthys)", "value": "f79623bada72b8c0149e7aa8f5b60ae8fb747ab846ee060894de36550a126c25e227d95d64c30dbdbc0860e6424002b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342721, "uuid": "8a387ad8-7ecd-4c48-bba8-f805778c0ee7", "value": "T17B3522683786D801C65687385AB0F6756778ADFA7830C3975ED82DDF3E63F218A50A03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342721, "uuid": "d5bd6f84-02aa-4415-b5bd-ca1465866cd9", "value": "24576:z3Gmy7NOjbunjiADcEcyrxMHwAZokFDOGScJ3sSkwt9Ll3r:z3VyhikqyrmHnokPtrLl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342721, "uuid": "709ceea4-4131-4d75-9cd6-ab9c1b3b9e4e", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342721, "uuid": "7bc6dff8-0836-410c-8ebf-6a4c762fd6c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342721, "uuid": "404b1d87-1fdf-4591-be7f-eee381ef2b4a", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c247379-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762335986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335986, "uuid": "5a8ccad9-a921-4151-b283-29f07cd6a62f", "comment": "Malware payload (CastleLoader)", "value": "bd61d42f552a7288cfb474498f2f43fc", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335986, "uuid": "6a521e19-69cf-44fd-85e1-f867e30b32be", "comment": "Malware payload (CastleLoader)", "value": "6444f0e3f78254aef663837562d258a2236a77f810ee8d832de7d83e0fdd5783", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335986, "uuid": "5fb2f4ee-8c3a-495a-9f21-fdf457783990", "comment": "Malware payload (CastleLoader)", "value": "5c0021dd581ac03b8711edfe34fff8ec646bad60", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335986, "uuid": "a814bb6a-473c-4f70-a49a-af5b9c462980", "comment": "Malware payload (CastleLoader)", "value": "2e04368c58f2818d20570c7c422fb9a6262da74d53b9b20f3c9650aafd4b7db62b24fe479270e6d5936b743afda91ca6", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335986, "uuid": "a4e6d9e1-5515-4a96-96e7-118527af6f33", "value": "T18A348D16B282DC77D8621A72549897B6642CBD310B115AC7B3C92F3AEE306D18735F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335986, "uuid": "693b9045-1cbb-44a7-a147-9ebb50226194", "value": "e1bd82e8b4275e0c717f1065b63ee328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335986, "uuid": "95b40b53-120d-43a0-a00c-0b63e48f576e", "value": "3072:Vd7HKKOY6J2bXZvvqf1gnj0ac83juIENQJ6L+1cZalY9xKHqMx1wvfvod:WYemZv8gjnnCbaJ8++ZaKLHvod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335986, "uuid": "4011187f-768b-4399-bce7-41d110148adc", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335986, "uuid": "1f03bd73-b074-4eec-b7fc-17e275dc5f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335986, "uuid": "526e1a33-b1e2-4a0d-b46f-3d588ea0af4a", "value": "6444f0e3f78254aef663837562d258a2236a77f810ee8d832de7d83e0fdd5783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f9a4a5-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762335952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335952, "uuid": "03344b63-cca1-4088-aeb4-cd9bb9d66098", "comment": "Malware payload (CastleLoader)", "value": "c5262c609f412e1b8f0ad6d392ee4e6f", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335952, "uuid": "a0e9ef4d-c0e4-4dc2-977e-ca42d9b3cadf", "comment": "Malware payload (CastleLoader)", "value": "65493c28b5991bb8e73d1ceb94b3633137542c422ffc5dfd90801909dd475d58", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335952, "uuid": "a3c600d3-7b4e-4ba4-bc25-c00d4b1bd077", "comment": "Malware payload (CastleLoader)", "value": "36ca9cf29b84c10c2b0e3e5e4bb4b4ca23388d5a", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335952, "uuid": "812448f9-ec7f-4b53-86d8-209697321551", "comment": "Malware payload (CastleLoader)", "value": "b32570c7b76c6dc3f84b5a3a1e400961b839c6e93517fde349f60c959d3c46b228e4f5376f9c5493e6a57b3cc11a2bf6", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335952, "uuid": "773291b4-e2d2-496e-8cda-c0631260bfe4", "value": "T1A7283321715B603AF3BD473658B36F4BDE3B26A699467D2E1154E0C8E83B3817D6FA00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335952, "uuid": "9a7f4501-960a-4629-8f6b-3f5f3ad6613d", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335952, "uuid": "5877ea46-8fd3-4033-a735-7a803f7583b3", "value": "1572864:GcNl8/oc/aYhQ2PaP+JBYwPLjRLI/zw1vtrGGvO/TiV3n:Gs8/oghhamJBPna/zwDaGyi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335952, "uuid": "ebb75db7-5381-4640-8a34-7e0b42dcd7d6", "value": 98286592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335952, "uuid": "4d8cbc48-174c-4ea0-ac53-7ac30b4fdf8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335952, "uuid": "6c64ee35-80c6-449e-9031-aca18101f0f8", "value": "65493c28b5991bb8e73d1ceb94b3633137542c422ffc5dfd90801909dd475d58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb98986-ba2f-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1762337467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337467, "uuid": "a709735d-e5fd-4201-a59b-386a3d6a6472", "comment": "Malware payload (CastleRAT)", "value": "f5610c801cf023bed27bf63a96735efc", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337467, "uuid": "7c46c97e-57f5-4308-99e9-27a0abf278bf", "comment": "Malware payload (CastleRAT)", "value": "66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337467, "uuid": "d8563451-d3a2-4afb-916f-07308709c740", "comment": "Malware payload (CastleRAT)", "value": "532004076a678ba81f8411774898a6fc7c533701", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337467, "uuid": "65cced93-3be7-478c-9fe9-d1702f6f063d", "comment": "Malware payload (CastleRAT)", "value": "a97e914233d11ec029e937a6eb334e035e3e815c7232d9f452359c847538870e098efcbd6c670127d8b658a11b2d285e", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337467, "uuid": "fb43f17e-18dd-44a7-bc27-b2bb7b8951ab", "value": "T14F752316A59594FED809C47E8598AB6FA672F0888F3257FF069101321F5DAD30F3CE64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337467, "uuid": "9ea48c0d-270b-454b-a491-f6a4bdeb9ba9", "value": "a58674b7d32a44b3f935a595e1cb967e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337467, "uuid": "ba2a66d5-b561-44c0-b0ea-c8c64a94743c", "value": "49152:ekaGsShE6+Se2NTzi7+hgvAaS+MpzC7M:FE6+ou+6AaS+Mpzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337467, "uuid": "fa81f30c-80e8-4953-bf63-af635ac7b005", "value": 1681408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337467, "uuid": "1d2f8b1a-3f92-405d-9cd1-552bea7e9d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337467, "uuid": "30950f95-0aeb-4e6b-b504-9e11fb733efa", "value": "66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7d1ed6-ba3a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762342166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342166, "uuid": "68485dee-a271-4cb5-a82f-c39014ec53ce", "comment": "Malware payload", "value": "2590b8f5f26080285ca2e997b527fa81", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342166, "uuid": "8e97a31e-fd0f-4bdf-99be-45c0f42cc383", "comment": "Malware payload", "value": "6734a8b384e9a2d30324b2834f5b46490b7234aa3988c2c0bbf854b32727c6bf", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342166, "uuid": "93a53905-1342-452e-9897-15964f283562", "comment": "Malware payload", "value": "56aca975bfa17e8fee6c933d34e6ecce67803e3e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342166, "uuid": "b16b9a97-cb2c-4db7-ab08-24c41454b837", "comment": "Malware payload", "value": "59688dc637d575a4358f0a23545f04f0f57ea57bd86b16d9c5050474d6f58cb9a305bba5dc60c3913f2f8ff0bb640ca9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342166, "uuid": "24ea5b9a-7aa1-4bfc-a2b6-fbe2f5bca5d2", "value": "T199E53305EA2BAFFAD04A4C03556DF390ED1C56C8076A69D82FD70EE21C29253547FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342166, "uuid": "a9b6ed9d-c1b7-4b42-b970-f89741221f9e", "value": "98304:ullkZPsAkkmTJrJ/Z3jaCBimVv3i38NqgWz:CeZ0nTJr3fBiyvc85Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342166, "uuid": "1436a503-2917-4d16-954f-8c9bc0917a59", "value": 3204403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342166, "uuid": "f0cf45d6-cc38-429a-b30b-4040d9a4a3db", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342166, "uuid": "a26f00fe-8b19-4821-8142-21033edb2696", "value": "180_25E5_2586_25B0_25E9_259B_25AA_25E6_2598_259F_25E7_258E_258B_25E5_2590_2588_25E5_2587_25BB.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd072da-ba30-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1762337710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337710, "uuid": "68d753ae-e612-499d-beef-d77850a595b0", "comment": "Malware payload (CastleRAT)", "value": "9e21fbc9e7862fb0d8ba59cf0f16037c", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337710, "uuid": "c91fb312-5c6c-4284-8573-3dcb1667a575", "comment": "Malware payload (CastleRAT)", "value": "67cf6d5332078ff021865d5fef6dc61e90b89bc411d8344754247ccd194ff65b", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337710, "uuid": "02e99dfc-d4e4-4956-9d46-2da4f0472e0e", "comment": "Malware payload (CastleRAT)", "value": "1cd4f445807f2e3eb6cdda367d10a2a98beb49d6", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337710, "uuid": "1f496a68-6309-4bcc-9f91-f754aead4bf2", "comment": "Malware payload (CastleRAT)", "value": "be37b0a473e5cf377bdd136689e9543d425a2d2f0117371427eac0af2eea9574dbfcaca92fded5f6917c5361896ba5ad", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337710, "uuid": "d89d2fe8-bf22-41d6-b0cf-9785a42308cb", "value": "T1E0241706F3F610E9E0B7D13985626616F673781D8720AADF476087762F23AE0A53FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337710, "uuid": "4808d389-cba3-43fe-b1aa-6d14acdb86a5", "value": "3a6a7d594475a83c85efc0982384206c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337710, "uuid": "ed70e6d7-279f-4d2f-ad9c-72172c4ccb12", "value": "3072:aRwgRPvUJdrhridEmmwOEEPglOpSn391rW1k1maa3S9+vzredIcJj:aRgri7mKE1SntdW12p9+veScJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337710, "uuid": "b57f64d9-7e8f-47d3-a3b6-9701adb9e096", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337710, "uuid": "aadffff0-1368-4758-84b2-a85a3dcf8c07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337710, "uuid": "5d682c60-9bcb-404c-884b-a941aa71cd45", "value": "67cf6d5332078ff021865d5fef6dc61e90b89bc411d8344754247ccd194ff65b(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9c4802-ba98-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382344, "uuid": "b6173f7b-abd9-405c-a900-50506d3fa101", "comment": "Malware payload", "value": "7c074681bbb6230572e0dfd5f3901e67", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382344, "uuid": "b1d5a2db-56c5-4812-b6c3-7380c8ccea74", "comment": "Malware payload", "value": "682fc4f4c9884dc64b7098a9a54415c9844aa145eb75124ab009eb90040234ed", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382344, "uuid": "16fa8c8a-01da-4af5-b7b1-8381d7b29233", "comment": "Malware payload", "value": "4a9a65168375bbd9ad5af001d72338f9f7d7d733", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382344, "uuid": "2dbea379-e0d2-4395-9faf-d66f5c585860", "comment": "Malware payload", "value": "cd00bfcd889363dd72bf5596079236e935ccad31790a3715e9e3457b0e3e5eae4be9a846591556567eb37dbf19510ea8", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382344, "uuid": "929e5a9c-bfb8-4a7b-bcb7-1b367c02a2a1", "value": "T1785412C94D9AC4A689A67831060579D9E13E881FFA02FDD163E691BCF321D960F2F11B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382344, "uuid": "ddf2566b-299f-49d8-8864-22e06f4a92b9", "value": "6144:T0GrFUsl4gdke6vQf0GrFUsl4gdke6vQf0GrFUsl4gdke6vQD:QkdkxvQckdkxvQckdkxvQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382344, "uuid": "fb8eceaf-e136-41ff-ab6a-48ec0babe543", "value": 293712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382344, "uuid": "f66a56fb-cd7a-4fcc-aceb-0eae2ff39d6c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382344, "uuid": "adeea8c5-5910-47fc-9c2f-b9e676d5d6d9", "value": "Complete_Guide_Age_of_Consent_Colorado.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043c6d6f-ba15-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762325987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325987, "uuid": "89c98a8c-f56b-419a-80b0-861e06c3ba78", "comment": "Malware payload (Mirai)", "value": "b69a5adfaabfc64bcb6b9e72b09d2941", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325987, "uuid": "44e3138d-3fb0-4728-a27c-b6586b9bb583", "comment": "Malware payload (Mirai)", "value": "695b8ed0a111423955281e1db7fb926e5c9ef60db1bde4d9c8a0c245cb9e044a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325987, "uuid": "24081270-a2da-4afa-813d-42a94358b2cb", "comment": "Malware payload (Mirai)", "value": "3c11b79bf4f0f8b3eb2b44515fee3b20962ea625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325987, "uuid": "68ae6d64-374e-4ab6-b318-2de9cc4b34b7", "comment": "Malware payload (Mirai)", "value": "4bd3a5061755d4b50751add1e6a662354ab4a7b7aa4ab85831edda6e7e662550b70905735c90ee846fcb07b1468dbac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325987, "uuid": "b772651c-1e05-47f7-ad5e-a87d709b07f6", "value": "T190A3C61E6E118FADF7A8823047B79E22935C37D737E1C685E19CD6046E6028E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325987, "uuid": "abed1b27-a126-4da6-a52d-112dbf997661", "value": "1536:qX4D8cG6ecFe0yYf4/XKFeSKbTE62ztuRo6crdsNbBFBLaezeZC78magO30:S4D8cG69M0yYwIeSKbJ2/rmNbrB98Ia0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325987, "uuid": "71df9622-0f12-43f1-ac36-3d288ac11132", "value": 105152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325987, "uuid": "7eab204d-8942-4491-bdf3-020d8dd6d86f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325987, "uuid": "30ba705c-aa52-40c5-b3db-52b2cc3ae4f8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242ae8a5-b9ed-11f0-91c6-42010a9c0006", "comment": "Malware payload (Joker)", "timestamp": 1762308861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308861, "uuid": "b5efcb03-b56c-49b2-894b-d9f66a427d6f", "comment": "Malware payload (Joker)", "value": "b364b46330028d3cfda74786a3b4b0d2", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308861, "uuid": "39dce922-8ab7-43f6-8b70-25e44ab815ec", "comment": "Malware payload (Joker)", "value": "6a3c78100945be8dd28c7ad2c79f8dd3075a2ec1f3d5fdd6186ca56dda57980b", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308861, "uuid": "832e092b-25a9-45ca-8160-6857e4c2c269", "comment": "Malware payload (Joker)", "value": "5f6f659af9ed367247319d4b8f56cb6e3bd13b23", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308861, "uuid": "971913ca-39c0-4c9b-9156-5c07e1f67cbf", "comment": "Malware payload (Joker)", "value": "aa19225df1ab46b039bd3860f02bd2cf69e8cc0ce8bb03a4101aba86c17ef1689f38855e69a0d2f20b431a0c4a11963d", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762308861, "uuid": "9c86a6f7-8af4-4672-bd1a-7d84c1ed4a92", "value": "T102771206E30CDA1BDDF2B0BC1D042756A018ED216AC6978EA815F3AF63F72C1594E7E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762308861, "uuid": "8cb7b2ab-c074-4dea-956c-200baf6d9a9f", "value": "393216:tHH71X+dNXDWW6bvE8ep9zcfhhhN/TPjdhpg91pWtobGLsyB5mMicUJ:pHZXySWgvRuzcfhd7RheN8D5hYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762308861, "uuid": "035ca30d-a8ad-4a29-8fbe-a3e1294b515c", "value": 32818119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762308861, "uuid": "42af1533-2bed-4c98-8d7e-414d9166e368", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762308861, "uuid": "3cfefca5-b1af-41c0-b780-3461b31bcd34", "value": "Fast+Phone+Clean_1.0.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8849ebb-b9e9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762307445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307445, "uuid": "9d557c87-b007-40dd-aeda-433be677bba6", "comment": "Malware payload", "value": "80d1e14d2ae290a6ed4c025c1a24db76", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307445, "uuid": "3fbb3b8f-f8e8-4a3c-8ea6-0363eaa651b5", "comment": "Malware payload", "value": "6ab8169b26559ae475f6a4f4eb34cd9efb5a655fc4f3b6b7470887aa22c86345", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307445, "uuid": "4f03fb63-b996-41e7-9440-2a8e5e475820", "comment": "Malware payload", "value": "566efb24ee53d362c47b3da4c16f5cc1fb8af95e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307445, "uuid": "1adae75b-80bc-47ab-9cca-c314bd9711ce", "comment": "Malware payload", "value": "917fe2c8229dec5ffc6480aa1332e160005d4ad06a40770e0a1f9fe3dd644d07b08d3e6dd0f305f87dc9064585938f12", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307445, "uuid": "74005df4-021e-41c9-b58b-7ed73148f8c7", "value": "T1A5762302F769A91FC8F3C332287256352126DE16C747A78B542533F928BFEE84B566C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307445, "uuid": "618cf7a1-3260-4a8b-a9be-ad794c89cade", "value": "196608:AJ027ptHb3zshynzlDoqJbRexWmiRotIY02aqCc5x:802FtnsMzlDoibRZ+tIY54c5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762307445, "uuid": "04ad90f3-d5cd-4308-a973-f83ed94ffbc8", "value": 7547419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762307445, "uuid": "37f25a75-2a73-4d6a-92d5-f479d34dd449", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307445, "uuid": "3669ca2b-07b1-41c8-9e16-d02daddcc03a", "value": "X-APK-2293.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c73c58-ba6e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762364517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762364517, "uuid": "4e48ffd3-ceed-438a-aacf-2db531558a4e", "comment": "Malware payload (Mirai)", "value": "6c4ada4eb8c73c04407f610a40ad2adf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762364517, "uuid": "244c95ab-b48f-44ae-831f-fa750da42041", "comment": "Malware payload (Mirai)", "value": "6bcfeeeda10a81031f909dc6813a11dc1352c901621ecff75bcf700ce94eac7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762364517, "uuid": "ea555110-12ca-4883-8908-17e8f906707e", "comment": "Malware payload (Mirai)", "value": "1ddfc51fdec27b0291e970e99ca5ae3317af9b7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762364517, "uuid": "95079acc-ae00-42bf-97a1-658e60a413c7", "comment": "Malware payload (Mirai)", "value": "77161ded19b9cebfd5898d651890c6f1ae0d078d329d7d47b553b4749e43ab8bf853979847dee522f78556bc3bd79eb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762364517, "uuid": "357e2a72-7030-4de7-9e64-a235904fc8e0", "value": "T171E47C9377218F94E321D27105F38B655EA421A20AF39085A3BCD3207A51B6D6C6FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762364517, "uuid": "95dc6e7e-b170-44c0-a9a5-d6ec68aed645", "value": "12288:OY+BJ4NXwIZ3N7uWVXcvim/U2LG5Ckj3G96tqpsmCN8p3sw0cI:OYy4NX53Ny02im/UQ+Ce3u4qpsvwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762364517, "uuid": "6c7fac5b-d01f-453f-afbe-5cbf41486787", "value": 718492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762364517, "uuid": "50b0c05b-1b39-42ed-aec0-135dd35dcfce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762364517, "uuid": "5772607d-474f-4dd1-ac00-e6e5a1032e49", "value": "Mddos.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54399cca-ba99-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382815, "uuid": "1ff2fc0d-7a15-492a-b051-d0761589ce1f", "comment": "Malware payload", "value": "47789288c14c9615d47fb642701f468b", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382815, "uuid": "9effe41b-81b9-4930-9cf3-942d71fdf1f0", "comment": "Malware payload", "value": "6c35499edd0eba276891a29569056450759c0e3d95c20d8f7c58f95f4111b6de", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382815, "uuid": "cb683861-044c-4602-afeb-81a0ca14ad48", "comment": "Malware payload", "value": "5a98e02b4ffb52e8d1817dafcad0f91905edfb9b", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382815, "uuid": "b3de8162-aa1b-461a-9118-0db7869c43c7", "comment": "Malware payload", "value": "d3a0db86e34bef6eece6bfa3466ea325d63ead5082aa270e5e64c77d443f0e17f9bcb9f39f42cc30918ccfc9f79689d0", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382815, "uuid": "b35035b1-ca58-4d93-94a9-f563ca930fba", "value": "T1A85412F5D1DFB0225A223E7226C4AD622AF659633CFBCA2984F90C9C5F31562CF65D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382815, "uuid": "402d2283-7a1c-41a6-a9b7-8581455a8a0c", "value": "6144:F2JwYBBl1FSGL2JwYBBl1FSGL2JwYBBl1FSGp:YlvUlvUlvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382815, "uuid": "1ec03a95-9692-449e-bbb4-2317ff0e93c9", "value": 294558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382815, "uuid": "94b800d4-8aa7-4484-a6da-a0d377c71aac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382815, "uuid": "1d45d13e-2196-494a-8a16-b09a203e6194", "value": "Ultimate_Guide_to_Contract_Deeds.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4ae811-ba94-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762380926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762380926, "uuid": "09332920-a461-4173-9665-1368c1bf47ed", "comment": "Malware payload", "value": "2ae1b14cb6dc63d462b02a664c576485", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762380926, "uuid": "c2251625-aa97-4300-b35e-c556e73a8bd3", "comment": "Malware payload", "value": "6cd782d30b7e1dda740e8ab4d3609d972631c6590348a8cf7e7a327edd9e71fd", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762380926, "uuid": "0d012c26-2610-4b51-ae37-1505202fbdb9", "comment": "Malware payload", "value": "5468cdae84c547aa848ed887dd56116dfc4d47f0", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762380926, "uuid": "043a349c-6505-4d82-8edf-71be023197a5", "comment": "Malware payload", "value": "bbc3b6303365eb90dc9e4553c02b797ec1caad328d5e4d5d663503ad8588d99876bba75263d495d1c95d75207200d4b0", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762380926, "uuid": "a2d4b23e-e744-4b75-a6df-f6d1bcfd61f4", "value": "T14F5412AEFC39E4D0EB94FD7F120E8E17236098F5915E143B119CD94197C5253A2CEAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762380926, "uuid": "6b0a0ace-5f07-4be4-9722-8eca6c1170ba", "value": "6144:CvoMXcER62K6eJo6voMXcER62K6eJo6voMXcER62K6eJof:Cg6v5KnJo6g6v5KnJo6g6v5KnJof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762380926, "uuid": "1533613c-c7df-45e9-96f4-6f77f5b8ca2d", "value": 294132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762380926, "uuid": "1bedc665-0116-4114-a8dd-1915c97b61d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762380926, "uuid": "9e2d7126-729d-449c-ac6a-575bdcd084dc", "value": "Ultimate_Guide_to_Contract_Deeds.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ae4675-ba64-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762360222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360222, "uuid": "42d0d9a0-162e-4244-8704-450ce0479911", "comment": "Malware payload (RemcosRAT)", "value": "5f0cf4c65e28966ee4fd5619508ca2df", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360222, "uuid": "68b4b645-09e0-4cca-9d39-f98722a7bd5d", "comment": "Malware payload (RemcosRAT)", "value": "6d028de88de1043b8338b133c6a675662817a77d5d3c4d14ce1b43aa90129d4c", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360222, "uuid": "f64db370-88e7-4023-a6f5-983bb68e197c", "comment": "Malware payload (RemcosRAT)", "value": "5e3284d71aa9cb59cd4cb19b6699c6d895d8a88e", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360222, "uuid": "d1bda17c-b763-4dd8-be2d-9fc777200604", "comment": "Malware payload (RemcosRAT)", "value": "4e52379b8dc8a991e19309b6ca6812d74b27e6a2008444b0ae701c6d195f9124953a4fcec66a69d44ebbf5cba299bcbf", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360222, "uuid": "f083e558-665a-4da3-98ef-6799d252eb85", "value": "T1CC15D074CD81885C3EB6306C2359C83AD4DBD969F15CA2DAC12ECB9E079339847EE176", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360222, "uuid": "05c6c833-d9d6-4075-9ec4-242a48585075", "value": "24576:Hj8izWDg4CzLvXbVcW9zRnaasGMaDFqd1:XXcmnSZagd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360222, "uuid": "6ab700ac-2489-4818-b5e0-1ad508cf248c", "value": 922601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360222, "uuid": "7d1ea446-be97-44f6-82fc-8b69219afed6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360222, "uuid": "3cb3a2ac-570b-4cc5-ad49-fd268ac9f858", "value": "Purchase Order-PO132025ED.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11826c2d-ba4c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1762349632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349632, "uuid": "493c9f18-9c7b-4dd1-b02f-f3e8bbd5432b", "comment": "Malware payload (Vidar)", "value": "053c3faa7aa51df2f67720b06ca274c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349632, "uuid": "eae3d23e-19db-4f41-8313-f6f28b148386", "comment": "Malware payload (Vidar)", "value": "6d170528faf56b51cbc2c2a19d00d8e643300e735e7235353c664c99e9d30a27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349632, "uuid": "b3410f38-9f5a-4830-bee3-d7ea24c9c6fb", "comment": "Malware payload (Vidar)", "value": "bec2925bc9ef303530c08a4605038c14a1cc74fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349632, "uuid": "9980e57a-08a6-43c6-b66c-32ad1c44967b", "comment": "Malware payload (Vidar)", "value": "0580f2c7b01eb45ad5d2aea1b859fa7358982e24f18e61cf4d334b444dd2ef08f5a67d097cc9c221cf8595ad02c19f4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349632, "uuid": "718ca4eb-e5aa-4191-9c2e-deeec887d61f", "value": "T11BD48E7AA490D297FA1880B504F1972DE9207435C6762AFF05A0D1A2D91BBF08FD47FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349632, "uuid": "42a84c38-01ec-4a84-83d7-c535f0f960cf", "value": "69b1c029b2300841771a0354f944d1f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349632, "uuid": "eb583411-f1e5-4f0e-a9ea-163124b88c98", "value": "12288:R9iIot+cETT1qeGSAFcApgLRouFg8OV8cgzVPjdQl4UQEakwmrwgPi8:XiIA+LscApgLfIgJjdQGUQHZmrwgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349632, "uuid": "0cd3e13e-bb8f-426f-b1e4-4f88235269a0", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349632, "uuid": "7433342f-9bc8-4277-8741-8a78993d024d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349632, "uuid": "32969fc5-7ffe-44e0-b2f1-61a01d32561b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86204009-ba1c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762329212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329212, "uuid": "5e380b86-84eb-43ef-9479-45157dcaca17", "comment": "Malware payload (Mirai)", "value": "a6820b21f8cf0ce30323a6f1f5698ebb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329212, "uuid": "6670608d-953d-41af-b5e4-9bf43e925caa", "comment": "Malware payload (Mirai)", "value": "6d183659149a45e4e862bbde008c9d55d8d45c8e1819931d6ffac6a581fb6063", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329212, "uuid": "9721b65f-e566-41e9-9d26-5058865b12bf", "comment": "Malware payload (Mirai)", "value": "9969cda0962f8a963b7d031a3dd717c8983f250e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329212, "uuid": "dc6411a1-3640-47f5-bede-0fec59827468", "comment": "Malware payload (Mirai)", "value": "533a903943c8544eaddce124ea4f0f12bfaadad66cb0e00019594713cea921afae237547b6a50f869ce39e1e194a79ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762329212, "uuid": "f891b32a-f49b-44ca-b749-fcd553ad2cd2", "value": "T1E3C3F185BB6369D1C1A242FDA4C00AC387916E318BE313080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762329212, "uuid": "aedb1943-3277-423d-8407-830200085930", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnL:0OCDjXG9qTWywxlxTnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762329212, "uuid": "43aa7b29-b130-49e9-ab64-0a9c00dfb4f0", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762329212, "uuid": "4394fa7f-07d5-462b-8ce7-0ceee8678167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762329212, "uuid": "f6dad4a4-2b3c-485f-9d7b-e1f9c2084fa2", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3730a1-ba67-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1762361411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361411, "uuid": "587bdc7a-193f-43fc-a227-8a61fcd918d2", "comment": "Malware payload (njrat)", "value": "00821ef157dcb175f92f8d8f3bdc3c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361411, "uuid": "1a7ec9c5-79a2-414d-9013-ad10a5034f02", "comment": "Malware payload (njrat)", "value": "6d54e87dc92e7de68679a2226db2057e57d18c610c5ed17454bbc20b60456596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361411, "uuid": "8f7ddf70-9c49-4292-b99c-3f5f669d743b", "comment": "Malware payload (njrat)", "value": "77055e4b1a5407b14937038705558a229f569be9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361411, "uuid": "96b63085-65e2-462e-b325-743e5893265c", "comment": "Malware payload (njrat)", "value": "c806346ba6a05132651f18a7e905e403a0bcbda1e2d3762fcc5d13f280044ceb72703ce24b7ce42da81eb4dd7d8c3189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361411, "uuid": "a1c889f5-b6ed-4ae9-baca-441157381c20", "value": "T151565B2BE5FAD0DDCB2B817182166235663DBC1C0C736A3B195FF6B02E31D5C1E9AA50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361411, "uuid": "199ee1bf-2263-4148-b586-48253792d806", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361411, "uuid": "4a790fa3-9e1e-47ce-ad1a-263becb9d692", "value": "49152:9wzq2yn7A1H1gVwAsOaK1oBnWeZhDaGX+2oyCqgGGtlqd14zv/wsT8L4Tlxb1IUM:Wu2WIOXeZhD5+ECZT807S+TV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762361411, "uuid": "d9fe4ff8-9355-4f12-9072-fb693fb3647e", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762361411, "uuid": "0c974620-d4ca-46ce-8713-380204174843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361411, "uuid": "c565783d-4ff4-4e0c-8c21-1de3fec47b6d", "value": "00821EF157DCB175F92F8D8F3BDC3C7A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba51ec1-ba95-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381217, "uuid": "d1d137f5-8c42-4fde-976f-8a8d3f6fcff6", "comment": "Malware payload", "value": "bf12b1896241434cecfc09f9f23ecaef", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381217, "uuid": "976c09e5-8a52-4a2f-ba64-132751cb0d85", "comment": "Malware payload", "value": "6d81b7553bb5799ce01dd205e3cd6f11f6e5a98b4d52df3115a04447588f101c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381217, "uuid": "e3583f00-7839-498b-afba-3fcc7d1fa6bd", "comment": "Malware payload", "value": "1c71d9ecd9422c02cdec35d9ae8b8932c45ccb21", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381217, "uuid": "256e329b-c335-4415-b9bd-efe06b9816e5", "comment": "Malware payload", "value": "f00d75cc27259695777ecfea5bfaf1a03f335d11310ca3a1afa3b65381382ce5a97a2d4404517775aff5d2bd75d19f90", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381217, "uuid": "c2535a7d-9d5e-49d9-b2f9-620f1ebd4f80", "value": "T132129D7678A0939A5C766ACA2C80ED58FA0357E73111BD5E9447C1F511564E330FE32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381217, "uuid": "6d8d2218-b5a2-463e-87e9-378d0f4dd25b", "value": "192:EHa2TDsrgYVKCIkfs8/zIfRpVbCXsNiRV8EtkaEs5rWEbXR:O88Y/zIpf3stsmbXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381217, "uuid": "60d452ba-3340-46e8-8185-2b0a92baa07b", "value": 9611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381217, "uuid": "71a84ad4-f1e5-4c1d-87b0-5a5acfe792a9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381217, "uuid": "a0b0b255-bb9d-4de4-8566-a12496e5bc7f", "value": "MEMZ-Clean.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2997e0-b9e8-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1762307019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307019, "uuid": "f6bb75ae-b3a9-44ee-892c-91c8719b6cdc", "comment": "Malware payload (DarkTortilla)", "value": "723ff0cdb47bf62f4c0d7302003fb73c", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307019, "uuid": "2e9bf6f2-c921-4dbb-80ca-63d8db4fcafa", "comment": "Malware payload (DarkTortilla)", "value": "6d971963f42e669f9a023c9017036579ee6ad6485470e1723606e9fba5f538ba", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307019, "uuid": "582fc23c-ce09-480e-aed4-2b5159cccb38", "comment": "Malware payload (DarkTortilla)", "value": "9b44e0f5d6dec2b3065e11b7d514df0fba926acb", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307019, "uuid": "4697b87c-8b99-4665-8012-c49a0ee1d377", "comment": "Malware payload (DarkTortilla)", "value": "d7631521814ca3c1426fbc0879cfa6ed2df3416822b48e89113929998079272edb50821095702ea4a35e23b21a99fb41", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307019, "uuid": "8e89525b-97a7-4657-bedb-671ba91710dc", "value": "T1FA55F11A16D15AE0E0BECF78E7B8009443F0661FE721F7AF6D5852E89E5174663233A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307019, "uuid": "8d065dac-f598-4fb9-8461-bca21be68404", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307019, "uuid": "c07c8347-6112-4396-83cb-6147cecebbbe", "value": "24576:HcdzN67rUBVia9FWqjf5ZmiLf1DcuwW6pIGv6PLqnc4c:HcE4FFWqdciLf1DHsv1c4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762307019, "uuid": "364dd03e-1827-40db-bfb6-b0a79a104289", "value": 1389056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762307019, "uuid": "1f260c48-7ca4-491f-9580-8e49d6147b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307019, "uuid": "7aaa808b-a8ff-43e9-a01b-ec72c772ebfd", "value": "Comprobante de pago Aviso con fecha de noviembre de 2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1ec274-ba15-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762326160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326160, "uuid": "dff68e88-d833-498d-b330-145959848a69", "comment": "Malware payload (Mirai)", "value": "0442448a6afac2e24f87164277e7ae47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326160, "uuid": "ac9ac40c-1364-4059-9566-4dedaca2ae0a", "comment": "Malware payload (Mirai)", "value": "6e214e128653d07ccda90a91a73a46765752473db35ecbd0f6f1cb4a421588bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326160, "uuid": "8eafb8b8-902c-47ad-a0bd-ae168e1828e4", "comment": "Malware payload (Mirai)", "value": "1f86b6cf33bcc6b130c4d3b09b4fa4e53486f26b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326160, "uuid": "4b30736d-ca0c-48a0-8fef-2fde070d5355", "comment": "Malware payload (Mirai)", "value": "1d2d2c540fc0b42cd2684e60e09d314f5b01453f9997badc54edfdb86a838fe71aa5ebf9476fb53ce684bd88cda4fd87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326160, "uuid": "ad319332-77d9-4b35-9692-c09d1b2577d4", "value": "T1BE832A91BD416A12C6E0237BFB6E428D332663A8D2DF721BDD226F1077C691B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326160, "uuid": "137391c0-7202-48d8-87a3-06ce964f12a8", "value": "1536:m7dz8LJEyBAXbmjsn6bmQBUxOBIJLq8Hh0/qsG+4z6zSDM/gTWOxvdzGJafHmHWo:m7dW2reGqzoOm3qFg2zSDnQa/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762326160, "uuid": "86c8839e-9495-4791-a2ab-4badab54631c", "value": 81616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762326160, "uuid": "91e5bd60-4865-4441-b649-89183be6253d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326160, "uuid": "4c86eb7e-8106-4d59-842d-c24f822ce784", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3eaa670-b9e3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762304888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762304888, "uuid": "152e1569-dc17-4d6a-b52c-3b251e59c8bf", "comment": "Malware payload", "value": "687968d73d74d6b2fc8ecbb6e503c8ac", "object_relation": "md5", "Tag": [ { "name": "github-dcm-m2", "colour": "#1F7EA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762304888, "uuid": "f539fe91-f389-4424-9ada-4e851acae1fe", "comment": "Malware payload", "value": "6f9098d9695dced5c14820b09d5ea94a6ebfd405bfc9d66ea2fce3401f82e4fe", "object_relation": "sha256", "Tag": [ { "name": "github-dcm-m2", "colour": "#1F7EA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762304888, "uuid": "fc35d9f2-dd0a-453d-968b-02ac57a01da9", "comment": "Malware payload", "value": "13d3aec0b57543e60ac84832e75238836a54bd2e", "object_relation": "sha1", "Tag": [ { "name": "github-dcm-m2", "colour": "#1F7EA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762304888, "uuid": "ad758026-ef4f-4f50-96fa-2487322d75ea", "comment": "Malware payload", "value": "00a8d94bd3f734732098c148fb6cbb8e72dda5f05b1c2c4a1a477eeff8a13eb156e61db7a21df17f74a4381606f00a7b", "object_relation": "sha3-384", "Tag": [ { "name": "github-dcm-m2", "colour": "#1F7EA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762304888, "uuid": "493db11b-ca79-4ea3-80df-485e6463a70a", "value": "T1EA272302823AC212FB0E6FFDE699013A9958E134651E5DDF2E7057B018B1AF256F3E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762304888, "uuid": "df0a1d50-7219-4e13-89bd-37dcc02d77d7", "value": "393216:m0Hf56u+vV9r10Gb/XFyKG0PWyIArCnseCo14zI575UKV5EgPE:m0Hf56XV95VbfFyKzP3TksG14zy75rV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762304888, "uuid": "de90fdad-fa57-4dc4-8742-a02d2f23f103", "value": 20624966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762304888, "uuid": "799cedaf-a67d-4376-b465-3ccc25c1bd91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762304888, "uuid": "6851d0fa-d04b-4d26-baed-4375d11f4a52", "value": "M1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e13e3a7-ba13-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762325359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325359, "uuid": "41554054-abcb-421a-9dd8-9710a6e6a6c9", "comment": "Malware payload", "value": "6b583d135294fa3e2b2cea4ed5af6893", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CAPI", "colour": "#5012C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325359, "uuid": "4b457d02-9275-40b1-a706-00ff115fad5e", "comment": "Malware payload", "value": "6ff9f347eaf66efd32d84fbee21a7830e73f2fb910a57564f87c6f94bdceb924", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CAPI", "colour": "#5012C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325359, "uuid": "0d608c9a-ce58-4db7-9979-3da8a9c7e95e", "comment": "Malware payload", "value": "7db6872a9b37a5c9795909d365e89b2c6a04ec81", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CAPI", "colour": "#5012C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325359, "uuid": "cf81a617-0f0e-4eb0-8c4f-9476e6cd545d", "comment": "Malware payload", "value": "d29a9f506c508136ff53260c455d6464326f3ac9aa57f6a5cafd2b3ded44ccb42a2b404dd1e17e4a9299238cdbe52695", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CAPI", "colour": "#5012C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325359, "uuid": "e46672a3-a6da-4382-bcde-053e909917a1", "value": "T1C092E1A8882C0119DE99F7BD48C4FBECC7D1F2382AB0954589957C9C16BB23A394C98C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325359, "uuid": "df49fb03-cf5a-43f4-84d0-6ea731a1dc20", "value": "384:9A+myjrqMnWDIrLYOXyIj0BiKTPxes59goyWJkwfXkXjNZ:NmQr9nAOXyIj0B9Zes3gp4TXkXjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325359, "uuid": "9410b3b0-c442-44c0-bd4f-5df83b0891a3", "value": 20050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325359, "uuid": "a576b9a2-ad89-4b3d-970d-cbbf9437fed3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325359, "uuid": "5aefbc50-c6b7-47e6-9750-8e13df2e6518", "value": "passinfected-capi.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24065dc7-ba12-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762324752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324752, "uuid": "b48ab318-eebe-4138-99bb-f73d3acf8570", "comment": "Malware payload (AgentTesla)", "value": "f28f61ee83d447a4338a5b66e100e4a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324752, "uuid": "2d7d7a07-ac7c-46d4-9d6c-e3f638e6f808", "comment": "Malware payload (AgentTesla)", "value": "7040225b32c3869e9ac1bfc969992e9ead2764d4bd840b87f435c49bca401a54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324752, "uuid": "f610203b-a9d1-4bb3-afa0-50b742320e6b", "comment": "Malware payload (AgentTesla)", "value": "77d1b5689fe604c1ba1c8d6a010d3beea8cc41a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324752, "uuid": "f98fe7d1-3359-44e9-81fc-4a843c10722c", "comment": "Malware payload (AgentTesla)", "value": "4b174f2fd3b70aa3eaf110c7133f8c4679a83df00ec1b06f3fa7188ca01c4c8c576bd78f858fa97c06c631ad340fe478", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324752, "uuid": "96b0ed05-15cf-4d99-a427-e67dc4f55478", "value": "T1CC052358C1E08EDBDFAA36006B94AA734D4F3CBF010E461D6357C9A227AC25505FA97B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324752, "uuid": "6306fc37-10f3-4961-b950-9b343db88b5a", "value": "24576:6S8Ju1cU4bEnP5Bg2W40w46MXDX8rEQ3jzKj+:F8MmU4IR/j4X0Eni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762324752, "uuid": "aafdb526-be51-42b3-852a-90f377c82d90", "value": 845039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762324752, "uuid": "ddaf3719-1354-4439-ad1f-9df211ddc600", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324752, "uuid": "8f654433-5ca3-48d5-a0f7-4d24fe4b4abc", "value": "PURCHASE ORDER#678909878876789.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259cc530-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376724, "uuid": "d9039f66-abf4-420b-92d0-ca66f2a40840", "comment": "Malware payload (Mirai)", "value": "657d59c74f9e5af471c142ead042be99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376724, "uuid": "38a8c4a4-9564-4e13-a712-a78566962290", "comment": "Malware payload (Mirai)", "value": "709994f1e6ef5ffcbdfc407df41923091ff193665e6ee59f092b43ca3849665a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376724, "uuid": "8eb8881b-6406-4181-b413-32168285f87b", "comment": "Malware payload (Mirai)", "value": "f4431425020e018eb76607782df4c94e89747b7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376724, "uuid": "85c4242c-c890-481c-8672-8c96d86af468", "comment": "Malware payload (Mirai)", "value": "c7ec3304bb644a80bd4da3079de87f5119b4a27c3d7ac9a925de824f5f5db4f3481056ad585c46e7e27ae4a9e3029946", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376724, "uuid": "68b698f9-3991-48bc-a194-2acd25ce0433", "value": "T194B2C0CC61943084CA8D7C7C578D4A664F6CA1D0BAED9F25E350CE98B3BEA8B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376724, "uuid": "8da6cc2d-6270-4f0a-ac1f-9ef8c861e4ee", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpKZqEWvT:/QlS07FUXqIYSXQKqu+qJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376724, "uuid": "715b4e9c-6cde-4e34-92ae-4159afd114cf", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376724, "uuid": "cd9476af-55f8-498d-b708-c3fc4d6313e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376724, "uuid": "df294e5a-7e61-4ba7-a309-0e5856de5e0f", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f3434d-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376748, "uuid": "b5ca6005-32d6-4980-aba9-a1c952426e0b", "comment": "Malware payload (Mirai)", "value": "9f1232d85c28a547b4ca2f43a00b934d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376748, "uuid": "71c06593-a791-431d-93c5-60e04b90aa1b", "comment": "Malware payload (Mirai)", "value": "70bd9f04552383cfbae0e390bf6ce6a1a5b4f363d0dc12b43f8b571903d1c1d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376748, "uuid": "07854aac-176d-455d-b814-d73b3810ba2f", "comment": "Malware payload (Mirai)", "value": "21d3b585639db98b7609cc34c1ac50f2076963fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376748, "uuid": "61f7f520-53a5-45a0-8a29-6a08098e7782", "comment": "Malware payload (Mirai)", "value": "d843d6d0b8929f718f9b59bbb1a84d7252b2540d6c85db15e87c0fbfaede51df2b087c6ecb5960033912bdbaa81afc1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376748, "uuid": "19c903f3-b374-4c07-abc4-fe24dfcd9cdf", "value": "T1AB2309C8F443D9F9DC4A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376748, "uuid": "701e07b5-c5f3-4782-8048-e14cd02b63d8", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2iXe:Gv4QPfZfW5XTOeoEzJ7AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376748, "uuid": "ad35ddf6-12ba-40d6-b58a-b55917b61337", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376748, "uuid": "ea856eb0-f808-435c-9d21-7a01eca512d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376748, "uuid": "53fe6f6a-d5a7-410e-847e-7c4a0b92101a", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d8468d-ba56-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762354011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354011, "uuid": "c8dc8ea2-c01a-4515-a0f3-4af57bc87f9d", "comment": "Malware payload (Mirai)", "value": "beea3a2eb6be7d34ae5eb5de7077397f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354011, "uuid": "665fae0e-231a-4d8f-a19d-c7a2c814d65f", "comment": "Malware payload (Mirai)", "value": "714b58277266e792fa80753193a9c024fd6f6aa659671f2ee7ac6cd2a619062e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354011, "uuid": "bcde9d39-7de2-410b-afc0-fe68b05b9779", "comment": "Malware payload (Mirai)", "value": "8ef7b2181bb0264f2d0de5cd240bb864942f91f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354011, "uuid": "b29506b9-4b90-45bc-8eed-64b28e08c21a", "comment": "Malware payload (Mirai)", "value": "b8c0cac9618074669b885ac3fa8530b4158956b3dc2a2ed2c8ac633e8a66c1826735c117a38f8e14146854766c96da72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354011, "uuid": "258cc578-20ba-45ec-9d94-dfa28e7a008b", "value": "T1BAD42845F8809F61C6C539B6F74D42A873074BB9D3EB72069A245B3437EB96B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354011, "uuid": "a7004816-6ad2-4f4a-9c46-cd77a79ae898", "value": "12288:mDG0cBNPKbeFdWAFBV97Y6SgpRFmvED12lvVa8pVkC4:P5NPKbe1FVU6DnFIEc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354011, "uuid": "bf8622a6-acb4-488f-b1b0-5588b3924849", "value": 604376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354011, "uuid": "48e69210-e7fd-40f9-96f4-c43d2f89578d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354011, "uuid": "afe987ca-e1ac-4b07-bdb4-c628404eb4db", "value": "Mddos.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d20390-ba38-11f0-91c6-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1762341240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762341240, "uuid": "03f2753e-71a0-4210-9586-b610d37b25e0", "comment": "Malware payload (NanoCore)", "value": "c1583f1af809d871d62caeef34ef6cce", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pw-00547340", "colour": "#A0DD2B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762341240, "uuid": "8fe77c85-3aa2-4213-a2c4-e6078eb54d18", "comment": "Malware payload (NanoCore)", "value": "71f39e2f07beb95c190ad94d9a4cc0ca94688a8f3bff91cb9b63d5a7036710ba", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pw-00547340", "colour": "#A0DD2B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762341240, "uuid": "c233683c-055b-4729-9566-4d3753d1cf20", "comment": "Malware payload (NanoCore)", "value": "96dae8eb67f0365a2fac57a03251ef8655d44725", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pw-00547340", "colour": "#A0DD2B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762341240, "uuid": "ee3b21ee-38bf-4f15-a46d-b63201325a59", "comment": "Malware payload (NanoCore)", "value": "69e0d17a8b033db28d412de5ab1106ba1cf43f173632e38467e235316f4fa7cb7bfc9ee928daebc52b98344f5032af7b", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pw-00547340", "colour": "#A0DD2B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762341240, "uuid": "3705f30a-4c63-4542-8336-78b1f0634ce1", "value": "T16CF423C147F6E4B035FD6E6BE2D5BE7C5121CC2C9F281638AEE2AD604241B6734256CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762341240, "uuid": "07e3447f-caf1-42f8-95fe-09f9f486fc9c", "value": "12288:BL4SJJbL4vVuVelnLlOE/VLn2CAQcFccRYWvyhHvrDiVht7Rp3ulQ+1tkhfpY:BLPJJbUvAVelLlO4qQcFhKzHTDidPemk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762341240, "uuid": "5f39a608-f4de-4571-80b9-fc79133386bd", "value": 734574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762341240, "uuid": "619f2618-0f42-4b1a-aabb-b17726787c06", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762341240, "uuid": "472729ba-1bb4-4b19-9082-e9cc7f3a0d0a", "value": "Proforma Invoice no. 04054756899647900006448 Nov 2025 787855.pdf.bz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c639f4-b9eb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762308011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308011, "uuid": "a36bbed4-2127-4bc6-90e6-a11e6fd7eefc", "comment": "Malware payload", "value": "61b8c00ba8cecda1dc44d6a62e32ab29", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308011, "uuid": "f45558f2-3e75-43cf-9c2e-00c00e683ee6", "comment": "Malware payload", "value": "73037127f884c8039074e268b444bfd286e2a433b8c900c48fb21887cd1e88c8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308011, "uuid": "2985df4f-0432-467c-b014-7312b7c6e2d9", "comment": "Malware payload", "value": "d5a654aec961e4e96af22e7ba81306a14a972831", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308011, "uuid": "221595bf-b96f-414f-8ffd-413a60b1716d", "comment": "Malware payload", "value": "1559c895d6046face2772fa6c50f9343842ff754f4d0b78ce0de58c61bba3cfdafec69681e8e7e3af4094c0b370138da", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762308011, "uuid": "6689d456-7b38-42ab-9729-a2cb0eecc4df", "value": "T14C1235670A15761681B3C1EBE0F5DE44EAFD80CA8FE288AAD4A147CF78175865C1FC1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762308011, "uuid": "770b432a-12b3-478c-9958-c114ebb5eb9b", "value": "96:9H+chu8j1A2HtirhhhhhhhhhhhhhhhhhhhhhhPhhhhhhhhhhhhhhhhhhhhh4hhhU:9Vu8j1cPcyuwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762308011, "uuid": "757ccf59-639d-482b-8035-22487fff633a", "value": 9686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762308011, "uuid": "8e3984fd-ca9f-41a0-80c5-5878a39d8185", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762308011, "uuid": "686ea09f-1e25-49e8-9b94-86bab1122df4", "value": "rPurchaseOrder_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df37a5ed-ba56-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762354272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354272, "uuid": "ae03b4a0-0496-4019-a0a0-a4830516e3a8", "comment": "Malware payload", "value": "090c5fa7a8db210af97780399638b749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354272, "uuid": "192fa29b-c69f-4ec7-b6a5-39aeb67b0694", "comment": "Malware payload", "value": "736e4577560250506a74c6f0fadffcd97ed3522664d4ced6bb62062a273c0bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354272, "uuid": "3d61466f-ef81-4685-bec7-deb025c0610c", "comment": "Malware payload", "value": "238e13497c6d72df224b891673c64c7406119132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354272, "uuid": "5ef41abc-2301-4d70-8cb1-c486832a393a", "comment": "Malware payload", "value": "e34c70b096494ffcda773e64bc2fe0764b100f04491b909e5a92ca876fe0f98a5cc55d5a82e5ca678079f1bf50990ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354272, "uuid": "c08499bf-6f8a-44be-9483-9728b86a1af5", "value": "T133363AD1A0BB40E2F1038AB490AC75890AB572A3FDC6443A735E77C48F6FE457985B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354272, "uuid": "9dd19bba-0d21-43c0-b787-1116f95fc38d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354272, "uuid": "57f31826-90ec-4e8a-8f5d-46ff76bcb37c", "value": "24576:Dw0pLu52ZMVhSSaVavKCjrg9PCzGJtlSZJWgqVxo2rY5y/vqCqMztkCuVCN7K7Ql:DEhB2mD5Jw5NCR7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354272, "uuid": "b2eb4982-d547-4f20-a1d8-0996ff0a565d", "value": 4900864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354272, "uuid": "5f98c9ff-d014-4a61-be02-7a5c76e0f372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354272, "uuid": "a8d16b52-54f8-418b-9608-ec5ae6e3a4b0", "value": "736e4577560250506a74c6f0fadffcd97ed3522664d4ced6bb62062a273c0bc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2632ce0a-ba99-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382738, "uuid": "22cdc219-4487-4d87-aeb1-51ab911ddff7", "comment": "Malware payload", "value": "599c2f407d9d3b29aa29ae50d8a2b09c", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382738, "uuid": "8ab0a219-0183-4436-ad81-80f14a9a6284", "comment": "Malware payload", "value": "7387388d493096cb5faba925041a1e7a1f392e5b320943c0dff622ec84132808", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382738, "uuid": "6009f9fb-c2ff-454a-b175-7f8428687388", "comment": "Malware payload", "value": "b0b9b70b2fa3670e219dc92c84ea594825cc7ac2", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382738, "uuid": "b6ed4654-d8e5-44b4-919f-509938af9e43", "comment": "Malware payload", "value": "e0c01a005e3bbc1ef4d40a6606bf4caacb0e15b5d93e8de61794e3c718a18320d139febf7332fca889975a2be54e091d", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382738, "uuid": "0a5dc2d1-e70b-4bbf-842f-639f788a616f", "value": "T11F541268512E8365EE1562F7FCBD9496FB3E4ECCBC25184116E618E072B1905BF0B0F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382738, "uuid": "2f814d2f-4c8a-4dd0-806c-eec6e0c280ea", "value": "6144:AYu6ERcxrVFEu/OOqvJ4uOYu6ERcxrVFEu/OOqvJ4uOYu6ERcxrVFEu/OOqvJ4ul:AAvxrXm7BeAvxrXm7BeAvxrXm7BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382738, "uuid": "ab06aa0b-4365-4d67-90b4-cd0bd37acf22", "value": 293808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382738, "uuid": "1bebf918-004e-40bc-9141-e2a66a375093", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382738, "uuid": "27765759-cebf-455a-aa3b-6890131b8255", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058b271f-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319976, "uuid": "21d0ff54-53d2-4db6-b5ad-4e995c72a53b", "comment": "Malware payload (Gafgyt)", "value": "d9cc5587ddae7305f2dbb0a5a1c50789", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319976, "uuid": "0d88abe1-a948-4c00-a063-cc1e7c66daaf", "comment": "Malware payload (Gafgyt)", "value": "73b48d1ce6a75f75494f67bcac08a677bedc4fd2d8d3ff7242867e2ec12f99a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319976, "uuid": "75aa4461-79cd-4123-b19f-9e203a1157b2", "comment": "Malware payload (Gafgyt)", "value": "88540c1d7f621299628fad8221648d88033cc684", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319976, "uuid": "f232dca7-4054-4dc9-bba9-49b88ea05d5c", "comment": "Malware payload (Gafgyt)", "value": "fc874843fa58b8a1c2fb29870d016a7d41e990e77301bf7bdfbaf20855678be1ee178f6187618e47691fff9f67e22769", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319976, "uuid": "9eb2a092-f3ad-45eb-8762-2898b5460ab5", "value": "T137C3C536B7D18DF9C00351F017FEAEB2EC21F1FF0276B06B23A02D645A6A9C25959E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319976, "uuid": "b88b5a03-85dc-4d06-a7ce-374a07fc8e6f", "value": "3072:Ksp4FnHJ07W5jk0I13++NlNNyphaSFwq:5hS55IJJ4phaCwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319976, "uuid": "dea35c37-cee7-44fd-852c-a0d8092819a5", "value": 118216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319976, "uuid": "9eac0648-0258-4a11-af4a-7f8f6206df32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319976, "uuid": "33c0396f-841a-4708-b2fc-cd390a4f8729", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32c7a1b-ba52-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762352560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352560, "uuid": "21600dfc-6220-473a-9f6a-50fa10595406", "comment": "Malware payload (Mirai)", "value": "d7492f40c07ac3b06796de3604f30f51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352560, "uuid": "32b78706-eba5-4d1f-a87f-1f1b04921de1", "comment": "Malware payload (Mirai)", "value": "7477a70bca4abf2795c9118c8c48037b0acfb9c43e66a49ee31546f6a646076f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352560, "uuid": "022bdc3e-2e0a-4695-93d0-0a55b1283ddf", "comment": "Malware payload (Mirai)", "value": "c920963c506b17e9cb4be5f8b05121e0a6cf2eb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352560, "uuid": "ec02dab1-babd-4acd-8914-a2ee4aaef150", "comment": "Malware payload (Mirai)", "value": "d9c1df1c2e42c05fd85e78c039790ca43d404bc228a9f91eccccb9f3b1d432cbf1adcc6273de59d6be4c02b8d74352ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352560, "uuid": "663bc2f9-267e-448f-8fc3-4252ce6d6ab0", "value": "T15CC43945F8809F61C6C539B6F74D42AC73074BB9D3EA720A9A155B3037EB86B0F3A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352560, "uuid": "7407f89c-f356-40b6-ba60-6c976698ebc0", "value": "12288:kvFww9PoXjMH8/+ZHzSm+TEj7d0OY/OLaxOlsTHm8pXkCv8:iNPoXxMzqTC7ef/wa9kC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762352560, "uuid": "bae29ff7-7c5b-4500-9e69-dcc2d35af4bd", "value": 596176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762352560, "uuid": "dde4bd8c-b64d-4d09-b22e-9f1c786676af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352560, "uuid": "c215b5d9-c07a-47e7-b301-fe1d75808735", "value": "Mddos.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbb9c34-ba12-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762325090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325090, "uuid": "12c71e65-64e2-4fe3-b1bb-e0b5bcde69dc", "comment": "Malware payload (Formbook)", "value": "c384138b5ea21c5ba6962a7d01f8266d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325090, "uuid": "580c1008-8115-4d02-a59f-576e8de5c9fa", "comment": "Malware payload (Formbook)", "value": "7588832247132c319cf651c3c22d96a7e6e427c642c95caad385ea086624f28d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325090, "uuid": "f1860580-a27c-409f-b38b-0485f6bfcbde", "comment": "Malware payload (Formbook)", "value": "d6c5c086b4c20e1aaf915b69c2838fccc2b2ee54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325090, "uuid": "d80512b1-56d9-40b6-a6e9-0dad4431f5d9", "comment": "Malware payload (Formbook)", "value": "32addee0f7ab216159e291e1ab2aa0d90971d9101da35399c3578ee062d7e4512638b206ed4ae6a31a7f15607ffd76f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325090, "uuid": "f99ba99d-7f69-4678-8ff9-63d9df1c0285", "value": "T16945E01923C99F88E47FA3B8DBB5052847F2ED06DE61D38F799928FC7522B418548723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325090, "uuid": "2acf4384-6c98-4ccb-b8a5-8197bc542442", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325090, "uuid": "e5a999ba-ebea-45e2-bf52-2aad3da6eba7", "value": "24576:af39HT4qnaH0P2l/daes9S7ufPNxPb+cUxifknM9DFZ+hj:Yw5l/nss7udxPhX8Kaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325090, "uuid": "5b1838cf-db34-4808-85c2-9140ee0a7030", "value": 1166848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325090, "uuid": "849c8aa0-e3df-44e7-a19f-fd50ccb0647a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325090, "uuid": "044d5942-3d86-4fef-9626-58d69108eb71", "value": "PAYMENT REMITANCE COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d18e2a-ba14-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762325718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325718, "uuid": "67f92b5f-43a6-46ce-93dc-7191e0005971", "comment": "Malware payload (Mirai)", "value": "982ae031a8d9b369d9488296283a67c1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325718, "uuid": "9e13456b-68a5-46b7-87d6-9e43669037b0", "comment": "Malware payload (Mirai)", "value": "75d1a9224f6e656a39a89af5d9e91c7ddaf87807afc6ca007cfdcd8512de5328", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325718, "uuid": "8c10a177-8cb6-4034-902a-3b16e1503679", "comment": "Malware payload (Mirai)", "value": "559cf790df1e84b670ceb3c239e6c6a5448cc388", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325718, "uuid": "30b67b20-1e9c-4aa1-92b4-c3bbe5d38cbb", "comment": "Malware payload (Mirai)", "value": "9e4cd292fc7a89fdfa079c1a01eab9541b4d6f2c3ece7f33c37807251f0e1184c2793380c147d1e3f0d19ccd4c5484bd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325718, "uuid": "b2e4bfbc-52a8-4287-bda4-ba0525705b68", "value": "T1B50147CFB4B284304814C5B835A3CE18F28DD1DA59C99B8AE26E8879708DEDDB411FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325718, "uuid": "87a264ca-88d0-4f6b-b284-b66a179a9d37", "value": "12:vWOZF85ZMNM2V4ZMBAENl+HWXwYAfCK/QTlQT2CIyg8oQTlQTC:uOZF85EMy0MBSWA7K4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325718, "uuid": "9ef83b23-0837-4431-9dab-95b381228e40", "value": 721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325718, "uuid": "0cc7e93e-a094-48c6-9160-f7166ebf852b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325718, "uuid": "f90e1b6b-44c5-4ebd-851d-318cb093e869", "value": "mwah", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fbb6e0-ba04-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319086, "uuid": "9a4b1a04-8f71-4d88-9b31-4c06573cf5fa", "comment": "Malware payload (Mirai)", "value": "88a4255e3a9c4d5c387b671cf96e8344", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319086, "uuid": "0b4e78a3-bda5-419d-8714-4f2c9341fdea", "comment": "Malware payload (Mirai)", "value": "765d22ad5abe37a8c0248666b8772e2822ab85de942277f565f34dc7422bc545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319086, "uuid": "4284f211-7bd8-4b6e-8f0b-b14ea64be9b4", "comment": "Malware payload (Mirai)", "value": "c77666a305a228ce28da7ec5655cd7a083d03990", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319086, "uuid": "124b8a49-2603-40b2-8275-79d5a309ed99", "comment": "Malware payload (Mirai)", "value": "b429cb79c1cadee9ece44717e3cae2eda12f29241c7223a78def8a102fbb6ba2ec51631eb7f710e1840d98368882e86f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319086, "uuid": "2b0e8567-3f43-4af7-97e3-b3454eb9f4ff", "value": "T12D73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319086, "uuid": "854cc2b1-6baf-4f50-9acc-525e74fa0b22", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerESts:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319086, "uuid": "effc6213-97fa-4119-93e0-9a7d65a6619e", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319086, "uuid": "7a0ad0c3-997b-413f-af44-96c10a8cb84d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319086, "uuid": "67105f5d-45ee-4611-b4dd-04eab9af3e9a", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f28da09-ba58-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762354782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354782, "uuid": "5db0ae26-2f2f-4588-8727-097eb0c4ec4b", "comment": "Malware payload", "value": "f178475d2a0086ae9eddecfc540eaa15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354782, "uuid": "d5e9c59c-b17b-4771-854d-e0a9f2652dff", "comment": "Malware payload", "value": "768f9d4c2dd33e72d10c18af8646eaa28713333a93b4d4f215c1d3d9cb921591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354782, "uuid": "2f85ddcd-854e-48c4-ba33-d2b20227d08f", "comment": "Malware payload", "value": "f6f9ee0ebfd53d7b8fd661df5fa228bc5ecb0540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354782, "uuid": "8e982e7d-8d3c-4f73-a386-4d1547edce8b", "comment": "Malware payload", "value": "ca476e02524d2296ef50a9c5d2075519f37d1cf59a21ec4ea398ae0e0b4e90a6f5c8e1415dbcef9e0e7c35ad831075aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354782, "uuid": "bcdb3494-cf5a-46bb-90e8-0c64246ccd0e", "value": "T10806AD15E3D901B5D83BDA78CA558333D6707D926735C14F0A98FA0A2F33A909B2F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354782, "uuid": "6949dc86-70d9-4231-bb18-7bd82349edc4", "value": "7b407282ef55036d842693b1714d0a5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354782, "uuid": "2cd50987-7577-48e0-b3f4-ee9a23e6d479", "value": "49152:WXJiTBrFy2D+Unij1/ujNsMWYlP2g16RXg2IM373K3KKolcIEVbf:PrPZipcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354782, "uuid": "99f9034d-c74c-444f-bec3-16c397be3e13", "value": 3783168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354782, "uuid": "f2c00eca-f570-43b2-a6f8-edfeb3e1f203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354782, "uuid": "95f19b1c-22b2-45fd-b7a1-2b45a59c7d12", "value": "vmtools.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d5b911-ba4d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762350040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350040, "uuid": "a2447030-375c-4410-adb9-18c12a2a83d7", "comment": "Malware payload", "value": "c704bfd94d7592e467a84b40bb64fc40", "object_relation": "md5", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350040, "uuid": "acd409dc-bee3-46e8-9c57-fddbaa0c59b4", "comment": "Malware payload", "value": "76cae04f9b3c1fe16f10b2740ff23a067258babf7f520c81a6fb16687f425d19", "object_relation": "sha256", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350040, "uuid": "d85cc420-5831-4604-b37a-09f17e309615", "comment": "Malware payload", "value": "7bc8b8cce5613292a147da481f93cbacfd9f490b", "object_relation": "sha1", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350040, "uuid": "4f3a25de-2ae4-4864-b249-63c10ac19d0b", "comment": "Malware payload", "value": "573d464390f5f810a7be793fccd5fbea4de4d42662ba38d5ae799326fd5dce2ff760d1299a42795803c9df1cb79a1fa9", "object_relation": "sha3-384", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350040, "uuid": "29124688-0809-47e3-8ca5-8cc0f080bcd0", "value": "T1E163F1F46725502FC2976D32C8A52E97CBFD6713C7A37A992C2487A618F63CF0550AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350040, "uuid": "234ceebc-f078-4946-9ec5-3272fce2d359", "value": "1536:3The4vVywksJe7Qdozhqz4J/VRkGR/gFaKf:Dhe4dy6oQkdRkO/gFaKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762350040, "uuid": "aeb6fd13-7ebf-4f5f-bbe8-0814b458e3a8", "value": 67693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762350040, "uuid": "0b32da68-21e6-4096-9a26-e9bb35e2cc5e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350040, "uuid": "bd31714f-724a-43c6-af68-f72c548871ed", "value": "76cae04f9b3c1fe16f10b2740ff23a067258babf7f520c81a6fb16687f425d19(1).docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3564e4b9-ba1c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762329076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329076, "uuid": "b852ac27-0421-4c84-84ad-200b1aecee76", "comment": "Malware payload (Mirai)", "value": "7bbac582cb20aaecae802025dd8bd5a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329076, "uuid": "da376f14-4cf7-4ae4-a4aa-93cb19b95313", "comment": "Malware payload (Mirai)", "value": "76d7b5f022285d79334f52b15141af6cedb2dd7d71807c35334a7ce2fbb89096", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329076, "uuid": "889f343a-45e2-4a54-aa2f-ea94f9dd2c61", "comment": "Malware payload (Mirai)", "value": "ee3e9b60b26c3a50ac4f59bf11932a25a1483053", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762329076, "uuid": "c104b0ac-8170-47d5-bbf9-c5a0eda248e7", "comment": "Malware payload (Mirai)", "value": "87ac5903e42f3b4a7040cdafc5e807e8c5d0d5bc28c8ba9eac79c863a32fccf20fa7d3041c9722645f36737728c1c5d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762329076, "uuid": "a6a87209-7615-446a-8506-dbb08ae5f1f3", "value": "T148336C36E029DED0C6560234A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762329076, "uuid": "020e0a62-6455-4974-8b85-2957deee664f", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762329076, "uuid": "39884e26-9023-46b4-9be5-515fd7e4db1e", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762329076, "uuid": "e77a1982-f810-41ab-b3cf-7a2fd6d30149", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762329076, "uuid": "90982140-e1ec-4d93-94b0-2ca6368f8115", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f1c9e2-ba7d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762370948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762370948, "uuid": "112cbc89-8a3b-44fb-927e-782e6f705ee0", "comment": "Malware payload (Mirai)", "value": "f43ad7a86acf8310f9db853b9f6d8c19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762370948, "uuid": "f7ec64d0-1584-4c84-bd3a-96fee594a3ad", "comment": "Malware payload (Mirai)", "value": "77b3617bc6dcb1685608f98ccbc71557f3d89407c7ee068e17b6bf36ade76af2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762370948, "uuid": "003eb598-732a-4a9a-9327-9c15fa4ffadc", "comment": "Malware payload (Mirai)", "value": "e5990a0df7c1d243719b315597c31e4367a813e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762370948, "uuid": "4011fc0a-51f4-40f8-a632-99112693250c", "comment": "Malware payload (Mirai)", "value": "87db2bdf4e587093fd749c284c47720b0b6e57ea0543fc969de75cabbd2183da9629f261a932f608a1a7f9d5ef276b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762370948, "uuid": "28afbdc1-63df-485a-b957-7c19bdaaa537", "value": "T1B7E44A06EF440FEBC4AFCD30852E835B15ED9D8702D1A779A1BC894CBA9D2694FD3948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762370948, "uuid": "95eb7ad4-2543-4c80-a988-8e77b82e7501", "value": "12288:R6HSmwdKbK9WC6f5gglvjXI0+FLNa84WqfC+SH7BDmNt4XdKznmaHPInxb/MF/Ow:uOrlHGJMPHeBbxvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762370948, "uuid": "e496b6e3-c747-4cd5-a4c0-8283235f1d05", "value": 722588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762370948, "uuid": "7a61d0e1-4467-4fd8-9d0c-76264ef5f113", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762370948, "uuid": "ec52afee-ee3e-4044-ae51-c05e381f6dbf", "value": "Mddos.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d965de1-ba26-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762333519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333519, "uuid": "47eb0d4d-1ea6-422f-974d-609f5ec870b9", "comment": "Malware payload", "value": "9f7bd0dae4e145ced945c33264ac14e4", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "mirelyww-com", "colour": "#A7A132", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333519, "uuid": "0acbc25d-0ae5-4ab8-83cb-e6fae444d8e2", "comment": "Malware payload", "value": "77c6aaf81354dcb78c617fdfbc89a9e103ec0c1bb1befab2423e22249dfb08cf", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "mirelyww-com", "colour": "#A7A132", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333519, "uuid": "31ac90b6-84cc-466b-a684-4208fb3d4b3b", "comment": "Malware payload", "value": "ceeb9fdc947d0f79a1fa1f0d10f60159cd0122a0", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "mirelyww-com", "colour": "#A7A132", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333519, "uuid": "a99d982d-7abb-4066-bd08-895550e45791", "comment": "Malware payload", "value": "dcabadc9765743bbde761205f6b767ec82ccbbb92fa0a8290c2a11eb1326d59e7799498063c0f3888fc4966be4462451", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "mirelyww-com", "colour": "#A7A132", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333519, "uuid": "53982897-de0d-44c8-be42-225a7c49ab3e", "value": "T1DDD5337547528F765E27D982833106ED165A023DA4FE7F8504CB1022F6A588DBBB3CEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333519, "uuid": "2a8fd63d-6d4b-4181-939b-f414668fa8fe", "value": "49152:9ojm2+cQGMZKmUob62eg9eaATSj7uoD6B5ZXzFXsvUCIeB9zoerjc:Am2+zXZh9bp2a71+pXzNsMCICp3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762333519, "uuid": "272ee97b-5887-4eef-8d51-90905345dcb3", "value": 3005154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762333519, "uuid": "c3d74c36-96e2-45ca-919a-2d58d87b2cd3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333519, "uuid": "3cd88684-f63e-4439-b283-1ec00ca1ab5d", "value": "updserc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7250de2-ba20-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762331065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331065, "uuid": "d26da42c-b5e0-4509-9d0d-9845514de01c", "comment": "Malware payload", "value": "9a677aa7b10a3582967e863a6c1e7f28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331065, "uuid": "e25a7174-99ba-4e1d-af44-1a27c8c9a1b9", "comment": "Malware payload", "value": "77d7ed3bcb8f4694d83758da1be1ec04b725ebdd9a5fc8279cd36c31da196505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331065, "uuid": "cb4614b0-3796-434b-adfd-bdd890e8be52", "comment": "Malware payload", "value": "8d3e005646f5cd91ea68f578e54f9988ee3346d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331065, "uuid": "ffd2a26a-a5c4-4228-a6d1-2c6de21b9c2f", "comment": "Malware payload", "value": "ae9e0a454a0c1d5d910438249a1796e2aebde3823531f9a432081928e4659861b4595f2247eefe51bbb6a391913d8470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331065, "uuid": "46555d2e-cbd6-47be-b92d-ea1c28e30f35", "value": "T15284EC1274AE600EF1B77B367BD9BE8FF65E27612E03954B51101E4B3E22C818F91729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331065, "uuid": "1eb787ae-aa49-42b1-8731-7b83f448a9ed", "value": "3072:4AHsQbjayGeObkfN1RDFsaq8ygAPNjdcNjMxzCum3aT+cpxxS7:uUatbkfDRDZqpgwFxzCum3aiaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331065, "uuid": "33308d1c-5d7a-43ff-86bf-480d51cc6c0b", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331065, "uuid": "a53bb2d4-c689-459f-a1a2-e7b3550a79c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331065, "uuid": "100398f9-6138-45cd-b87c-eb58dbcd680b", "value": "#INV-20250129.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef68c962-ba95-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381357, "uuid": "2731f735-fc3c-466c-b55a-e6d017f5f0b3", "comment": "Malware payload", "value": "4030797536d9452a652957b383489e97", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381357, "uuid": "1b345ca0-5bc9-495c-a6a3-bb9131e3da9d", "comment": "Malware payload", "value": "794883918d9dff93db8b772a6a7950c7b928e1de2fe11f41f2990afb0f55aebb", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381357, "uuid": "3f8601fc-5374-4cbf-b5e6-69098fab57c3", "comment": "Malware payload", "value": "9baa3d1acab85fe6323ff3020a2753aef4fa6e0a", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381357, "uuid": "4196d831-18a5-428a-8ebd-4c0c7de33458", "comment": "Malware payload", "value": "e497e5c4da36d2a865d9632e7b45fca0e1707aec369dadc8708c0666729ae83a73c3a56e1393c9f94217d52de4a2b331", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381357, "uuid": "190d908a-248d-4976-a48c-8c3929bf9195", "value": "T1155412441D6B9C870C7EF5D042FBFD0A53D3FAEA5C45E7E06080E1E62AD642D2A5B178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381357, "uuid": "f0239cd6-9911-4fbd-828c-97c8df4d20a2", "value": "6144:CEUiCOKPykyXHhGIXVOpiEUiCOKPykyXHhGIXVOpiEUiCOKPykyXHhGIXVOpH:7UtRKdhGIkpbUtRKdhGIkpbUtRKdhGIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381357, "uuid": "e07f6643-97a4-4874-896a-30197b442733", "value": 293847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381357, "uuid": "f987e9cc-2ec6-420b-919e-ec43f6fd3579", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381357, "uuid": "9be7af4a-5098-40ce-83dd-95339959c3e7", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3eefa1-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318624, "uuid": "f38ba330-794a-4fd8-9ecb-22de68f6d956", "comment": "Malware payload (Mirai)", "value": "f34c83a544d4e8ea248de28da9043a4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318624, "uuid": "76b78ee7-33a4-4d5f-803f-50971b6d58c6", "comment": "Malware payload (Mirai)", "value": "797b79dde82ce025f5ac10181256466e1acc515e0937fd006feba358a97e3f3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318624, "uuid": "c7baac55-75ae-4279-99b5-7d540f5a57ef", "comment": "Malware payload (Mirai)", "value": "a4a55bd244500c017f1dd52f54faee84bcff3cc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318624, "uuid": "a2edea8a-2578-4fe4-92c6-5f4709a26971", "comment": "Malware payload (Mirai)", "value": "95ae14afb69e7ffbee0b82778fb1589837c0cceb93bd18750e7c878461c949b6b3bf27f1b7068a646c20a0130d878a7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318624, "uuid": "da16bce8-d7a2-40a3-b6f1-c614abfb23ae", "value": "T106E34D8AF802DE7EFC0BE57E44670D15FA30A7613243172D529BFDA3AC321A65D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318624, "uuid": "880bed84-d461-4ea5-af1e-f80caeba2739", "value": "3072:luWypdcGShA/oVlPA39TsZJ243nxl9XzrTmdDp:gCGShAAsThAxl9TmdDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318624, "uuid": "96983eba-c102-4375-a98b-caaa64f5aacf", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318624, "uuid": "c640f35d-a92d-49a6-af01-2bf8b322fc47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318624, "uuid": "bf5a4e94-426c-4d0c-bf2d-31247a29651b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568b5de9-ba2f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762337292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337292, "uuid": "adac249d-099b-4002-a690-f19bd8566df9", "comment": "Malware payload (Formbook)", "value": "01818e883a3d8efc6e2fea66f1b35b42", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337292, "uuid": "bb19f090-9d7d-4b7c-84a5-fdde4d3333fa", "comment": "Malware payload (Formbook)", "value": "7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337292, "uuid": "ec093124-1cb1-40b0-8949-3f045444e742", "comment": "Malware payload (Formbook)", "value": "987b7b137633df23202b259bd702ba8fea00d297", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337292, "uuid": "37d4a79c-0471-4338-88e9-8008d2d857a2", "comment": "Malware payload (Formbook)", "value": "c57727313a5856e38095be5fb5cd4b62f5d1024633f07de15ca7065ea45e78ab1e245e58babed8c5d87f87ec8343ed62", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337292, "uuid": "df15a587-82c9-4fbe-a084-0bab23759379", "value": "T1E6D65B6F76A186A8C35DC13AC0A78F05E53370B91733C6E793B402686E5A9F04E7E764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337292, "uuid": "5223c19e-d658-4c25-90f4-e691e4b638b6", "value": "de6273c02bd4519d211a58c54c890cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337292, "uuid": "88e5cee5-5410-49fd-a1bc-237a3a21fb9d", "value": "98304:aRkyhrOHMsfh0V2Zcni6bYm0dgXW7zUaPdQI:anhr/spC6ce+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337292, "uuid": "3db056f0-fb69-4e14-989e-af4122956074", "value": 13041664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337292, "uuid": "4f657154-336c-4adb-a1d8-43f040bd7e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337292, "uuid": "aa2f908f-179c-4d05-8a57-8954a7e4430c", "value": "7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56f87c0-ba56-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762354309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354309, "uuid": "01d10cff-6794-438e-9acc-171fb42d1ace", "comment": "Malware payload", "value": "6a87216ae80421c5783c4934f85c8611", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354309, "uuid": "9eacc9ed-6b4e-4cee-a805-f553f9e0e127", "comment": "Malware payload", "value": "7d37cdc0b3800d4d6e96c66a9006abd7b2b97d27546af6a0b3d77dcc04d40a2a", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354309, "uuid": "38df4614-b0d8-4cf7-9cd1-478d4e4f70ec", "comment": "Malware payload", "value": "34699b3760aa457532b515717c519603ca69f827", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354309, "uuid": "15950e31-a0b0-47a1-ae35-2989e6130204", "comment": "Malware payload", "value": "dfd3ead2780b5da4d0ad8472e1dfdc08ea21c239c3622a479e60e7539dbf0fab5ea79a3169592a0e12b18ca1e109eab8", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354309, "uuid": "ebb11b8a-5176-4784-a2ba-554b065e83ad", "value": "T1A9129554BF577A26BA24F17988170BCE0D5D40F7DF01B0F89AB9B03968602541B7B27B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354309, "uuid": "3e3ca07a-cf8f-4565-a7fa-8cb1091474cb", "value": "192:spkYR/e+KWGkI4n55no8pSGQDTYErtNP6Pw+M:spkYVe+ykI+5no8plQDUctNiPw+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354309, "uuid": "fe3d919f-5aaa-42bf-9cb5-bc290c8764e1", "value": 9552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354309, "uuid": "93265739-08f4-4160-a062-97eec5687750", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354309, "uuid": "5a5d53cd-ba8f-4a08-bb5b-c0c9567ffd4d", "value": "Project FMD2025UOS.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81a7dad-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316813, "uuid": "684239a1-91fd-42de-9271-6b908d37d4f4", "comment": "Malware payload (Mirai)", "value": "c5b9e61771003258107ad7340a441b3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316813, "uuid": "3a8e85b7-7208-4f3a-b791-41335d93043f", "comment": "Malware payload (Mirai)", "value": "7e178cf20f7ca01d17f31ed5e4af1b91d8266803ec29600fd16b538b67a1a44e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316813, "uuid": "3aaacd88-5e02-4aa5-976f-97e2f7da357a", "comment": "Malware payload (Mirai)", "value": "0136aa372a8c87e50f5cf550f5772a2ddd731cd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316813, "uuid": "4e954853-e25a-4b82-84b8-31789493cbdb", "comment": "Malware payload (Mirai)", "value": "f3473a2c099ca806e475003263a58a165194c0a85eda6b2bef624aa2b8469f2c26ceec5ab9f77ad460927b232b440d87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316813, "uuid": "63ad64db-ff0f-438b-88f7-5b38c49bda83", "value": "T1D573940E2E619FBCFBAD863587B35F209248339226E1D545D19CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316813, "uuid": "4541f1a4-611c-4c50-b988-81cbecf4a1d5", "value": "1536:D4Z8VUay6+vl/R1KIdysUmR9EiYHXwoRyNMnTwZjDETW:E6Zy6+vdGIdysUKsyNMTwRDIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316813, "uuid": "9827ad6a-8303-4364-8931-f5ef0660ec26", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316813, "uuid": "8c95cc44-c97e-4c98-8a22-9d0466b7b257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316813, "uuid": "2244003e-f8d2-4da1-b2a7-ffe2faac4764", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d124d53c-ba3e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762343940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762343940, "uuid": "f95bef57-669e-424e-ad22-02109b9ddbaf", "comment": "Malware payload", "value": "b0bba9fa88dbfa35f3b9c155693851af", "object_relation": "md5", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762343940, "uuid": "daf40be9-3562-45f3-b13b-ba1539e21cff", "comment": "Malware payload", "value": "7e601dc6d04b80c316f45ccec9406d77c87911901e68068cef18a21210ad9fb9", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762343940, "uuid": "a05206dc-5153-45a3-ad01-db67f8b62572", "comment": "Malware payload", "value": "78c30b005ad5af5881a7a16963dd81e19c8aae40", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762343940, "uuid": "b662cbbf-23a2-4998-ab30-a6f3a7541744", "comment": "Malware payload", "value": "145cd1ba5572400552ecc6d72334927f3bbf522d60676a72109b667508f90cbc441210c71fdd50f54f1be1cafaa14d4a", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762343940, "uuid": "bfd19845-a6cb-4082-98f3-4c7479c56e2a", "value": "T1E185334F506E20E8CBA6551EDBFBAD5FA0141F15887E038D2A2DB697A4B0FF52D6F001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762343940, "uuid": "dd52ed4a-751a-4bd2-b03d-85fec5d1d4bc", "value": "49152:TWA9vor5q1JPt1IDizWqbnhb4hsPaeMlMefi:Ktr0LVq2zWq9bUtv56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762343940, "uuid": "74ccf969-7328-4dec-be9e-870996bce64f", "value": 1812646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762343940, "uuid": "b0c4470e-2b9d-4eaa-a0a2-3dd286bf8678", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762343940, "uuid": "1188bbfe-f4ac-4570-942c-1efc4f54f28a", "value": "stars(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7aac428-ba3f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762344434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344434, "uuid": "c1aeca66-e0b0-4c0f-8931-f30f720cd472", "comment": "Malware payload", "value": "94a50412467121827a12b5be4668fa83", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344434, "uuid": "9b083b3e-fd15-4f63-8160-fec525f3777e", "comment": "Malware payload", "value": "7ef0beb610146d2c3979008510ef15cabd047a8c0f7d50451bb200e9c40ee301", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344434, "uuid": "83117fd0-d65b-464d-8be3-6c645d136a6c", "comment": "Malware payload", "value": "86cc62133915a94f168c6e1e52c03222043dbee8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344434, "uuid": "7ca42198-ba58-462a-84de-92462d13f276", "comment": "Malware payload", "value": "a6ae323a3660b2dbf411c3c0c5357c359d208a20dbccf48f97c5b7060968093cabddd894d5675848a7de826233141194", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344434, "uuid": "3a5c99fb-a878-4824-a5b1-89c2f9e7b2fb", "value": "T12F67335BE9AF5BDBE83B803088B9B5699B66BC3B4E424C3E3424724714F36F0B575049", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344434, "uuid": "e7a3a73f-06c8-4c27-8d46-b4bc141cea46", "value": "393216:hFLiEePdZgmqNTbKFRpdzhCOqwSpfuGtbBhXzLbzFHDNYuV6Bdv/NDis+2KPiGjG:hVJ4dVjpSVTtbP1ebd9DioK/jkMYHwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762344434, "uuid": "c2af6951-4f43-4717-971d-a3d76edf43a7", "value": 29761536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762344434, "uuid": "14705309-e50b-4666-bf44-c0c115de2737", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344434, "uuid": "e8215657-b936-4bb6-9097-0a36f52b63c7", "value": "EasyStart.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce68911d-ba13-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762325467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325467, "uuid": "4f65fd85-9352-4ab6-bec8-b1e0e1fe26ba", "comment": "Malware payload (Mirai)", "value": "ee9e602dbee89013e8a6d7298302cdfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325467, "uuid": "bf020da0-bb7e-42e4-9888-af4a306c7154", "comment": "Malware payload (Mirai)", "value": "7f118f5bc074dadefe60a67e1517f6866984cc51d3adc3312329332deb0dcbe8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325467, "uuid": "c87efd58-057e-4893-ade0-976ef9566a28", "comment": "Malware payload (Mirai)", "value": "25184caede71875aa76aa945598ef8845c6d9827", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325467, "uuid": "e2b8bbc0-a5c7-496b-bc3a-09a603f8c145", "comment": "Malware payload (Mirai)", "value": "d43b193d976763c45e924fb18f51d42f22f3a92a066c8604ba32e2b5cddb3d4f75ff47030deb89adc5db974ccc0fb949", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325467, "uuid": "cc07d16e-adf1-4e47-a0d6-348cdc2dc474", "value": "T124F2F1D4538CDD6CC2A0D1B70DCC752AB6E0DC153B6CCA165B58A2EF64F1128C5DC9B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325467, "uuid": "b36aa48f-5f2c-4628-9235-2057a1079301", "value": "768:fNJhJrqSELF2qX5lNfBH+Btl2sJa6Cg24RKlrPrMV0Ms9+CzUS/:DuSC20lbQOsJLAe0VY8r/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325467, "uuid": "0f097545-2359-456b-bf21-3c18d7ae5fc4", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325467, "uuid": "57ae0f07-27f0-4125-b92a-128614a1397b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325467, "uuid": "cf79346c-e8ce-41d0-a8d6-cdf2237e6277", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e17730-ba91-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762379294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379294, "uuid": "b6afbd70-d533-4b0f-8226-04b2c4500859", "comment": "Malware payload (Mirai)", "value": "ed26ba41b2c6ac8a263fe98f53d373f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379294, "uuid": "73227a26-4bea-4044-80b6-fd18ed43be6f", "comment": "Malware payload (Mirai)", "value": "7f357d922d4e4f5a5b00223b1570504b9c9f020b6d1d5b695592fe9e65699959", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379294, "uuid": "25270a18-2dd1-400d-8b51-800d408cb4b0", "comment": "Malware payload (Mirai)", "value": "3cd035ec4c1e2d5446cff3f286e2180752e0d519", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379294, "uuid": "26d4f8f3-a5bb-4a7b-92db-18e2006628ca", "comment": "Malware payload (Mirai)", "value": "1ff655d9fcbfcbcd3301e22dbbf7eec87b1852a4f12b34424aa8a858e038177292ae709524f21197904a039c6f291231", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379294, "uuid": "103c11f8-047d-42b2-a81f-582724bb044d", "value": "T12D331881FCD2996EC6D41779A36E618E3311B3A4D2CF3607CD186B2276C660F4DABA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379294, "uuid": "75c46866-e379-45fe-a558-433dfbd3a05f", "value": "768:GZyw3o6ttNYWE1LSrVMKarg5ewFoi+cQC31Oo/Qg3y+dhNBN7nTKmz:GZos7E1aBewFoin31j3y+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762379294, "uuid": "f8a2227e-20fa-4999-b085-a73352fd980e", "value": 50552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762379294, "uuid": "57ebd108-7d83-430c-97ba-9b7cb257f68f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379294, "uuid": "e4bd6978-8866-4e83-b968-d8e448fa10cb", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edf2ac8-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376739, "uuid": "017e2cbf-559d-498c-ab7b-e9b8a9c4ecdb", "comment": "Malware payload (Mirai)", "value": "e81f59213aefb41317c7d28a49200f6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376739, "uuid": "7da36eca-b00f-4996-ab5d-f07c6f388c5d", "comment": "Malware payload (Mirai)", "value": "816c47a9fb66b9d53613b5f77b826f94f08434c13479d0baecbbddea45db7b7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376739, "uuid": "f8fe9f30-8c42-4e13-90a1-1ad4cf9228c0", "comment": "Malware payload (Mirai)", "value": "32ea41f34ba0460efe00c7e60bc20a12cab272a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376739, "uuid": "d518aa2e-0337-47dd-820c-3ea6da978f9e", "comment": "Malware payload (Mirai)", "value": "3da47896115e72e4438880cfea053ce58a29614bd1ab02f4496a65d138dd3c886f58fbc6c5931a95d5f996daad4121ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376739, "uuid": "20871137-3b69-4489-a459-2cafbf3c7cc8", "value": "T14763951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376739, "uuid": "ef02e84f-9524-42c4-bee9-2d0dc7686de5", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAV:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXz2L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376739, "uuid": "8b550cb1-bfba-4188-b87b-bd5fbe75b297", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376739, "uuid": "e30355d1-a75d-4753-80dc-d5f862ee83f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376739, "uuid": "6dd9abda-68fc-4c88-aca0-9634882f6262", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f75c723-ba0f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762323671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323671, "uuid": "a1f1280b-3110-44b6-880f-faa4af808e32", "comment": "Malware payload (Mirai)", "value": "69493b2d0a949af8b6f911c132756422", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323671, "uuid": "d3cd7360-9ecc-4091-9ca8-8b23abe7e186", "comment": "Malware payload (Mirai)", "value": "8184c32c4f39d70b7ddd2712a24f5d0c1ab6f4c576574e42b5729dc8ac430e6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323671, "uuid": "4cd44c18-4902-49bb-bb56-e1fe4a7e816d", "comment": "Malware payload (Mirai)", "value": "650670c9eb3f6c651f12000d9ac14bf6f91fbda7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323671, "uuid": "51476204-606e-4ed1-934f-80a4fa6146d1", "comment": "Malware payload (Mirai)", "value": "d261b553e43380caafb31db239420ee497cdee22c45833bd530bd63e53cd80c0aec89f8b05fc447f093f02aeccc8d13f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762323671, "uuid": "7090474d-90af-49a5-b3da-43729b70ab02", "value": "T15A2309C8F443D9F9DC5A09742036FB27DBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762323671, "uuid": "a5890236-9c08-4a97-8d40-49ce4b54ec7b", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2iAe:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762323671, "uuid": "c7cbf247-a4f7-4c2d-b9c0-cc6638e1dcc6", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762323671, "uuid": "40129499-deca-42d2-9092-60ffd0115d79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762323671, "uuid": "63e17899-8836-4440-b47d-d839c119a230", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b747f0-ba50-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762351644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351644, "uuid": "9f825143-9969-491d-8b3f-6f213717f5dc", "comment": "Malware payload (Rhadamanthys)", "value": "df13b662adf9ce398b8a5c3feca4c23a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351644, "uuid": "d834cd8f-2ee0-467c-9e2a-c1a73fcd88ef", "comment": "Malware payload (Rhadamanthys)", "value": "81cacc4723600629ea9d7498d381249def26020541bf5d2e5433ef2fd109bfbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351644, "uuid": "15128574-3f09-4bd4-b7a1-f846a59a3ffb", "comment": "Malware payload (Rhadamanthys)", "value": "047de796623007bb9b8feda5e3c81944e19ec409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351644, "uuid": "5c1290ba-039a-41fa-b3b4-073217170944", "comment": "Malware payload (Rhadamanthys)", "value": "86b666725160c3ebe1fe696788f457d49cc1c743e6c87110dfba8f7d79b5a865ecff575912b8b270b276873447f23df1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762351644, "uuid": "4befd4b1-d564-4a8b-acb3-12535a21a0da", "value": "T1F6F52847ACA000A6C06DFE3599A611837B257D1F8B3263D35AD472752E3AEF11E76F08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762351644, "uuid": "0df4e5fc-928b-4e7a-8fb1-9389388e2a96", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762351644, "uuid": "b64de4a1-f545-4117-af1e-18351014e505", "value": "49152:jnUoXIyF+f/pv5IJWCTKZKffMTBgp9udH:js/psWgh42adH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762351644, "uuid": "66e613a7-0cc5-42dd-ac73-33926cf528c6", "value": 3425280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762351644, "uuid": "c773d949-0dfe-446d-a569-5be29039dbd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762351644, "uuid": "5b73ebe4-831f-4289-8427-69f9cd078c72", "value": "81cacc4723600629ea9d7498d381249def26020541bf5d2e5433ef2fd109bfbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5934394b-ba49-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762348464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348464, "uuid": "46cc9104-a5d3-41c6-ad98-eebbf3bce573", "comment": "Malware payload (DonutLoader)", "value": "dfe0d2ce3cc878c1adb80385b5d03f94", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348464, "uuid": "82fcb211-4a11-4a09-bd09-0a41fdc251e6", "comment": "Malware payload (DonutLoader)", "value": "820a8b7a5ae70cc82262dd3d179d7b9394935182b914fe2971696de41f47af96", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348464, "uuid": "3291453b-9248-4c39-a330-9408602c9459", "comment": "Malware payload (DonutLoader)", "value": "9445f365109180b033de4de228e15634db8c1c0f", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348464, "uuid": "9bb133ce-6ebe-41d8-a27c-d778d1e1ecc8", "comment": "Malware payload (DonutLoader)", "value": "b1837f644227e69b7c22a9373a66a17096ebdb0a24473dc8f348058072e6f7080b9bc84f538b2d7541792fcd5b023999", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348464, "uuid": "5c16bd4b-8a33-4621-b167-2657d653f902", "value": "T12FD339AB73F530F8D077853989920A45F772787657606BEF07A4426A1F232E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348464, "uuid": "cff81fa9-93db-4496-97d4-804bca595377", "value": "be86415128710d3379f48f0de6729eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348464, "uuid": "7d3016d9-ff05-44f1-bd20-1b3eeb49432f", "value": "3072:xKKxSF8UIm6D53IQNhd9Iyr7YASaGbbZg2FWDu3T:MRJ6D5fF+yr01pSuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348464, "uuid": "75221aff-eb9e-4382-869d-d3310c519eeb", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348464, "uuid": "f60b0c58-fb0b-499a-a394-305f2a9a8bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348464, "uuid": "9682f3e0-a690-4e7c-931c-02faf6555c40", "value": "f03295a04bd34cd3a9567639b07d5eab_crypted_build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04588c7c-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319545, "uuid": "4dd363a5-e9e0-4f62-8c1a-9096230745c3", "comment": "Malware payload (Mirai)", "value": "34f316db17ae57390c7bb21fa43b0029", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319545, "uuid": "63fab34a-b088-4212-8dd0-5df27980decc", "comment": "Malware payload (Mirai)", "value": "82203287e46105ca9cc7c7dcdec7a0a4fac52540f683f41822b6f242b2814cfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319545, "uuid": "4e6f3722-8231-434e-8946-3bbad41e1bd6", "comment": "Malware payload (Mirai)", "value": "f64660a4b6fbc1a02f2a6c389d59fec23e2563bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319545, "uuid": "7ef8ba47-df39-45fb-a830-b8aad083234a", "comment": "Malware payload (Mirai)", "value": "d17a49797cdde9329b91b080cc1a842f762bc226e3a42b69319bf0f9e1dc0085b9a6de72f71e4f86d4a171aa7f872fc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319545, "uuid": "a75ce5fa-2b01-48ba-bf87-8716ac34658b", "value": "T17903F18296ACC0E4DBFE24795CEF271F74212B2DD8AEE5F8D718741C24266600D29BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319545, "uuid": "fd1e56d9-e1dc-4d87-b3e7-b7597d379729", "value": "768:W0kIT3fVwO/vsJqOOH4HG9QPnSaR+cleugqYSc0K9I1d6ELunbcuyD7UtQRjU:W0kg3fVwOcD+4muPjRleYcr9IH6ELunr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319545, "uuid": "9f610547-874e-4bd3-98fd-cb8e92d651e5", "value": 40300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319545, "uuid": "26b9e39e-8323-4aa2-a0fb-24878b100bb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319545, "uuid": "d191f234-3480-481e-9608-75898714ff16", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a690fa-ba3a-11f0-91c6-42010a9c0006", "comment": "Malware payload (ClayRAT)", "timestamp": 1762342151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342151, "uuid": "4f2bc2f3-7020-4890-a23c-3c8cacf08d05", "comment": "Malware payload (ClayRAT)", "value": "50bca32cff89d23af5dc5fb2017981c3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342151, "uuid": "f4a5c31d-699b-4182-881f-d85b58b3b921", "comment": "Malware payload (ClayRAT)", "value": "8299e3292df2e3f03f0743095c9fe2648bd29ad21c2115a9052aef85401f034e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342151, "uuid": "dcabc689-450c-41ba-8f26-42c7388792e9", "comment": "Malware payload (ClayRAT)", "value": "63b16d7dd1dcab7858e0272c37ce09eb9697c175", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342151, "uuid": "5a5114ae-c345-4b88-82fc-34fd395b9855", "comment": "Malware payload (ClayRAT)", "value": "c30b74fab8f9e23a260cefe0fbf50ac7141509e21d06b9ecb1a6e9263da2e5684888e6b92ba639e4c95bc126bcab8696", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342151, "uuid": "c4082ca1-ae4b-44be-8954-035d340c54cf", "value": "T11D460156F718947EC4FF57324A3622602167DD268F839B836928733C68BB5C81F25ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342151, "uuid": "0230b039-2489-4af7-bd39-64bc8cf0e285", "value": "98304:OfFPuPNnQCjcu6lGE6h7MX1FLi5AECToYIKRWwY61mnWAXIe0wWDaiZLCIP7S3kT:O9WVnQacu6CK1FLPfj5WWJDJHP7Sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342151, "uuid": "c1a01611-4b02-410b-866e-fb4d89f6a485", "value": 5497628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342151, "uuid": "8dac767e-d234-47b9-8ed7-762224e33a9c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342151, "uuid": "c43c0bbf-d477-4fb2-9c49-28177b0d742b", "value": "BezProbok.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edca5d11-b9da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762301039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301039, "uuid": "60d355f5-625e-41b4-a1dd-f865dc3a136b", "comment": "Malware payload (Mirai)", "value": "7271999c338a50e1e9477bb96c262a3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301039, "uuid": "5a0df2ef-3cca-4819-9216-de8935cc9048", "comment": "Malware payload (Mirai)", "value": "82c64619aef34469824bc0d394cc8cbcaaa4d5c0bef9335154e4ff62a84b6b21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301039, "uuid": "5d2a4ff0-aa72-4776-94ca-89353b814151", "comment": "Malware payload (Mirai)", "value": "4ac1eb1a266d94d8bd7a2012fb74ee9b251100c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301039, "uuid": "d2f578f9-9a39-4dbd-b0f8-2e5c0c78df03", "comment": "Malware payload (Mirai)", "value": "fab258e60b7b8293b46e6e7d9753aa972084e93d497d86f8c8dfbd64d38862e7c1ab61ed1cc0ae0329af12ed817427ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301039, "uuid": "2e1c4ea2-899f-4bf4-8393-6cb129432f0f", "value": "T17603F1270A028CEED23A903553660B813BB50AEB9D62EC57AF6FB5564E5C05870B3FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301039, "uuid": "118ee1a2-1afa-48f3-943d-cc975e4eb135", "value": "768:Q6FWes0S1WSofXaprf2zOD2x2psy8oqR0GaqUstKJCBntZfBJ1gOJgGlzDpbuR1S:lFHdUWSw4rfie8WGCENtZpY6VJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762301039, "uuid": "023d8c63-a236-47f1-8aa0-a38a25b95a3b", "value": 41128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762301039, "uuid": "8a5d8ebe-950e-42e7-8c70-6d8f7e8d468a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301039, "uuid": "d0d2b772-28f0-47d6-be9c-209f1572b99e", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fb8310-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319620, "uuid": "9b05bd18-b652-4782-ad03-438e80355c60", "comment": "Malware payload (Mirai)", "value": "8d8f29e53921a8c208748abf162256be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319620, "uuid": "008fa6ec-f11c-42e4-b85b-cabc0f3ae493", "comment": "Malware payload (Mirai)", "value": "82f81e65b59b1f497cf9714d6dcc171bb328e6f7a071b96582241a121d6850d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319620, "uuid": "8f2ddf8d-a137-45b4-a663-01cf871a7e2f", "comment": "Malware payload (Mirai)", "value": "f258b243df38a8cbfb770a2e66c5500ec53d051a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319620, "uuid": "8261134d-a9bd-493d-9e0e-14ec9a552957", "comment": "Malware payload (Mirai)", "value": "f8d92a27c39f4c05e8b935d035aec9309a9c005d1b9b7c56a80615c83f43321e10ca81d165a8d90e4ce8da15ad743b46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319620, "uuid": "6ccbeb68-7fa3-41d4-9d56-f2fc5073fe34", "value": "T1EF736BC2B743D0F1E9260632217BFB364673E13E0029DA43D7A9D87AEC52641E6663DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319620, "uuid": "1e8e024f-3cad-452f-80e6-7ba087840e82", "value": "1536:+lBYOT1n4SLczHn6Ozk0kyE5oG3fs8kZ2rEZsS4W0Si9LzBB:+BN4SYr617yooG3ELZKgt6LzBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319620, "uuid": "8d672ca1-ebb6-4ee1-9565-c6df5f550abf", "value": 80208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319620, "uuid": "27ac6d7e-35c8-4b70-8b88-156955dabdc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319620, "uuid": "452d4f5c-f23c-42d7-8664-ae945fc0106d", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138758c2-ba65-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762360373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360373, "uuid": "6cb86a01-cfb0-4d18-8c99-ae8d48abcbf9", "comment": "Malware payload (RemcosRAT)", "value": "1f395d0b836dee24658a6135477ffb69", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360373, "uuid": "b7f39708-f387-401b-bee4-c55f9ceb136f", "comment": "Malware payload (RemcosRAT)", "value": "846d7e1508a3f0ffdbf16119f714f38d3ea23e2ecdf07f52d32ccc5316d69713", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360373, "uuid": "d7905b85-5559-4439-8d25-2ed243288d1c", "comment": "Malware payload (RemcosRAT)", "value": "8baa2543f968d75a59975bcdc00465305a57baba", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360373, "uuid": "e472094b-dd75-4b7d-94c1-1e0c496f3602", "comment": "Malware payload (RemcosRAT)", "value": "71c2c5d54bb4e000e75793b03a0bb99b651a24551c84934551f6bad998458b0e1a485bb587cefc08077f76f1889312cf", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360373, "uuid": "4b7c2068-2f12-4663-b86c-7cceb1fb78d7", "value": "T1AF8303C466C862C5909D9ECB0676653D611D043B313D1816F8DF9ABCAF3A4B838B7DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360373, "uuid": "6b3697d8-96e1-4ff8-8ee2-d77383fdb551", "value": "384:VJOLuCRLuj8koBKKlgHop9OJRCsxk2hcy:eBdkoBK+0mWcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360373, "uuid": "e202c74f-00dc-4461-8c1c-0aae3428d525", "value": 83543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360373, "uuid": "eea0f7ab-9880-490a-8919-b276b3355e7f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360373, "uuid": "f12cb968-8bda-4404-a274-bd1bc9ada33d", "value": "sjdhf00vcb98sd0wjhjcmvnmsdfkjk0fs90c88b0d00s0cv89sdjjhj98vx0c0xc0v0cx08xcv0xcv.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a617d612-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316810, "uuid": "1af183cf-cb4e-43df-899b-f5545efd3952", "comment": "Malware payload (Mirai)", "value": "1c0a6b770ada0c1df0a3654619f009da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316810, "uuid": "89bfa739-e09a-44b3-9859-9861e1e570ac", "comment": "Malware payload (Mirai)", "value": "84dd4510c6e5844105c81a491fbe95a84f5cff6e208dbe997221df40f4fe8f96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316810, "uuid": "03c25738-0e7a-4617-9045-bf4d744241a4", "comment": "Malware payload (Mirai)", "value": "094b25332b6b7869239ecba7a8fa1465d209f515", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316810, "uuid": "1f7901d3-e8eb-428c-9de4-1279c225f5d3", "comment": "Malware payload (Mirai)", "value": "726adcb7430667d17b5b375f31e2f958b7d2df6ad400287bc3d48875bf82ed4c3b447240c0059987cf866432514bbb60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316810, "uuid": "cc7dd436-af1a-4ee9-9207-9536243a1433", "value": "T1AA3319D6B401AE7CF95BEFBE80224909F931621151930B3B637BFD936C322A58D62D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316810, "uuid": "4ee4c645-c7fb-4e4b-be95-8a1f0d63d572", "value": "1536:y1rztlv7Dl1XaeZoPzlCH7n2q/CV85/9r8GU:GzllaLlA7U851U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316810, "uuid": "600c8bb8-67e7-415a-99cb-e8a541166a88", "value": 52500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316810, "uuid": "a6a3764f-15b7-48bf-9200-b2aabe9c8b6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316810, "uuid": "d13e9ef9-27b1-4685-b7e7-4158fc2e9646", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d4a5ce-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376722, "uuid": "ed5830a9-cb21-451a-a3cf-0609ef239168", "comment": "Malware payload (Mirai)", "value": "651f27189b063bcaa40955bd0cea0937", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376722, "uuid": "c33b7e83-402b-4c02-ad85-f02b14fc304e", "comment": "Malware payload (Mirai)", "value": "84f0aec894451f0cf16497c6aabb5724d3db6c656831d4df6dd928c41f28c6d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376722, "uuid": "84647170-5b3f-4ac4-a041-4ed635aa2891", "comment": "Malware payload (Mirai)", "value": "47e2976c243b7ba421f5e3f73ba31c9ebdba6d16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376722, "uuid": "7fc1819a-12c8-47e8-97a6-fb579a46c7a0", "comment": "Malware payload (Mirai)", "value": "c9296a45746bb1383f334a99d0e60e181839474a1d676e521a3b9b9f043e4f34ca4dadc927211ee3635c2d3467fd951a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376722, "uuid": "ef9290f4-2941-4a97-98e7-f3cfee1a99dc", "value": "T107432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376722, "uuid": "dc537340-d2fb-4f48-ab06-5a62df4dd156", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwh:RqtmZPuutfbltZFBSJsBcfDSTFI+BEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376722, "uuid": "4a38e683-bfa1-4789-9915-cd2a44f80a69", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376722, "uuid": "1e4c6aac-8e81-4f49-ba94-87298c3539f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376722, "uuid": "95166b9c-f41b-4cc3-9257-a99ca974ff61", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a57ee85-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319555, "uuid": "beb5e3f0-0ce9-45ce-aa76-e9562f23bea1", "comment": "Malware payload (Mirai)", "value": "788d6e57a4531a29b5d9e93387686909", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319555, "uuid": "640a415e-6bf5-45f6-a8ca-bef98298d449", "comment": "Malware payload (Mirai)", "value": "8576a00f145bae25947c3812fbd9cc8c801f6e734fea1885d3845ffee3bc7e5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319555, "uuid": "37da0486-eca6-4c9c-9fea-9b5ba6fea498", "comment": "Malware payload (Mirai)", "value": "86fb4fd37280b024d99a9a1cb82cd4fa14a07662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319555, "uuid": "cf78ec70-97d5-4ed8-b660-4e51998af831", "comment": "Malware payload (Mirai)", "value": "329c54742602d931e7e2a1610002946d732429e3bdb71a3d639db62e1a010bb4377a225318c029dc8e550448c34c1e6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319555, "uuid": "6435e8f8-ddef-4264-b832-b0fa5c6bdd17", "value": "T14003E110D8267CBBDB7BDE970D51C9A637518ADCFB60CEE230D17B101B239296550ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319555, "uuid": "258590e5-fa07-4f00-a26d-759a1ebb7b71", "value": "768:KGz8xWqxg183qwt1VmzWhyXziXsnBlW44uw3BvaM1GlX8N4uVcqgw0IH:KNxWWd3RY2Xsj1bwR3GeN4u+qgw0IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319555, "uuid": "257f5101-0de6-49b6-a594-5bf944da7d77", "value": 39976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319555, "uuid": "26d242e9-9c19-4a36-bca6-92cb8d3825c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319555, "uuid": "a0825be0-dfca-4475-b5d9-8c233dd6f0a8", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b64d6a5-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319637, "uuid": "0a5bb2f7-d5a5-43c1-8084-210917efff1c", "comment": "Malware payload (Mirai)", "value": "ac94f7d387f11de4105c340c2d91e3d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319637, "uuid": "82de0db3-34b5-4f91-b1c5-a0699073f1b4", "comment": "Malware payload (Mirai)", "value": "85d4a4db3a2a79579381be53233a523bf5aac644692c71cd4d8b239bdb4af192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319637, "uuid": "33dc64d5-936d-452b-b194-b4b53fc713bc", "comment": "Malware payload (Mirai)", "value": "8d12503e870acc4d1dd6018827de1ae48fee6833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319637, "uuid": "b8b2a682-1ba7-401d-9b81-4192d233b326", "comment": "Malware payload (Mirai)", "value": "4a4a565f774b1d24ee0a4e88546aeb2f98d95f6cffbb587aa39e0663b5ddf22bcb7ca86a240d09fbdf755f80d96166f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319637, "uuid": "5f81f86f-a7f3-41bd-9593-d0001e3723eb", "value": "T14C933951FD819A13CAC112B7FBAE428D372713A9E2EE32039D255F21738B91B0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319637, "uuid": "13414417-bf49-4651-be8c-aa404b2be460", "value": "1536:twIJAJrFrBLKneYCmNK7d9ZQk271ACI8ajFOsvQ+g:twIJKrFrArNKZ9ZQkxnJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319637, "uuid": "d01d0448-628f-43f7-9b61-59b247c569e7", "value": 91948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319637, "uuid": "ed251108-4249-4ad6-abf7-c54477d44ddb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319637, "uuid": "12354d2d-a070-4406-ac14-70eef7c622b2", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b7b3ae-ba66-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762360943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360943, "uuid": "c666e2a3-a2f1-40ff-a25c-2f005c952ca4", "comment": "Malware payload", "value": "a922d98014a5419e631ac1672e89791c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360943, "uuid": "406d8135-da35-4d19-b8c8-643c76a6b78c", "comment": "Malware payload", "value": "865864bdcd9d422dc90e38b90f51d18ad621b8054d2bb874c6d143be0a1fe958", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360943, "uuid": "3083a29c-df8d-4168-9893-b6215ab1cf20", "comment": "Malware payload", "value": "f67345669725794d599e71250e47c37fba4ee6a1", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360943, "uuid": "b79870bc-c9c0-47b8-b733-9927bd9357b4", "comment": "Malware payload", "value": "c4cf4b463c5e7576eaa4aec823c8a75b6ac0ea64601fefa84fd83a4d98fcb2781c24b4120c3756a7e1cd80690238ffb3", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360943, "uuid": "90457c97-ceb9-4244-a799-c035de168a0a", "value": "T15795F082EEFF9D72C22AC63A06E716144320DC288A719A433ACA773475F6F457723759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360943, "uuid": "0d9bc431-73ab-4fed-88a9-e401359c2748", "value": "49152:xXy6134hyImJh4iRZchz57ilThLdvx+Er:EA34sImJh4iRWL7Qdvx+Er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360943, "uuid": "ade05c48-761d-427f-9419-a01e9ce1b11b", "value": 1951232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360943, "uuid": "c54151d9-0efb-4eb2-ad52-261389795c32", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360943, "uuid": "1d16a7cb-e431-473b-9818-e54353c750b8", "value": "PO Confirmation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ab1004-ba53-11f0-91c6-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1762352706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352706, "uuid": "d926cfc6-b6f8-4af1-b319-5e2f98695781", "comment": "Malware payload (NanoCore)", "value": "8442b27ee97c40b5e0c9ea5ac64e735e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352706, "uuid": "da202b87-43fb-4df7-b4da-c0b5ccaf634b", "comment": "Malware payload (NanoCore)", "value": "86bab321000ab08a9bc5c2eb689c46f779fe62763a0a3fb44b3b79dc958b203d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352706, "uuid": "934a44c7-f055-4c37-9e69-2727b130df69", "comment": "Malware payload (NanoCore)", "value": "3e0f499f4005369387253ad5c3d7a5f451eb1e1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352706, "uuid": "39d1316f-3797-44bc-8977-c4d3eae6a3b0", "comment": "Malware payload (NanoCore)", "value": "d8a96a3e7087d731dcabfb305a19383ec1aea983705468abbf88a50fafe88ec9f189b2257adfdac0307c5a8ac94959d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352706, "uuid": "147f800a-aeac-4369-bd30-3127b05c3738", "value": "T154F41297252CCB02EAF29BF03E67D2344374EEADE161D3470EE89EDB74257215840762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352706, "uuid": "594cf718-9b62-4a81-b022-81465a76bd79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352706, "uuid": "5c81698c-f7fd-428e-803d-da18daff3d22", "value": "12288:522iNAeRPA6gfI+lC3kRtAJDwthjQuqfzMjN6we2KsvXSfsBr47X/OxTB09BB:521C+vy+kt0Yh+MNDKgS5vYTi9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762352706, "uuid": "30304fad-a765-4e5b-94c0-3cb95f4544bd", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762352706, "uuid": "403bf64c-fd2b-441a-bcb3-581ac3963281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352706, "uuid": "e1948b6c-19fb-4943-8919-d5c44ffe6dd9", "value": "Proforma Invoice no. 040547568996479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e12b7a7-ba21-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762331292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331292, "uuid": "e1052002-fd4b-46f0-9985-747b61c86bb1", "comment": "Malware payload (RemcosRAT)", "value": "ca07a983b93d42e6a0647cdd0c05108b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331292, "uuid": "7f307520-b12e-4eaf-9cec-8fc016190029", "comment": "Malware payload (RemcosRAT)", "value": "877669e770f6a616d7011b19bf985fade0d04206498edd4d7c412c278d5bbe1a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331292, "uuid": "9ac9175e-c972-4dee-b14e-fb1d8dffdb84", "comment": "Malware payload (RemcosRAT)", "value": "5d360216109c863e1d802c6f73eb622cda282de4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331292, "uuid": "6000a0d0-968a-4ec7-b168-abb3abe12386", "comment": "Malware payload (RemcosRAT)", "value": "89092ac277239629fdec379324e01b7bdd1bc891d8754f0fca050c3c794ec63f41f754ed8835ff05ca25f3f1f70c7780", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331292, "uuid": "56119c39-03c9-4a75-af3f-ed83b0956d36", "value": "T11A853382764A62E4D00D4E6F857FF394202EBDE4D23CD8F805EDB5D6748ACDA4D13296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331292, "uuid": "aac3c8a2-cb13-4901-aa83-8e0c05e8c2b1", "value": "49152:/hW+i9LWgtfJdBlUdMUmg9c0P56TgtG4Z0tSgXIuJEK3:/pERPdBwMn86TQGZSgYh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331292, "uuid": "4eac7967-89b0-4d8d-9001-27ed49098f07", "value": 1819245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331292, "uuid": "4458a98a-7bc1-4b3e-b313-27dde3fb472e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331292, "uuid": "43e77f04-c76c-4c71-a60c-bbcb768645c8", "value": "dsada.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781be9fb-ba6c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762363548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363548, "uuid": "ed93f3d3-3281-479f-8775-f538cfc2afcd", "comment": "Malware payload", "value": "a3e7303c065a6dbe89bf4977889b32ca", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363548, "uuid": "e66fdb9b-9d00-42c0-9585-e02722a7f8cd", "comment": "Malware payload", "value": "886e1b04a1b56540263d4cc3d344820953a7a1e15e5c2371c5080d8f9c10c144", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363548, "uuid": "2c5e7e30-a653-4f05-89a1-66cd73c4f052", "comment": "Malware payload", "value": "ab7b08eb67b2171f9a3430fbbcabf91ac013aedf", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363548, "uuid": "187f867d-5358-478c-878b-919a814e1cb4", "comment": "Malware payload", "value": "88b809710725ad294a0156b9d165aab88c14ed7f0b1567081dc1e1f839f634d8246f681e032e3edba40fb7253f58bc00", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363548, "uuid": "d8ebf541-6d25-42c5-a4ea-4c112f771df3", "value": "T18CE3A4BD89D01ECF0EAC63419D1EFD9BD9BAC1235723E0CA466D0C99495DE84DA1FA0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363548, "uuid": "ac7bce82-2996-4c5b-9eb4-f5a6d3c71f07", "value": "3072:/Lj+193l+KK+fAkyfrelzRoZDousWkmQkp3wRHv4rswkecJ3w:/v+193l+KK+fAkyfrelzRoZDoD7cCvan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762363548, "uuid": "62a73054-d1cd-424c-8bc6-3ffe25b190fc", "value": 156517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762363548, "uuid": "c9576cd9-2b11-4e13-8f95-7a8b1f157ce3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363548, "uuid": "819e25a8-83ce-496c-b7bb-da468282ec54", "value": "output_1762327175.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1766d7-ba29-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762334614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334614, "uuid": "5610b6e5-4bca-4c19-b360-7618439c8294", "comment": "Malware payload (XWorm)", "value": "76d3c455dd8035731e1b63749e098065", "object_relation": "md5", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334614, "uuid": "8da510b8-6d24-47a5-8faf-cfe46e8d7710", "comment": "Malware payload (XWorm)", "value": "8877866b514c7abad2f45320877bd92010fd58fb9ecff045650bcb399669af4a", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334614, "uuid": "5ff1b02b-2bff-4d65-ba88-fce5993f3096", "comment": "Malware payload (XWorm)", "value": "940084495024aff36e2f86219699efa654121957", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334614, "uuid": "c8a827b4-10fe-4a98-b57f-ae2a6491251b", "comment": "Malware payload (XWorm)", "value": "3d8f0e31ff2fb6904d89f8cd5a588085096c5b0b9a35fe2be612b6bc27115e7752b3593531659b57fc14a032dac09023", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334614, "uuid": "7a54ef19-afe9-4c8c-85e2-9af54e278bed", "value": "T1D4F72316ED0DCF1222E37E8E6B35E0E71729F14BB91858BC55B705688D2F0F66D38286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334614, "uuid": "af1a7abc-1c52-4d99-8b02-c2ba079d9985", "value": "1572864:RxBuvfVsrNg5QoSaPBW7FaWFtI79NFdVifAKk8rFbkTSXmPJvcL:RwwgmGpW71F279NF+Y4WS0CL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762334614, "uuid": "2d0bc4a2-9f16-4bdb-a7cc-97470703661f", "value": 72665635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762334614, "uuid": "9942b6a9-49c3-456f-b3df-c1af51d75f4c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334614, "uuid": "22c3c1b0-e4d3-447c-95ee-e64b90effbb8", "value": "db0a438046614c79396506559aaf8a1237e47f16637dcd63544f8f4333c0e4a6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d68793-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762335927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335927, "uuid": "616be749-340d-4105-96c0-f5dd16464f9b", "comment": "Malware payload (CastleLoader)", "value": "e77c5a2814c674f790b0ca2851fb3273", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335927, "uuid": "fe6b2574-8679-41ba-99df-c427f0c2347f", "comment": "Malware payload (CastleLoader)", "value": "88d16948e8cf885d475bc44afa477d2f5b38721e32248425a9e5429c48a4af26", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335927, "uuid": "281b3ded-0024-4e36-9745-c04dad565cbb", "comment": "Malware payload (CastleLoader)", "value": "8fdefd82a3a13e2683481653847a49e1302b64a5", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335927, "uuid": "cc051ba7-9ad2-483c-9f59-c307bddd991a", "comment": "Malware payload (CastleLoader)", "value": "af5732f3252b278177599a795b34509df777ac7a8427444e70396081c938d6e3c059bf8d8e71ead7b2e28eb5a453cbed", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335927, "uuid": "fd8dc643-d5e2-4b59-999f-9499f50828f7", "value": "T1C5B73327F264D03DC06A173245B6E6A08A3B7E20DD064D4F17EC798DEF729A10E3BA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335927, "uuid": "73e31e24-86df-4cc9-8958-19db6f42d2c4", "value": "81073f2b397217228357dd031a037bb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335927, "uuid": "d521964f-d65b-4600-980c-d5fb74a6b42a", "value": "393216:Slg0RgcdW48wApekwgTeD26OLp0iS69bKISga5ddIORieiFuNSG7vg6:SlKW8HpFLXBdanBRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335927, "uuid": "197b6ad0-a9c5-4ca7-b31c-a42ebe3d0642", "value": 52684832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335927, "uuid": "9b61729f-4047-4682-9687-289f934d51e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335927, "uuid": "cf9e7952-4e12-4225-a5cd-9e16a5c78d90", "value": "88d16948e8cf885d475bc44afa477d2f5b38721e32248425a9e5429c48a4af26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f59040-ba5e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762357474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357474, "uuid": "83c73497-cb35-4ee2-8fa2-e4ca9ee66a02", "comment": "Malware payload", "value": "28870fc4c6a7663a097c0e36fbedbed0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357474, "uuid": "7a0bee7a-addf-4edf-b1cc-9339a85f0e93", "comment": "Malware payload", "value": "890d34af93f587da5e2e818c9035d66264abb2558f72df9a34370b9d57edc137", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357474, "uuid": "36a0c1de-2be4-4be7-bb4b-e09d7fa726e7", "comment": "Malware payload", "value": "ed07723176d0dbdbb45e2a122a6718dc8e633832", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357474, "uuid": "bdd559c3-0a82-427f-baa3-9fcca54e3414", "comment": "Malware payload", "value": "9ae59c650555b9fcee75f97921992a958d127754f173d5146adc600cd901fdefd411dedae1e20c46d3ea7b20bc6f34a7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762357474, "uuid": "c18caba6-255e-4dfd-84a7-84ebb321335d", "value": "T11F5506047B84D712C4A927739BAF8615136549F9C6F2F30F6A49BFF0AC2A2D5B90E047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762357474, "uuid": "7eeebbd9-d65a-4edc-8edd-19bd8f793840", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762357474, "uuid": "abc82190-0352-43bf-95c9-1014b06e6d0e", "value": "12288:/S7fLvVvdSRvz90hJbbeXmGbcCSBFIzKhickCBPIh0NL1G+uXkLf5gE6m5C58Rj:q7za2gl9BKMULORm0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762357474, "uuid": "e914eea1-1f39-4a02-ad65-ef7344eb26cc", "value": 1364480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762357474, "uuid": "bdc8b41b-b58c-4f3e-aa60-90dd879f7a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762357474, "uuid": "b8d02d2b-caad-4520-bb1c-b62a700e6949", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab88196e-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316819, "uuid": "3a1361f6-db1d-4ab4-98a2-c98c3ccfd5ac", "comment": "Malware payload (Mirai)", "value": "d89a44c682e4df3b0feeea26a3cb555e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316819, "uuid": "27d52dfe-5b3c-4fd5-a895-f6e308d37882", "comment": "Malware payload (Mirai)", "value": "894588ac34e014ffca4a2b0c7152c2ec98fec60c5a3d6cec25ea5558f5884bb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316819, "uuid": "b7ac9a14-e84f-4159-9035-eb6a02b1cd7e", "comment": "Malware payload (Mirai)", "value": "91ee8944f6f1efa9065ed7f917c577bdaa4fb6e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316819, "uuid": "06386641-3f25-4754-aa87-4c60d5a88c37", "comment": "Malware payload (Mirai)", "value": "857416ab0b97c0a94cdebe97bad761c6420f89f5a78668118128e831524085c759b5c1152097152dc609f6cba03c58b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316819, "uuid": "2c6cf7d6-0641-405f-b331-4b13de31cea1", "value": "T10853F94AFC818A06C5C413BAFA2E118D33136779D2DF73129E106F2477CA96B0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316819, "uuid": "8d5cd3a5-461d-4ad9-bffa-d6168cc68f2e", "value": "1536:M5nWhLFmBpvt9aA1iEcadDwapaczKRfRnVPEvmsXaLxIVi76yBZWA:9Fmn1QQitSDwNczKRRV6mt6yBZWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316819, "uuid": "6cb4870c-9f2c-45b0-9b95-55c0fee11ad5", "value": 63188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316819, "uuid": "16224879-713e-40c3-a30c-c5b051ffb698", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316819, "uuid": "ca5d132b-12c2-4ab7-bd12-7b436e22deef", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3a9663-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316820, "uuid": "0126d762-56df-4d61-9dac-244eed8551e9", "comment": "Malware payload (Mirai)", "value": "31a5993b097c2b51030431c19d1f0558", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316820, "uuid": "18e5ebff-ad9b-4e6c-b1e7-7e6e09fd3844", "comment": "Malware payload (Mirai)", "value": "89fd5f1fbb3aacb14c930df1af7e3a09f0ede25e161e2908eb6504f47b500360", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316820, "uuid": "77d7caa9-2c84-46f0-88d9-0aa0c785571f", "comment": "Malware payload (Mirai)", "value": "1812323eb9e5c0572a90ff605e9ec678a771a129", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316820, "uuid": "0d51667e-fc79-4ea3-a97b-57e20c4d6dad", "comment": "Malware payload (Mirai)", "value": "64b50217e2de1212373986b540a626bc18681fe025b9994efb5566a133bf0a6604e8753a0641da25fb86ddf8819c7cff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316820, "uuid": "47a87ece-1fcc-42ff-8bd3-532198769951", "value": "T186234B41761C0E07D2A65BF4293F27E483FEE9A020F4F58C260F9A868175E73518AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316820, "uuid": "5366306b-73af-4f36-b4b2-b6851263769a", "value": "768:z0FAcluoIyzlDBHesRs11pQwq26inWZVwC5AkBPdtVABUksb5W7yEEN:zQIsBHL0Qwq26MaywZN4/sQ7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316820, "uuid": "04b055ce-1125-4002-82ce-94dbe398284e", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316820, "uuid": "99e2feb6-2bac-47cc-a027-ebd7693ea074", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316820, "uuid": "d20231a3-2e26-47e2-83c0-5ccd5848acdf", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb96a258-ba12-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762325114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325114, "uuid": "dcf44a2a-a0cd-4a1d-9fad-7c07deda26f2", "comment": "Malware payload (AgentTesla)", "value": "603ce031b36700da182f37c0e493f553", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325114, "uuid": "838156f6-ad68-437d-9b0a-063e5d07d8b2", "comment": "Malware payload (AgentTesla)", "value": "8ae3df968713a844d65a2bcd5f8f5a1c1e86e82a699837e3e5b8a3e48c00bfce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325114, "uuid": "bd2ed30f-37b4-415a-8628-1065169124d5", "comment": "Malware payload (AgentTesla)", "value": "8aa96d84566594f371414cedcbec324c32d6becf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325114, "uuid": "e44e57d1-800b-4ea9-bd44-94b161b46b6d", "comment": "Malware payload (AgentTesla)", "value": "9dab299a576ad848a865fa082c915dd363094b0342ee677a66c5c1aa7453ce23d66f38c4716a4169259574ca3d4978ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325114, "uuid": "49e151f4-eb10-4704-a398-12f0e8095dee", "value": "T1DF05392730EE521EC471A7F32BFBF875967EEA23111DB17634D39A4E83A190949820F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325114, "uuid": "989a09c4-8e90-4b91-8206-ee04f4f53241", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325114, "uuid": "8434b260-8ad8-49fd-9c20-077e84ebf995", "value": "12288:8upkjSJz8xlEkK34CL6dnbHYPo0XLCZLFaG7hlyYRb3OQ5:Mqkaodbx0XmZL7D3RDO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325114, "uuid": "1ded8bbf-4082-49cf-812d-98e7ad8a4b66", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325114, "uuid": "33f7c914-a806-4769-8a18-f147c15aa7c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325114, "uuid": "7696f8c3-4ecc-4392-ae5b-b3a6472e6b53", "value": "SOA FOR SEPOCT 2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bda45c-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762336007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336007, "uuid": "abd2fd17-2af6-4495-958d-fead7343c90a", "comment": "Malware payload (CastleLoader)", "value": "9a0960c674378a049b8d9ad0e1c641c3", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336007, "uuid": "9b6e3528-9b87-4b9c-bbcf-ee5f0d05eb12", "comment": "Malware payload (CastleLoader)", "value": "8b7c1657f4d5cf0cc82d68c1f1a385adf0de27d46fc544bba249698e6b427856", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336007, "uuid": "f54cce90-3ff8-4c25-a0c3-8979a316cd33", "comment": "Malware payload (CastleLoader)", "value": "0580a364ab986b051398a78d089300cf73481e70", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336007, "uuid": "5d6cc861-4a50-4006-a583-a73a083c1acd", "comment": "Malware payload (CastleLoader)", "value": "9a20eeb53acda9aaa20669b8c1475b233251b41cafa8bfe6596583add47b479dd824a221fda8d78a6b5c68e9e194f8a1", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336007, "uuid": "ecacdb10-bae2-4491-bda7-8f675081e0ba", "value": "T1BF76CF37F3886D2FC4AB1B354A7782A0A837766275128D7BA7F8090C8F355506E3E746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336007, "uuid": "6ad04ba8-c930-4b10-9fa7-335bbd4d1949", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336007, "uuid": "c58feb1d-18d0-45f2-8cfb-f6ea781351d8", "value": "98304:+SiTA3G874OPos6b9iGs19RVRNrUd2V4ym7836JX5iRb6+PGppxYa9tBZoeVKD:F3+OPos6b0GW9RlUd2Jmo36LFYoZoeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762336007, "uuid": "2455810a-5b55-4f9c-ab48-d16357edbae0", "value": 7430488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762336007, "uuid": "4a0626a2-1ce1-4fe6-b5ea-71d7cfea5733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336007, "uuid": "5b844aa8-46ab-4685-8ee8-e69f3e913a49", "value": "8b7c1657f4d5cf0cc82d68c1f1a385adf0de27d46fc544bba249698e6b427856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecd3093-ba55-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762353573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353573, "uuid": "ad83dcb3-52fe-45ba-b4ba-f63ec7f5d051", "comment": "Malware payload", "value": "f10f58c8f51ce0e210d8a3ee2421898e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353573, "uuid": "000f3b26-a84a-4e52-8f43-74e9090ea7fc", "comment": "Malware payload", "value": "8b7cfe23539027e6b32aa7be3f7be406e10d40a3f73b7a7bf1b5d105214cc123", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353573, "uuid": "cc31dc72-147c-4d13-9f1a-d0b1f05103a9", "comment": "Malware payload", "value": "05de84624cdaa0ea253229c9d7a5ff3486d17de2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353573, "uuid": "0443c1a2-c2ee-41cc-89d9-a25f6742b063", "comment": "Malware payload", "value": "3124d7fe436fcc5e963f19a3244d2b61d08bca79a23047ab4ced9890794d83ddd16e973eb030805826ff93df4648dd4a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353573, "uuid": "4cfb8ef5-dfa3-4302-aa35-33412b4843dc", "value": "T1CBF42384E432F40DEF464FAE1F120E06FF6D91E17C3A5E69623947B086B0B2A5F16B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353573, "uuid": "1f8917d4-74a5-47fa-afc3-4d911930878a", "value": "12288:UxVB0lx3gd7rnoXPG0EmB1MLYOoPWLhkkZQHy3bJYs8DVZFn3CfZFOhY:U10lx3e7rnoXO0T1ML8UhpFrJHmZFn3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762353573, "uuid": "fdeb6f35-08ce-4a8b-99e8-734f8b3e1c79", "value": 751147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762353573, "uuid": "9142b7fc-dc88-4c2f-a2ef-6efd55efb802", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353573, "uuid": "4a6715be-41b2-489a-b09a-40754e89e86b", "value": "SKM_AC4347CAAC6550XP 25PL30104D0006OIR8.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fb7066-ba4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762348993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348993, "uuid": "6544de89-eca5-48b5-ade0-b0b3eb191f3a", "comment": "Malware payload (RemcosRAT)", "value": "6021e8c69374fd59b383cf8dff31d12f", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348993, "uuid": "03550ba1-2dd4-40c5-8df0-b5c4b4ef073d", "comment": "Malware payload (RemcosRAT)", "value": "8bf117963f27379f9b6885dbcb4869923e87339194ba2182a5e9c2fc46c62e0a", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348993, "uuid": "238a03ff-9318-4522-a192-56919dfb27d6", "comment": "Malware payload (RemcosRAT)", "value": "654753508654e6fdeaf8223a243f6cd7c86dc482", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348993, "uuid": "70e101b9-e1a0-4860-8e13-1b4bab92fe56", "comment": "Malware payload (RemcosRAT)", "value": "3d314fad48b1e45a4c5a6ff5b07e14c5589dfc13a81e7eabe4a4bc5ff54825a9fae16a6141cdaabfc4e80bff97b471a3", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348993, "uuid": "e4e5a340-d5e9-41c9-8c95-fafbe3cfa253", "value": "T1E785CFA17DBD4DF3D2832930E456D69C7B147E201B3DF5215AE80AECE92A273B91134E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348993, "uuid": "4f4d39c5-ac96-445a-80e9-84e7a7aea6b2", "value": "92ee8edb91c1b0b9fed310e14144c3c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348993, "uuid": "5ab012ec-64e4-4865-a740-fba41383db3c", "value": "49152:rx3uhZr6a9esI5ggDpKGUC6wCBK6RNL1jBbNs7:rxehBwsbC2B7RNLnNs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348993, "uuid": "9b9dcfbd-3bba-4f71-86b3-21749ed87310", "value": 1711616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348993, "uuid": "3e113b05-b0c9-41c2-a7d8-3031ff1c0249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348993, "uuid": "86c5a7f5-c9e6-4db2-8667-499c8319f595", "value": "8bf117963f27379f9b6885dbcb4869923e87339194ba2182a5e9c2fc46c62e0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b341d7a4-ba48-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762348185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348185, "uuid": "44db5434-ba15-4681-aea9-00cf6c6b7d84", "comment": "Malware payload (RemcosRAT)", "value": "643ac1d74367a802434c455329018aaa", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348185, "uuid": "8b09e434-7054-4000-a33c-81b2bd916154", "comment": "Malware payload (RemcosRAT)", "value": "8c77a5a4139856501b1dce9ddc3e3c117676da0dbbf37350ed295a97c245a8ef", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348185, "uuid": "49e72d23-98ad-482c-8ee0-83c036c4ea21", "comment": "Malware payload (RemcosRAT)", "value": "5ffaedabb97894d3f8db6d7f3576d473b5afd430", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348185, "uuid": "3fc813d0-c916-4867-889b-2338a3abe930", "comment": "Malware payload (RemcosRAT)", "value": "5c2a1d1cf444c0587d2c2647aee9e432408d9458bf15248a16d464bd06a807b5f3cdf0bdc20e3a8653488080346e9222", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348185, "uuid": "36225fd6-c9d6-4770-82af-94b9f5ea0eb7", "value": "T1A6B4AE01B6C2C0B2E17354310839EB75CFBDBD242835997B93DA1D57FE305919A3ABA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348185, "uuid": "a463e407-a9ac-461c-953f-a1665e67c6b9", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348185, "uuid": "f7839333-ff05-4617-a25c-b4805db23cfd", "value": "6144:MlNyrBOlAl4eajA0VGnjeBobKvrsHaerUnYNxi9lw7RuqdwqsAORZq/XQ+cqs1Mw:Ml8oq4eheG0YKvA6erU5XwNFsPZqmSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348185, "uuid": "a724d819-e560-444a-b16d-9882e31eca34", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348185, "uuid": "44879979-4c0c-4af3-9543-252388bf54e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348185, "uuid": "e05c7742-eaae-4508-b1a9-1413ca12f4bf", "value": "8c77a5a4139856501b1dce9ddc3e3c117676da0dbbf37350ed295a97c245a8ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9cd953-ba02-11f0-91c6-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1762317842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317842, "uuid": "16e841c1-fc4e-4125-b314-7ab32eb3a713", "comment": "Malware payload (CobaltStrike)", "value": "3b3d40f82f51f78be3c2ad9a0e2d1d59", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317842, "uuid": "b9d40e27-bc52-4b3d-8b0b-cf591d0792fd", "comment": "Malware payload (CobaltStrike)", "value": "8d289ec1bb210e213d20fb8684fc5c3d0f3d7e63c193b8bb0665ddedfc0ec292", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317842, "uuid": "6ea95431-73b1-4f66-ac58-18c4e92017d1", "comment": "Malware payload (CobaltStrike)", "value": "bc5ec6fcd1dddb2791c46f8b142f3ca55d1b80bd", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317842, "uuid": "77137a02-f853-4d1c-a837-8b49d0d1f3da", "comment": "Malware payload (CobaltStrike)", "value": "1d942eb258e46cd38c3e0d1e4d746ba0434b0a88b2701be34319694aca8c524ff6494aa9a73c6d8ea6abbfca74f7c731", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317842, "uuid": "5314c6d6-14ce-449f-bca3-e6f6d77b3c1a", "value": "T102F533C8686AD8F101DC36B5A7D6A18311EE281FBDC8D39983B59094DC0E7FC5F7A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317842, "uuid": "95bb1d4b-4b54-4a41-bd3a-73d4652d8d8a", "value": "98304:GAB6m1v6li2pB9QOzFbGKj6C+mE6hbzi4/c2RqW:G+xJ6liS0wr67mE6hZvRqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762317842, "uuid": "465d8de6-7f52-4188-b335-9089363351a6", "value": 3652200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762317842, "uuid": "3ac56a17-d7b7-49b2-98bb-37fc079fc1f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317842, "uuid": "11a0e213-2efa-42b2-9a79-ad92c8dafcff", "value": "ChromeUpdate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09aab4cb-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319554, "uuid": "6383977c-2e47-4bc3-8d0e-b54501bb329e", "comment": "Malware payload (Mirai)", "value": "089f45ae334e45c7b09ff4df1782e1cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319554, "uuid": "08f018bd-b017-4236-a9d2-f45f10fa86a1", "comment": "Malware payload (Mirai)", "value": "8d3700377e881e7ea2e629abca7c2207d4888b53ac4becc945bb06a6a238def4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319554, "uuid": "f9953a84-3a45-4845-b9f5-6b230e68d4f6", "comment": "Malware payload (Mirai)", "value": "40fb36e43ffa70d1796f171175d19003481d7585", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319554, "uuid": "4fda7351-1468-420a-bf48-501e6327bf5a", "comment": "Malware payload (Mirai)", "value": "5e7c27375d79c37ae323ea42ca33a7eaf41cbe6fcc9b627705d45e7f04aeee796e15414edc7f3fa6fb294251d32cc0f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319554, "uuid": "5a09a470-f548-48d7-8df9-279bfd936f46", "value": "T15503E01BEDFCCB94F9AE553CA05BBA0F1516D04198B4C18C3A89B479785276FF22D213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319554, "uuid": "4a40ab8d-4e00-445a-8ce0-b78e2621d636", "value": "768:NWEpd2cR0FVepN18qzdmtRPwZVpFgWlNrFKfFXFNZYwM61u5J7cMcOA+tMkw9tyN:NXjnGMN18EUtKFvlNrFKf3Ybb7cMcOlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319554, "uuid": "6580dcba-fb23-4bfe-b535-bc3eabccbf31", "value": 39332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319554, "uuid": "95952c7d-4d1c-4420-953b-3f42b374c113", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319554, "uuid": "434a8d3d-b4e4-47b2-937f-0dc785a704c8", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c15ead2-ba09-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762320873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320873, "uuid": "3ac3fa81-ace2-4cb9-a82d-e8d03e6d7afb", "comment": "Malware payload (Mirai)", "value": "a68285490620468641a63c5938bbede5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320873, "uuid": "d81cbba1-cc98-4fc1-a6cb-3caf866ec9ff", "comment": "Malware payload (Mirai)", "value": "8da21627892dfc7f1eddc1cf5b530b3d22a922db57359caf49869fc479c95de8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320873, "uuid": "60335575-3116-4a01-a3f5-0b58ac2bcfa7", "comment": "Malware payload (Mirai)", "value": "5b0c3e3c45b9d44fa5b0ca54c531699e4f481596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762320873, "uuid": "1a5c3910-e70f-45cd-8cf4-044a4626206d", "comment": "Malware payload (Mirai)", "value": "3629ee90f5cc7575cfc9f018a34e50ad0ee39fad965d97fd08548982e455106dccb79b408d2ecfcf8a2d84811c87a43e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762320873, "uuid": "79ecf508-8ad8-4805-8516-fa225105da6f", "value": "T122639E73D51AAEA4C04455747875CEB02723784492B72EB74BAAC2B5A08BFFCF2143B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762320873, "uuid": "c28d8235-3b8b-4732-8ca7-9caba11ab28d", "value": "1536:JvafiZUWXESS0iomGfRNwr4WKKfKz4dRjQCTv7KoyVo:BikhX+kWNflJQmW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762320873, "uuid": "d93d756b-b6ef-4a09-96ea-86f313abb8a3", "value": 72340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762320873, "uuid": "e9448d8b-6de9-4281-9216-375e948d9174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762320873, "uuid": "d86f260f-066f-4186-ba2e-4cee61bf2294", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08feafbf-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319553, "uuid": "611747c1-84c6-4857-9c63-71fd71bf5887", "comment": "Malware payload (Mirai)", "value": "d51057c6c83519ea37d7a1d2c3a35bac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319553, "uuid": "55fcc12d-f390-410b-87c1-a454840200df", "comment": "Malware payload (Mirai)", "value": "8df88b9d94011e6719628b683f8819bdf9c820de9f69f0e3557e954fa27052fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319553, "uuid": "5f67ed77-13f1-4935-9ef7-aa572ce10317", "comment": "Malware payload (Mirai)", "value": "3e784e2ed272b2ae329ea6875b995c34f9ed142d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319553, "uuid": "fd9428e7-07c0-4d4b-ba85-cf4b8c4e6464", "comment": "Malware payload (Mirai)", "value": "c22eb6b90d63f862f90e0e18dee8d03e833d6d00fd0e6df8640495e50e779b3a6b46c15d8f49d10d0754584799faf637", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319553, "uuid": "96537e45-5bc2-42e9-8c5d-d7c33ed6b0e2", "value": "T1F413F14C1A02D05DED3AE0B803F90B706C011BBB7C935E26258FDAD76FDA1517945EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319553, "uuid": "48e0a943-efb6-472e-ab8a-8d3fd9ea64d5", "value": "768:BUjKrZsAW6EpKKReuzYJAmGU+B9IwQJIa4oxYCr+X8zV0JgGlzDpbuR1J5:BHZsAkpKKMNX60wQWa4MpyVJub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319553, "uuid": "709cfaad-7a17-4d3a-981a-bafc4ca98541", "value": 43196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319553, "uuid": "a5ef3677-7ca1-469e-8375-e0c57bd34e49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319553, "uuid": "2b8ba435-6282-49dd-92a5-4bbe55f8918d", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f7497b-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376753, "uuid": "bdcb0ae2-9dd5-4fbf-9c59-a8a6d36560eb", "comment": "Malware payload (Mirai)", "value": "9e50fef231560e19d05eb2bb1af3ad94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376753, "uuid": "0104f2a7-fa62-4eaf-a565-cf198282f215", "comment": "Malware payload (Mirai)", "value": "8e2c61f8e608e1bc62ffd0e85c6dd18392e3d3a3f6dde8789617a5f6852b3f77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376753, "uuid": "141d7f91-2999-4b47-a56f-8720f86b8871", "comment": "Malware payload (Mirai)", "value": "16ec2863ecaf0c232f20605f142e147096ac62eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376753, "uuid": "1037ee84-8b28-4a2b-bbb6-921fe1facbdc", "comment": "Malware payload (Mirai)", "value": "a1b4530adf8742cbaecd00e956acab9fd307c622e36dd60c374609d61f355cf6d1bc3bbb78c85b16ab3eb641fb932f85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376753, "uuid": "3c26f124-d03d-4abe-9b10-80fef83e73ca", "value": "T137334A42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376753, "uuid": "9198d84b-5c7f-4715-b182-402330e582c9", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Twe:ivW3jdQGqt7Y+Z+zN9cGgI6be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376753, "uuid": "92f9e99f-3595-4c97-ad19-edff32b4e8e8", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376753, "uuid": "7bb7eb77-fc92-4a2c-9694-ea0a7f01b63c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376753, "uuid": "54b00071-320c-4149-b40e-cdebe3ac064a", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8730edd4-b9f9-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762314181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314181, "uuid": "d6bd87a8-6a2d-45aa-8a2a-ee80d429e695", "comment": "Malware payload (AsyncRAT)", "value": "547065f0250c8b0536d88d75e3d82172", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314181, "uuid": "ea70a128-37d2-4abc-adbe-ef79c75e8063", "comment": "Malware payload (AsyncRAT)", "value": "8f3525441d90a73776829dd1ca640672d999fec041c7d82412cd3d87b227dd4d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314181, "uuid": "4bde7095-a032-440f-b66e-449e263961c2", "comment": "Malware payload (AsyncRAT)", "value": "d1f889f57644dd84c257d281074f80e9281bd8ef", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314181, "uuid": "8a177793-61eb-48cf-9581-a1e6b9cdf9ac", "comment": "Malware payload (AsyncRAT)", "value": "21019461315980fdde31019819c15408f2f757fd4e0e537211e270a5592a8bcf9dbdfb2319ad6effe5ea607da3b1653c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314181, "uuid": "b5e512ed-9589-4f91-a41b-6107bdb942bf", "value": "T184E23B4877E04312C5FEAFF02DF3710A1675E11B9823EB5E0CD8CA9A2B679C146907E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314181, "uuid": "4d1bee9b-11b3-4f91-b41e-4c9d89296e3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314181, "uuid": "60224cca-38d2-413b-9fea-2fe65866a8b2", "value": "768:GxC3fOJ5yivGFbO75pKDFo9jdznOOjhBbj:uCPOei+bO75p+Fo9jtOOjHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762314181, "uuid": "2a902384-1994-42a2-9891-3c0be2a24530", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762314181, "uuid": "e306827c-0c94-4d90-b670-578774cb5ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314181, "uuid": "2035f794-e12e-40d6-8203-715d5f229f77", "value": "xtest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37599e0-ba64-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762360211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360211, "uuid": "d7eece68-8f1f-4475-8691-711140d015f0", "comment": "Malware payload (RemcosRAT)", "value": "e93af87a127ca6be2f0f043a2070300c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360211, "uuid": "b1d5053f-70cb-4bbc-8872-f14f925ab5ed", "comment": "Malware payload (RemcosRAT)", "value": "8f4cb07a4333f15fa8e585b00ef08ab329fda9fbc3802fdbdf579c194096ba9d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360211, "uuid": "ca7f750a-a767-491a-8a6e-fb347933a2b1", "comment": "Malware payload (RemcosRAT)", "value": "bfe1fd750967a09f44a88aeb8b888d0d5a7a2b33", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360211, "uuid": "28a6afa6-b3c4-4dc5-9b1d-783e0e5da942", "comment": "Malware payload (RemcosRAT)", "value": "fe0ff1279fcf1a600b38be75a4b4481838a9f08728cd5e99160a392f1764fe5e4aad74961cbc1a12b8df6eea65baf9e7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360211, "uuid": "53bc0de5-f11a-4a3b-9f03-b3ddf0c31f55", "value": "T10F4518FFC8DC616B35E3EF12A27ABABC463525D6AD22551E208137B32E0C146F702657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360211, "uuid": "509eea7a-d2be-4572-8f9c-f10ec43e0492", "value": "12288:fzaaPdSTjA5yXetplEqUuWBnmcjWEDL0w3Hf/5tKZVjOPSe2ZVJiCJ6:bawSTjpfXr3DLFKZZwSe27wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360211, "uuid": "97c9f960-48a7-448c-91d2-224d51816eb3", "value": 1263843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360211, "uuid": "c5a9c7f5-ff72-4d41-9150-a6599ff0917d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360211, "uuid": "c4762555-42ed-4058-8c1c-7a9da70b7406", "value": "Commission Policy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a155a61f-ba3b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762342572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342572, "uuid": "66b4c72c-464f-4146-b0f2-82c1c2980f39", "comment": "Malware payload", "value": "1bb965774ed9022bf8190871fffa914c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342572, "uuid": "306ca7df-659c-4061-a307-e9f2418179b0", "comment": "Malware payload", "value": "8f5aa6325ae84727f4fac778f10af10be1918d675c32d79229af1078bb8aa220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342572, "uuid": "1ae22ef6-12f4-4c4b-b4ab-108c0ac51bef", "comment": "Malware payload", "value": "22bddd9a19b09c0fd2e730e4e09ee088c63f3419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342572, "uuid": "1fe10125-dca8-4ad8-ae59-7e558a881130", "comment": "Malware payload", "value": "abf69666cda96440cf51c8352ceffec3737c2f265cd00b786c753e3d721b25e5bdcd772784c55927b2aa4069f43ccf1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342572, "uuid": "eb9517fe-a7b7-4ba3-a124-5fe9d894a7d2", "value": "T128A47D5AA66900F9E1A7C17CCA438D42E771784547A1EBCF03A49A762F377D08E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342572, "uuid": "e51a2f3e-b20a-4313-b518-3999896a387b", "value": "4417249db25f76aa5ea9cf43e19a38de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342572, "uuid": "c2703067-3c8c-4526-b077-bef11bd2142d", "value": "6144:r6ibByeaqedB1eoHAmFky7z2bpXkKHHhiH9QXDvbwyMAfrMnrK6MTU:rZ18/tViHwdEP7R5NU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342572, "uuid": "a6e8db11-a4ae-421c-b8f2-407a75f5d8d8", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342572, "uuid": "edc43044-93f8-4533-b797-7013c1f5b145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342572, "uuid": "ac7b2126-10e1-4bf3-acc9-28de034ba36b", "value": "dva.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2648ea05-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376725, "uuid": "4a17f79d-0a1f-48e5-a885-3addb805d282", "comment": "Malware payload (Mirai)", "value": "ba1d846fc551703860159b9f10044371", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376725, "uuid": "e63afeaa-cf8e-4f04-abba-eba9d025bfb0", "comment": "Malware payload (Mirai)", "value": "90ac481b0483bee411d930974abfd6c77381baf04038344301cebc79a2d6898f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376725, "uuid": "46934f2a-d3ee-4ca0-8bd2-2e5c2f9826d2", "comment": "Malware payload (Mirai)", "value": "09e7f2007de2205baf3e433bfe9003f775a00cb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376725, "uuid": "5aa22f2f-3e3b-45f6-a781-8f10b473a1f0", "comment": "Malware payload (Mirai)", "value": "21663c652c9769f442af9c4f73a574f49abf9a7b84498cb81e9728dfcb1b20de8fc551457a553ae69e760f3ab8edbbaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376725, "uuid": "315d5622-dda8-4e6a-aa06-c9debfc16b97", "value": "T11DA2D11572632D65E3ED283CC96AC31BB9A71BFCD0F5327A69411520C94D24A3E39B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376725, "uuid": "d7dbcea0-2792-408d-aa63-f31065086f87", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjHyBhymdGUop5hR:vvQn4j+ZO5fKAlxLyBs3Uozv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376725, "uuid": "e2b443f3-46a3-4d0f-8def-5f248a6834d0", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376725, "uuid": "a073d817-d0fe-4ce7-8628-f5a2d5c969a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376725, "uuid": "76efe328-9948-42ee-8ac5-ce8d22175df5", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2438358e-ba57-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762354388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354388, "uuid": "c5914fb9-14f0-45b6-a19c-f7b78356d551", "comment": "Malware payload (AgentTesla)", "value": "e3dc6530e7258dfabb53b6ca2e93330f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354388, "uuid": "28889864-d6bc-4831-ae85-4c98a801cb80", "comment": "Malware payload (AgentTesla)", "value": "90d3d55fdff5ae934295eff3f68555ce904df92d8a7e6b72c56d3e140bed51d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354388, "uuid": "4af6108f-cc19-4f24-a624-341f08d8a3cf", "comment": "Malware payload (AgentTesla)", "value": "9773a4d60ecb38a28170350cbe63a9ef735aaec0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354388, "uuid": "c45c2f7b-8fd9-46f1-be02-82df0e79fc43", "comment": "Malware payload (AgentTesla)", "value": "4aa92e346b39d0fd4eb2eec8b034f2c7f30e04c9f8af624aca13824fe3d39eadb1d2c76111e594a40f390b559f216e37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354388, "uuid": "c34a6b10-7a92-40a9-b1db-6957cd6c7ad4", "value": "T1A045F1158A886FB9CFAC5E1880FA161EA3F00A8F45167549FB3BBD46BFF7504421B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354388, "uuid": "be91b031-9171-47b0-8bce-2545a7f58c94", "value": "24576:KBbv7c0DKpxrseZHHRZjFoI56TTFKnIW6XBeEW5WUY1:8Ds1DhFoygFKIFsEEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354388, "uuid": "f8d7ca3d-a07b-4de5-a7ac-02ddb15cabbe", "value": 1261542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354388, "uuid": "c28acb23-81e6-4b4b-9b43-b136e81b3590", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354388, "uuid": "d7ec2782-26de-4d9f-aa0d-95b5c51fa9b5", "value": "BASE.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace81b9a-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316821, "uuid": "7917ef39-906c-482b-8f9d-56667f085672", "comment": "Malware payload (Mirai)", "value": "67d59f1e1fb0dc2feb4b139e55f5880e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316821, "uuid": "ebaacbc8-22c5-4653-adee-fbc63b46d31e", "comment": "Malware payload (Mirai)", "value": "9182f6db71c6f263044a5d2e18c365857834d752ad6ce8e405c96e2902d3fafc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316821, "uuid": "be507553-5c4a-41d6-a31f-386c277e8dbc", "comment": "Malware payload (Mirai)", "value": "053fe57ffd88af7935b076d823cb07dd79eba96c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316821, "uuid": "169786ca-5cb0-4743-97ca-df4c74e2a018", "comment": "Malware payload (Mirai)", "value": "dfa11173e93c7c5404b7b8df8f7da348ebc97b72a5dc2327b776cc7dc84f6daf646372b9d39c7a4a4c2f1c247e83508e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316821, "uuid": "0cad437f-65c1-412a-a9b9-d4f7e461457e", "value": "T170435BC59563E9FCDC1015393077FF7296B6E93E1028EBC7D7A8AD32A941A02D80729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316821, "uuid": "d1891a99-5076-4848-96d8-e5b724a5c3ea", "value": "768:CoXHT2eWv2WAb3Mn6zDjbr63UM7Jwv3U/HYXGvWt1XfWA+7tOfRc3IA:CojZWAb3O6zDHr63UywviHWTF+7t+Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316821, "uuid": "96fc2f03-0d5e-4cdf-88b8-84343fe545b1", "value": 55872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316821, "uuid": "ee14e3a7-16b7-4e5d-a116-4b493c7d05b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316821, "uuid": "a05cd24f-2c91-428d-9c4c-74e0454bedac", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7b59ae-ba17-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762327107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762327107, "uuid": "7a412b7f-2c50-449c-900f-f6c41d1a7e81", "comment": "Malware payload (Mirai)", "value": "3c9f55a9c2917192970221f1abacc96f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762327107, "uuid": "4075660a-4a95-441d-8174-365e9544ce59", "comment": "Malware payload (Mirai)", "value": "91a54105a0aae3ad81a2e3eebc3ce15a40ba55b35fa2b34ebcda4b64ffd5a034", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762327107, "uuid": "7fda5d13-fbe7-4dd5-976e-be99ab967839", "comment": "Malware payload (Mirai)", "value": "d5004f1f0caa300526fd353af1d16d59bcab59a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762327107, "uuid": "b0018321-6d51-4905-b734-6d9661ba03ee", "comment": "Malware payload (Mirai)", "value": "364377e30fe3d1d6e6ca4c6536b339c9cc1eec07bbdde9af4d7182beea8826927198118f18faf55b89afca68c4212364", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762327107, "uuid": "754967b0-12a2-4a73-b54a-15411610f696", "value": "T1CC936CA1FC02EEBDF40FD77B84474919B230A3A125935F362397BE57A8351994C63E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762327107, "uuid": "f6d288a3-7143-4ee0-8c54-b7e30d8b26a0", "value": "1536:Nfh5RffdMXYEBraD6FKv5hx/8ibyK0gFm6lKSo2zpTbg94GArgudTbEYo:NHRnberycKv5hxFyK0gISV9wArguJbEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762327107, "uuid": "3c393355-a5d7-4744-a686-deb3552bff50", "value": 90244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762327107, "uuid": "9952877c-3ba0-4868-9485-2b0ddbde8070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762327107, "uuid": "3047b35c-e81c-49e0-b641-37dca157b700", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2010fc0-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316803, "uuid": "89282744-47dc-484b-ae4a-4a647e08a613", "comment": "Malware payload (Mirai)", "value": "14c31ff2016a8f6069be287d4aac2aa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316803, "uuid": "8e6f3bbb-2371-4223-96bb-b3b53196946f", "comment": "Malware payload (Mirai)", "value": "9216566a3b04c398c50335e75edc9aeeb255950e173dbbcd47c1cda347de5a08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316803, "uuid": "1ec4e64d-d7d5-4e48-afb9-22154a7cd51a", "comment": "Malware payload (Mirai)", "value": "17f219d4577da32c32a7b333c91003f3588431d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316803, "uuid": "c7aea1b7-2466-4869-a62f-34d9b102732f", "comment": "Malware payload (Mirai)", "value": "17a43311b6ee87c85a0bfb1c3d4b338ce5120b01e1ef0f10690858d4ba214a9f28577d38cdcae5d4b00128ab8b067a5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316803, "uuid": "9d2e9f54-3a7a-427b-b0f2-7b8db175fcd5", "value": "T18A531895BC928A12CAD423B6FA2E518D332663E8D1DF3207DD216F1137CA82F0D7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316803, "uuid": "f0c0d50b-3e2e-48dc-a496-79cb5d76fad9", "value": "1536:xZ3r3+MJd6jhQWBq7dmVrL2yBCtt5KK2LxlR:xZ3r3rJXQlvYbKK2LxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316803, "uuid": "17f14bb1-d7e9-4e79-950a-a902a36eba19", "value": 60792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316803, "uuid": "c8657634-913a-4f7d-966d-ec0b60751400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316803, "uuid": "6afd2e79-26d1-4076-9a1a-bb2c49fbd780", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46bf2a3-b9f7-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762313371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313371, "uuid": "1c3b198a-adbe-4451-97fd-34a0e62a5243", "comment": "Malware payload (XWorm)", "value": "f6a2105bfa00b08c3bd4540fdd187250", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313371, "uuid": "def2c4f5-5ff1-4d8a-bd30-18aa8c372e14", "comment": "Malware payload (XWorm)", "value": "9260dbe6bc74d9fcc9739b257341f910123b11dadbca4e718dd04f72565f932a", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313371, "uuid": "9bcb2706-a91d-45ee-8493-790f2c15672a", "comment": "Malware payload (XWorm)", "value": "f31e103d9987809374a7d3f9f618df5908d178d3", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313371, "uuid": "2d5310c3-4d4d-4a26-b5f4-77af08ad8310", "comment": "Malware payload (XWorm)", "value": "aa727c43c50417c6dbdeb1486a1dee211ffa43351d1adb79ab0b173b2b458dffb5805476c88668fd10d4f7da42373340", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762313371, "uuid": "af3f0d59-3935-4703-86dc-cf7951120ed9", "value": "T12743F1C79849948A70FF9BEADE85B4724A81C4C7113F3D9C4ED80EB64EF1EC79242261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762313371, "uuid": "ad45179d-dd40-4093-a19d-770d3ff60c63", "value": "1536:RibtqbBQGz3NJO//1yarctl6t3SkUppG1es0OkHD6:RibtqtQGzw9yarul6tcppG1es0NHD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762313371, "uuid": "27df5f5e-b961-4c23-9bbc-1bec89b0ccb1", "value": 59704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762313371, "uuid": "48055964-36f7-4cfb-a715-10d3babb5ddd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762313371, "uuid": "f9710310-7517-4683-950e-4eda1a5b4239", "value": "Overdue_Invoice#2351.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d358aff-ba45-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762346860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346860, "uuid": "3656ce79-1bdd-418f-8034-b047574e3dd2", "comment": "Malware payload (Rhadamanthys)", "value": "0665284a4a27953a857159d9776d721e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346860, "uuid": "d5108d72-58a3-4b33-85a5-25c2254367d0", "comment": "Malware payload (Rhadamanthys)", "value": "92bbfa7d033c3f31dc6837b26978a1babc530b77aac50cd25c29bb10c3eae3a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346860, "uuid": "9e24a586-05f0-480d-ba83-de30dbd37566", "comment": "Malware payload (Rhadamanthys)", "value": "b698a12cbea972ec9dae98639c8a5ef1d8cda5f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346860, "uuid": "a4fcba2d-bfa1-4e00-8c8d-a30b8913fb54", "comment": "Malware payload (Rhadamanthys)", "value": "24d08fbfbb48538e542bb37633f1ddaf4736ecab19ef0a2921bac295d62860148f28aaea8efc6e025b36881e2e288795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346860, "uuid": "d176d736-6883-424d-833d-e6a731d5f264", "value": "T1CCE423676801FA57C523FA32E51198D827DD9F08325FA76A2D022A245B29FF07337F18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346860, "uuid": "eec8e6cd-9647-4a4a-bf64-c6713844fc65", "value": "cf9fe8688c9cad7a9539ec9bed0bae85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346860, "uuid": "96fdb127-4561-466e-8dfa-1f286ea8fca8", "value": "12288:YB9ATmgKh1FinN78NG6AUe+VG6erJVdOVMHyfag20vNhDWCYUUTRuTFeL:9Tmrh/iN7VNkFE1e2EHWCfDAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762346860, "uuid": "7b7055ae-7e5c-46be-ac01-54764b6cfc02", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762346860, "uuid": "39fb3c66-715f-428e-814f-28d532393b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346860, "uuid": "6eaa453c-c387-4582-806d-823d90f8f6d6", "value": "stasik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e49784c-ba4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762349009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349009, "uuid": "3e1c55bc-1288-41b0-a71c-65b6d442f738", "comment": "Malware payload (RemcosRAT)", "value": "eebeadeb326fd311ba4bcbd35b3139ca", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349009, "uuid": "a6d1dc2f-c79c-4c33-94dd-4f0d853bf21c", "comment": "Malware payload (RemcosRAT)", "value": "92c4d7096ce417b57f5125ed2d1c31a054b1cb849a3cb39d344a8ad029b32fc5", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349009, "uuid": "99c2b725-a0fb-4d6f-a92c-818e13dfa53d", "comment": "Malware payload (RemcosRAT)", "value": "cb8f6cfb73456499fc9b5a505dbcff53bd8817b8", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349009, "uuid": "bbbc53e8-2763-4412-9d78-ad840fd563c9", "comment": "Malware payload (RemcosRAT)", "value": "bb5a7d044805a1071900989e74f672952ca7b0019386c503d447dc77439680e4c902ddd8f4b6deb524d249c6aa84b2ed", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349009, "uuid": "c7352d85-696c-4e55-9943-f9ae92835da3", "value": "T13E75DFDB62A1B832F01315749C7FC7D8B4E9BA10D924B68669D4DFCC1A347DCA4E6283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349009, "uuid": "376f7cb4-3049-4118-946f-57738d8c983a", "value": "da2ff03d800b80f30f9a0595b3e80bfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349009, "uuid": "2d1ed853-7143-47ca-9245-d6a1bcc9faca", "value": "24576:nFR7GVFsIagACpSe+FQ2q0zLdNoWCaZEXvEJz14WGTMxC48vl3:n+Vr+FQ2q0zL/lCaOXvEJmWzCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349009, "uuid": "64357687-ce4a-43c5-a1b6-939756712a6f", "value": 1590784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349009, "uuid": "1581a835-246e-4a29-aeb7-7fc87d8f10e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349009, "uuid": "982f74fc-5d0b-4376-b3a6-087b1f72fade", "value": "92c4d7096ce417b57f5125ed2d1c31a054b1cb849a3cb39d344a8ad029b32fc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5366802-ba22-11f0-91c6-42010a9c0006", "comment": "Malware payload (SharkStealer)", "timestamp": 1762331841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331841, "uuid": "f2185942-d2e8-49e8-8247-d0219bbfdf0d", "comment": "Malware payload (SharkStealer)", "value": "7b24546c341884520eb2e254890bd637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331841, "uuid": "c2e8d60f-cf84-4d8e-ab46-c53bb547cfb6", "comment": "Malware payload (SharkStealer)", "value": "93accefa8303fff76fde84f1daf124364f6e4928ebe6cf607d499068cf244dcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331841, "uuid": "4b6b05cd-c8c5-448a-8766-4bf06b0595ad", "comment": "Malware payload (SharkStealer)", "value": "38830e4bec92288b9ea2abf00bf83b7d07dcf097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331841, "uuid": "a4a31f47-4c61-47c4-8c87-6b3566b0564f", "comment": "Malware payload (SharkStealer)", "value": "56f1e4eb8b343610df9f3b1346f9f8c173b6313f60140cddb5e5d191897f013185ef3516c4db8da8560860e69e59e3d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331841, "uuid": "287a1d5e-bfc6-4295-95f9-ef945e3bf7d6", "value": "T17BC6129562DC00A4D0F5C779C6EA5813F63A7C144B3AEFFF02A196162D26AE1DF39720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331841, "uuid": "3dea3ac9-9452-4295-891c-6e11aa2c8b00", "value": "da7c7889a9af299fe69cc0665690e327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331841, "uuid": "fe9e7694-2576-4cbc-b9f9-de425577e174", "value": "196608:0zVErIdoi9NOJJ66lxLYRbgQK3g4XBtHRFglwRwetHJCcCUTBM6hteMRI:Rr8NOmNP+5xowzplpteMRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331841, "uuid": "d5a822d1-66b3-48eb-a0ce-fffbcddf325f", "value": 11927304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331841, "uuid": "fb89f7ba-9f54-43e9-925c-197c5f02b55e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331841, "uuid": "e5e562f8-8007-470b-a554-1039b37da9bd", "value": "claG29AwmsS39p62iyTc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6faceef2-ba96-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381572, "uuid": "ace5710d-69d2-4d0b-be9f-d8b829f02376", "comment": "Malware payload", "value": "4deec846ab4940c9c3fa9aa2ad55dcbf", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381572, "uuid": "94499572-b11f-4baa-b3fb-2b4c6b8deb05", "comment": "Malware payload", "value": "93fa78d3a546ec71908162218e4b19caa4f2a236d4387d4ffa61956cee6ba11a", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381572, "uuid": "f85849a6-3455-42da-aa4c-85ab7faf392a", "comment": "Malware payload", "value": "db2737a049a1093f21701613f1950c92e4e4d7e2", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381572, "uuid": "922af20a-900e-4829-a3ee-ed51927d5fb3", "comment": "Malware payload", "value": "51abf442d7627c984feaecc89dfdcd9694d73f8f33cda9b45c9693ba7990b673ae9d2ae7c90178ecc0f6895a80ee88bd", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381572, "uuid": "bbfe89e5-21af-4360-ac26-769326766e87", "value": "T1675412B684E399E6FCB8D7D4E242EF965D310F1E4374B406107B88E0361E736A6164AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381572, "uuid": "4a34d40f-8456-4c63-a489-8c8a2214a985", "value": "3072:vQJl7tNL7QxrS2xk+LKHT8W0/+3MQJl7tNL7QxrS2xk+LKHT8W0/+3MQJl7tNL7Q:uD1h6KHTy0D1h6KHTy0D1h6KHTyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381572, "uuid": "49579076-3db5-4461-87de-7dfdbd66391d", "value": 294363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381572, "uuid": "6c6147ae-14c9-406b-9214-dbd1ffde4caf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381572, "uuid": "ab01963c-5451-4224-9cdc-d30ef329ba0b", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e9f668-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319979, "uuid": "dd91b1c4-3cdd-480c-aea0-a0dc2ec8860d", "comment": "Malware payload (Gafgyt)", "value": "507948373f55fa49715fab8e1b638dc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319979, "uuid": "23dcab0a-56b7-4f9e-b4ca-7ac703e01c76", "comment": "Malware payload (Gafgyt)", "value": "943a5a0541f2989e027ffe68b46b881dd93c1d9f1481e45218c778dca835f42c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319979, "uuid": "a5880e62-3607-4d63-af75-072fd428d393", "comment": "Malware payload (Gafgyt)", "value": "66d29b9eb970957c5de41b6f07a42e023545e750", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319979, "uuid": "44a64ba9-d8d4-4d13-a641-178f496f37a2", "comment": "Malware payload (Gafgyt)", "value": "e74ecdb7cb6295dbe4ef0cca23cc41a75d8a0fdafe9d1a5102879ead8f183e402a49dcce8b457340d0a917172d316bd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319979, "uuid": "ca7e5cab-bc2d-44ce-b849-fb5a288445d2", "value": "T144C31769F8454B67C3E332F6AB5C468E7E3507E723DB30225A348EA067C1BE22465D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319979, "uuid": "0b4b19f4-5d60-446e-a5fb-7b9a99ea38b4", "value": "1536:a/WoAXa6tk9RPFHW1cbYK090PkWPk6YRwuW9fVt4VjpOLH5hINr:zXLktHlbL090zPmWSVi5hINr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319979, "uuid": "bcdb3f0e-fd25-4798-97bf-754e49c3cfac", "value": 120200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319979, "uuid": "2ee0c358-839a-4d33-9f1b-bb471c106a5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319979, "uuid": "3d423c92-bb8d-490f-b7e9-611e55f8c18d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1712371-ba8e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762378220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762378220, "uuid": "5f360b3e-0c65-4881-813b-19963fd06d1e", "comment": "Malware payload (Mirai)", "value": "177bb31b5f5f9410df762465d34576e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762378220, "uuid": "85503e9c-db07-488d-b5aa-9d338467a902", "comment": "Malware payload (Mirai)", "value": "944a636126ececd0737b54418cc82bac38d3cf5a50696f8fdf40a2c187fcfd75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762378220, "uuid": "561e00bc-43f1-4268-b447-d1f0af449d19", "comment": "Malware payload (Mirai)", "value": "83e62020d2e6d00fae240ac7b4c7b554a8f9258a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762378220, "uuid": "50b0c5ea-f4bf-4e7f-96f2-25a0732f8f7c", "comment": "Malware payload (Mirai)", "value": "958b60abc32ca944dea8139472377cba45c455860e5368055fd2b85ac92339b30c3e4177483eed51de3cb6f78076b94c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762378220, "uuid": "43af3555-96fb-43c8-88a7-e35b5455beae", "value": "T100C2E1F2464A242FE6C080B6437E7E9B8E79D1F9F396076909D4843B1ADA0C1F624D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762378220, "uuid": "717d7bd5-d3b3-4c21-9698-3ea539bd91c4", "value": "384:Md/Phw3ZuKh++Tad08paQjntbLAB1/NGsoQ/5yiaGs7TPIRa8X3eqLmzD/NzlKCV:knhdnd0GaqEUa7O+5oNlKCFh8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762378220, "uuid": "3a9d4413-603c-4b95-b140-21de8b0a1404", "value": 25824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762378220, "uuid": "45e097dd-2ff9-463a-ad11-f14b6d53e8ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762378220, "uuid": "2113ff6b-8799-4056-8d5a-afb02ddbe826", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07917fd3-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319980, "uuid": "6465e962-ed4e-4c50-8183-36da865a9243", "comment": "Malware payload (Gafgyt)", "value": "208b21d8625f171ca76e295a87875d79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319980, "uuid": "9d7edbb5-dbc7-495e-a451-4d89083bf464", "comment": "Malware payload (Gafgyt)", "value": "9532fd32c8ea073e67dbebf93034a7ed9ccc7b94cc6aecca2114a1a5e21584b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319980, "uuid": "d0af6efa-674e-4d1f-9fba-22ee8ddbb155", "comment": "Malware payload (Gafgyt)", "value": "b3640e07cdfd626382a1d7408b20579b429455a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319980, "uuid": "474df208-f923-4cbb-85bb-5e449f4d5685", "comment": "Malware payload (Gafgyt)", "value": "d9918b8cda0f3ce7c0d003c03dd4b7e27b849d52498617493caa9829fc9fcc498f46b2dc8458276318f52049cdfd0847", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319980, "uuid": "1dda6a40-3f16-43da-a819-90d65a02fe25", "value": "T1E4A3F7B5F341DA72D10300F2219ADF325C32F6FB1596A55AE7A02DB0DE750C26962FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319980, "uuid": "ce940195-c8ef-4a46-b26c-dfcd67f2f8cd", "value": "3072:5Ak/JVUIUVUrUsDU5UgkwV6BGkvI3ThpC/5h1:P9CsBaSk6BPq/C/5h1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319980, "uuid": "b376fc96-b98b-4576-867b-d46ddbfbf91b", "value": 103176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319980, "uuid": "aba99ca5-2345-4095-8526-d1c64c0165a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319980, "uuid": "dc697f4f-fba7-44ed-aa7b-492332e3fe89", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0dd5074-ba6b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762363294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363294, "uuid": "1f9dead5-ba7f-4b90-ba84-2cf0e327d324", "comment": "Malware payload", "value": "bcb3ca17af659995656bb40faea00fbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363294, "uuid": "c8ab1e4a-2c5d-4042-aae3-380ea5bba555", "comment": "Malware payload", "value": "9587e5194e97233e25db8c27e260e7a964e37409908223831a96764a5c9aa8e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363294, "uuid": "92e1506f-6406-40f0-a89e-7f9c741ffbce", "comment": "Malware payload", "value": "958fb456e4101c067b4b92ce2edf6e52cea01fc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363294, "uuid": "cc74c64f-86c7-49ef-aafe-2464df018598", "comment": "Malware payload", "value": "fc1af670fea4d3a807df4eda610a3e45ad95f962fba2b12c5ca17de13495bab7cc1690aa4dd5fea5329736ed40f0d91e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363294, "uuid": "36cbbd4e-3e8f-4147-8b85-e16ab1443851", "value": "T183A3768D3DDABC61576220373D6F68AEEB2B3CC1714C4114D2B6BC64F96C309E8B1969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363294, "uuid": "b514694e-2a03-48a3-a7db-112bb6102b51", "value": "1536:hHS0PaSgW5iQe+WBP1nL81dIHWZGN/W0Gs4LU1ACTV3M71lRTTClnGyf0RmIYFI4:hHLPaSgW0B9LpGdU1He9TWBGy3i6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762363294, "uuid": "6cfff0c0-2ad4-4ca0-b300-99d9e47feb19", "value": 102541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762363294, "uuid": "512bb22c-0dc7-4d40-92f1-a8a18eb70d22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363294, "uuid": "82a7591f-8222-447f-ab43-6bfb776d1ca4", "value": "Inquiry Supply Specification EuroMeridian Sourcing Group_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693445f6-ba30-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1762337753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337753, "uuid": "0e8b8ec4-f60d-4f08-9054-8e44db1c9761", "comment": "Malware payload (CastleRAT)", "value": "ce7e6656eb256a8b750097ff8e90ade5", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337753, "uuid": "165cad76-b625-4f02-89e3-a563286d9f52", "comment": "Malware payload (CastleRAT)", "value": "963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337753, "uuid": "84fec1a2-a2bf-4d5f-b066-8db700be47a0", "comment": "Malware payload (CastleRAT)", "value": "a65cc34e8b4814a0d5a8490ab06b04319f59ee9d", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337753, "uuid": "00180548-878d-41c8-b4e2-bf74ac30b76a", "comment": "Malware payload (CastleRAT)", "value": "2577ac331c39f4f2c89e6d53c244bb85633932c0ccdd7ed549571db7f2d6afa2060967e959ad326712836f27e5ad4ae8", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337753, "uuid": "d4c10115-cd22-40d7-ade7-75f023c8b7ad", "value": "T10D242806B7F610E9E4B7C13989626616F673780D8720AADF4350D7762F236E0A93FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337753, "uuid": "45a377b6-a493-40bb-b640-6303b3ae0645", "value": "3c356739b2d8023cb5239dc7141badfe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337753, "uuid": "2d12da7d-cc32-44f3-819b-9bcff0e9c205", "value": "3072:dRwgRPvUJdrhridEmmwOEEPglOpSn391rWuk1maa3S9+vzrax/IcJj:dRgri7mKE1SntdWu2p9+vaicJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337753, "uuid": "a7720b6f-c2c7-43a4-ab00-1eb4da4637aa", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337753, "uuid": "ac70f44f-bbad-4106-952d-7d9bc5f0c4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337753, "uuid": "afb46ae8-442c-425c-9e35-54c635153efd", "value": "963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff059d6-ba48-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762348180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348180, "uuid": "a75f72d9-5952-4125-bae4-36e552c015cc", "comment": "Malware payload (RemcosRAT)", "value": "eb02800255cfd4e832cd6a473e69cd07", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348180, "uuid": "ae598f40-c38d-49e2-be66-a4bf7a3a5a58", "comment": "Malware payload (RemcosRAT)", "value": "96f4be5fe7ca9039295f560d460de3074e0e9370a0dc4e7e82b9a3579801855e", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348180, "uuid": "f761be27-24e4-4e4e-a43f-f411310de807", "comment": "Malware payload (RemcosRAT)", "value": "8825d13eb1b55dc598923c0896242b3b72101e84", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348180, "uuid": "ea8e665e-ff1f-4cbf-b5fe-288b3cf023a3", "comment": "Malware payload (RemcosRAT)", "value": "2aa3bff260e55d8a3cd3c647bf4ce04e1c36b3fe4aa8cfef453b231eaa4283f1e47566284a024826d253b5aa7b1ec82b", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348180, "uuid": "f97642f4-02a5-4625-9ba0-58620715f742", "value": "T1FDB4AE01B6E2C1B2E57214340535EB75CEBDBD20183DAA7BB3DA0D67FE304519639BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348180, "uuid": "13b164a8-687f-4e10-b2e7-c9edd3ee36b9", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348180, "uuid": "d018b3d1-f59c-4cdd-80f8-330103a01586", "value": "6144:TRlNoBcUQjA0VGnjeBobKvSEslHaerUnYNxiialwcSRuqdwsIIsAORZq/XQ+cqhF:TRlkLeG0YKvSR6erU5Xwc0vsPZqfSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348180, "uuid": "29e67416-5296-4a1c-8c30-a7a6626fe7c3", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348180, "uuid": "2e7e2bfb-7d1f-4bd8-a75e-8e4b2f85922f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348180, "uuid": "e8c3f88c-202a-408c-b991-af1f728c1145", "value": "96f4be5fe7ca9039295f560d460de3074e0e9370a0dc4e7e82b9a3579801855e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06525758-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319548, "uuid": "a67a4b3b-35b6-4252-901a-6f0520103fa4", "comment": "Malware payload (Mirai)", "value": "98a4a803ee4cc21501d1cdf083f510ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319548, "uuid": "ce5234b8-a9ef-41d5-a90d-5492be11a899", "comment": "Malware payload (Mirai)", "value": "971736da477c2c4a7892cd8e8c9bd1979931beacbcc25242a2d8d8c222c91c78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319548, "uuid": "6646d2c1-278c-46c6-9df6-948d4dcaa920", "comment": "Malware payload (Mirai)", "value": "cc6ef9b971b7529045361dda87fc7d1151e34d15", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319548, "uuid": "08e844a4-07b3-48de-ad61-6551ed49027e", "comment": "Malware payload (Mirai)", "value": "eeb92b61057810b2db6009b099a4ec5487307ed05cf24da73c6ed1dfc4ab70b7a6edef1df23ae243195d719e1a4ebfd5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319548, "uuid": "fd86400e-b806-4d30-891f-1f8220b86fe0", "value": "T1A7D13EF6B48A52BCDD9FC83E511029BD5086B99B26870D6887EE247A7C99FCC5C409C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319548, "uuid": "3c28089f-a8bc-43b0-bbef-b83cf2a8114a", "value": "192:XU3mBKXOBqTGp83crC12fNk7sBpgnAlMPOZyMPOZyxofI9aNwDYPGpi79Ur8xuxm:XU3mBKXOBqTGp83crC12fNk7sBpgnAlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319548, "uuid": "111d6991-8d5b-4157-9ed1-e1918bd65c08", "value": 6329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319548, "uuid": "c7048aee-23a2-4920-8823-f4724d06b7f4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319548, "uuid": "fe22a061-cc35-4e48-9824-f619d4d7fa88", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f9678a-ba40-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762344680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344680, "uuid": "640bb510-0430-4616-a978-a888e51e7eb2", "comment": "Malware payload", "value": "3fcee3f7982facbe12529f68fcfd052f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344680, "uuid": "b3628581-99ab-4a71-aced-9802b414e3ef", "comment": "Malware payload", "value": "9783731122153db7ebfe852d412c371609c9428a8436fae8d058ab71cf45c15b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344680, "uuid": "49f22d97-b35f-4427-bbbe-2a70d5a74d4e", "comment": "Malware payload", "value": "8c2c0ca60c1d80e20a1878c2918e681f4e4eedef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344680, "uuid": "7ecd1827-7cb8-445c-9349-b60b2648a2d3", "comment": "Malware payload", "value": "1293dd4b58e9de3861ab5e4178c493cbbb01ac1a89a28ce603518fff2ce5df012a8828746aa26e1dd07fa25c08e594fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344680, "uuid": "5f7eac86-bd80-4e01-85ca-8464069d5972", "value": "T19AC08C92843CC431623D0B6EB396F1F49902A42D0FB078A2D8188650A1240700C8F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344680, "uuid": "348090a4-9b36-457f-87fd-7932e24a8a1e", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfVV4sHMLAGztUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfAsHKFgebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762344680, "uuid": "37efb00d-505e-4f3a-be54-58abadf11015", "value": 168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762344680, "uuid": "30773045-168c-4494-ac92-74e9db5cdd17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344680, "uuid": "432fbd19-b671-4678-9010-457b86fbd6a2", "value": "tvrzkwy0xb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30707f4e-ba4b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762349254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349254, "uuid": "b54c6bb8-3af8-4ef0-b397-664b764ea78d", "comment": "Malware payload", "value": "b1500a2fea112193955b58e89ba2c688", "object_relation": "md5", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349254, "uuid": "96e49b9a-1c21-4635-a0f0-42ab9a3432cf", "comment": "Malware payload", "value": "978f952fc500407cdb2269be7e40be46845c5461dc787b29258f4e42792b4afe", "object_relation": "sha256", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349254, "uuid": "3b6379b8-b4d1-4110-a245-38141fe4e1fa", "comment": "Malware payload", "value": "e576283c0140d4e5fa33d732b212a8034a43d11f", "object_relation": "sha1", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349254, "uuid": "c8dfc27e-1251-4f08-8e01-888eb20ef151", "comment": "Malware payload", "value": "d84042ccd034092b5ded2979f26f8676a6f6fb3235e9f6cd49a5b77aec18c02f07854fe4febcafaec2f08b32b6730a1c", "object_relation": "sha3-384", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "62-60-239-118", "colour": "#F7045A", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349254, "uuid": "6ccc6a4d-c458-449d-855b-5397c9ccafd2", "value": "T177F42344E421F40DEF464FAF1F120F06FE6991E67C3E59A5623903B086B0B2E9F16A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349254, "uuid": "3d44cf74-dc6a-461b-8193-5b3d9db2fe62", "value": "12288:oxOB0lx3gd7rnoXPG0EmB1MLYOoPWLhkkZQHy3bJYs8DVZFn3vfZFOhWu:oA0lx3e7rnoXO0T1ML8UhpFrJHmZFn3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349254, "uuid": "8dab52fe-82c1-4609-a9aa-cb000ae004d6", "value": 751160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349254, "uuid": "8c9b69ed-a886-4d13-9c76-9eaa50152df3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349254, "uuid": "921c58ab-e114-4896-9e59-bba5693c211e", "value": "Ordine acquisto ODA25002173.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd96088-ba22-11f0-91c6-42010a9c0006", "comment": "Malware payload (SharkStealer)", "timestamp": 1762331805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331805, "uuid": "b3c00415-b149-4cb1-b85a-897f517c1896", "comment": "Malware payload (SharkStealer)", "value": "4c44cfdb59732e763af97d5c450966dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331805, "uuid": "e24ccd0e-c355-4222-a2a6-ab01f8ac1a20", "comment": "Malware payload (SharkStealer)", "value": "98512ec65db9895f9fd7bddc254567ecb91f36ba50a35702fc348db3a05f81d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331805, "uuid": "8844fc56-93d3-4257-ac63-55e391902938", "comment": "Malware payload (SharkStealer)", "value": "ed5878d82566506dbd72e33ce483ebb35cbdc57f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331805, "uuid": "33738c59-81e6-4dc3-b6a7-4c88940a5c9c", "comment": "Malware payload (SharkStealer)", "value": "43579232a8856068aa1dff613c968a4a671e9e38632b7bc755874d7ee4470e705b6df972eb82d3ea85402191246859ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331805, "uuid": "6d758bdc-51e4-4ef1-86ad-dc4109bf1331", "value": "T173C61294629C01A5D0F5C778C6EA5813F63A7C144B7AEFFF02A196162E366E1CF39720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331805, "uuid": "a1f6e822-4236-4eb1-bcb1-ebe3c2951153", "value": "da7c7889a9af299fe69cc0665690e327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331805, "uuid": "0253647b-a8b7-495c-afc9-567bcc419963", "value": "196608:czVQAyk2voHU3KXdPD3VPF/OB5s158ka+4drj29pOHq8C7vHqetRJeYMR:ZAC38ZbCB5s/JaVmOHqXHqetRbMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331805, "uuid": "08febf68-9afa-470c-b3ab-3d19e853c935", "value": 11926976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331805, "uuid": "95fb49ac-37b6-4482-82d1-413cd32f892e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331805, "uuid": "35db3b84-d227-4851-ad22-653270bbc149", "value": "98512ec65db9895f9fd7bddc254567ecb91f36ba50a35702fc348db3a05f81d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f00567b-ba29-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762334622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334622, "uuid": "6a8eb7fc-9f9b-4206-9e69-10802d87ef49", "comment": "Malware payload", "value": "59103dc39dc36e20f2d4cb50fa584261", "object_relation": "md5", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334622, "uuid": "cbd070d7-4689-404f-a7e1-f9d14a6bdb8b", "comment": "Malware payload", "value": "98908da34699f6f9bfed46e8c7be9dc06a55e6721a9c06c8df74178ca1125b6d", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334622, "uuid": "24db131f-d339-4938-9a8a-1cce9b467576", "comment": "Malware payload", "value": "a44164046a70a6154e3fe8b2a0ff502022b2539b", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334622, "uuid": "6ff66a6c-5a4a-49be-b290-2bfaeeae96c5", "comment": "Malware payload", "value": "d570c33f925940e702e0c24e006758b5c23cd39bdb16703edc4a6c18002e5edd8fb174261005aaa23891196142ec3ec5", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334622, "uuid": "597e50ba-ddcc-4eae-b89a-f9602f31d8b5", "value": "T1BEF723D11DF8BDD42231A9A1245EAC2BBE036415762E5A71FA3603C130C2E4F6DF697E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334622, "uuid": "b5572151-2dfa-4f8d-9614-5b731e66f2a0", "value": "1572864:Ir9U+Jbqd9szywTwmczFoZsx9aOGm/Gy/ZOlFu/2zqRwbbaPuZafzC6LZdkjp0W:eBAsfwmGaaky/ZOlFu/2ziwbouZWl+pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762334622, "uuid": "0f8bf421-c2ff-4d2d-b77b-792afc4a62c9", "value": 74920571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762334622, "uuid": "c45cd4e5-0c8e-4d4b-bf99-2c025eabd957", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334622, "uuid": "2298f2c1-3f19-4608-a63a-a8524732cbf3", "value": "0c1dd768ebb6cc3cf48c34fcbba0e3afa06957f2ace11b648541577b3437eb24.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffe3fb1-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318625, "uuid": "e73e8225-17e3-4e91-80cf-f01c5bd60d26", "comment": "Malware payload (Mirai)", "value": "b55de51925819e0b671e105f265aab00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318625, "uuid": "ec53eb8e-41b1-4011-8bc9-64ff24ba89c2", "comment": "Malware payload (Mirai)", "value": "9a56bf4be4cd082973660e4790f07eb19afa3d944a3e170dc08fc7e3e07d9fdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318625, "uuid": "c881806a-dc42-48d5-adb0-16263b438f45", "comment": "Malware payload (Mirai)", "value": "8efcd743e10466a54a1cfbd88f8bf977e769d0de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318625, "uuid": "3417eee2-5ad3-40a4-bd93-95839042f83b", "comment": "Malware payload (Mirai)", "value": "ed4c2ef11caab5452a2fe011249a256739afb39c5d63e27cb7e049f7ccbf989ad64f91fc0b6da090353efe3554abc5ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318625, "uuid": "ae7f283b-5c95-4bd5-9854-03b4c2c246ec", "value": "T1C0C32902F98184FCC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318625, "uuid": "dd5c2b57-c3fa-4518-af15-663dce8d15f4", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7BgT9upmzQUAdojgaR/2N:eH3TghM/1weZbcnITeyosFAIxnJdhgJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318625, "uuid": "87d90446-0bd8-4ddc-bd5e-b387d203c700", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318625, "uuid": "4e371ab8-4d1b-4607-a148-5a921558e5d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318625, "uuid": "83dd8d34-58a5-47f0-8947-3d7644030c8d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394f84ed-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319634, "uuid": "dc59478d-db1e-4d32-a007-bb3ad2c0be6d", "comment": "Malware payload (Mirai)", "value": "3ca3c7d48c968f541e4b48be7731c5c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319634, "uuid": "9f3c08ba-9b67-4893-91c6-f140bc0c6941", "comment": "Malware payload (Mirai)", "value": "9b34712f6718ef50f305aae802f375353c6e8e9fe554022b6d1d44c73c6b8589", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319634, "uuid": "aabbc4c5-76e3-4590-a4d7-27b6800ad862", "comment": "Malware payload (Mirai)", "value": "7f1ac53bcbf904903032c383d54d2220bae674c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319634, "uuid": "6545bb4f-2586-4f88-a86e-0a55cbb27e3d", "comment": "Malware payload (Mirai)", "value": "910235702602a7639e968a0c83d0248007ac6e5d9c6efaf18fa7d38f885f8bc10f70f95a315b46e0f1f0e674d2b4c869", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319634, "uuid": "2d07501a-88c6-4514-af50-bafe199fa71e", "value": "T1D7835B0375C0C0FCC899C17557AFB636C863B07E1239B15A67D8EE16BD8DE602E6A9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319634, "uuid": "6ab55fa1-f00f-48e9-953b-88f28a19f8e9", "value": "1536:OsraijWT9kcRTSB5Rhg3/Y71GS3ih5pRz+IVhYEcYAXN0:3djWTZRTSB1661GS381z+IVhGTXN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319634, "uuid": "0e1ded72-9bba-43bf-baab-19d0bd527ab5", "value": 85728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319634, "uuid": "16733d20-5e4a-49d0-b16d-16e25cd7327d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319634, "uuid": "06bc0a7a-fc21-48ca-a751-0b60c4fe3b74", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd648a9-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318621, "uuid": "29153b07-8996-4715-8253-bf6d92cd1346", "comment": "Malware payload (Mirai)", "value": "75c693ebff412f223ce9ab7b9666cd10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318621, "uuid": "053733af-b31b-4fda-947c-c05faf628d94", "comment": "Malware payload (Mirai)", "value": "9c2a72d84b23f604f2b877e00d3af7080037f2d5a6fd4d857cb3d4786e9e08be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318621, "uuid": "8005dc07-60a2-46b3-852b-b7403ea3bad0", "comment": "Malware payload (Mirai)", "value": "db09797f63a21f50c999d5170327557b5d95c0c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318621, "uuid": "609566e2-a9b2-4c28-a834-ea172634fc5d", "comment": "Malware payload (Mirai)", "value": "a2033814a911e9432010efe0d38b0bd00d30b5a6d3819757dc447cb3a62e7865a390a45f45ab8338aabbe269b6c44a81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318621, "uuid": "bb0c1218-0cce-4284-b7ff-1862f1a3222c", "value": "T11ED34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318621, "uuid": "875af606-5f86-4d26-b280-30ce902ebe7c", "value": "3072:lCldeCsOs9kzj2vV4NcZgqxiE230IO1BlsT3jDA:APeCK9kzivVGCitymTTDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318621, "uuid": "39322417-fd89-403b-a7e8-e2ea8d35d6fb", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318621, "uuid": "06a314c2-96b4-4327-9ca8-20bb87746d3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318621, "uuid": "2f6af6f2-acb9-44b7-a11b-e8b4085b0856", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b33bfb6-ba11-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762324415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324415, "uuid": "d472e484-0ab6-4489-b066-eca0851a4130", "comment": "Malware payload (AgentTesla)", "value": "080e33b6579f04b3fcac2718e4d77c5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324415, "uuid": "537b1208-f081-483f-986e-6fb8a5da7483", "comment": "Malware payload (AgentTesla)", "value": "9c3ad2c9b081bf1aa51d44a440c25fd6884f08dd8a965625de8d0312173c51f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324415, "uuid": "fabb2bba-5969-4550-937f-bd2811652b4a", "comment": "Malware payload (AgentTesla)", "value": "f5ec3568a805962913fc8d74ff00bfe8b7cc1246", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324415, "uuid": "199e18f6-18dc-41ed-bf1e-3e5684e3b345", "comment": "Malware payload (AgentTesla)", "value": "dad02083d782ed6703bdefaeed1c3d4251d048753a0a0f6afd550c1a8bb160b7846608aaf3d561b498d9a515f7be466d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324415, "uuid": "2fb4c2f4-3e5f-46ba-8f1c-cea31c421c5c", "value": "T13115122A5AC64817C66C8A77C07151285370DCABA143E3EE5DC867F4BDF3B6ACE53092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324415, "uuid": "3178b6f2-0c3f-4661-a2cc-b662ae9e071d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324415, "uuid": "cf4abc88-d31b-46ed-a2a6-858c078a2b0f", "value": "12288:bnUAK2q5b9XjilseLYBhXrMeT7e7yIw9LNg9ZunLPKstytYyn37lrzdlqLPHTVH8:jU/2ges9re7lw9Wr8SB7lXvqzRHKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762324415, "uuid": "29221453-b1c5-4d50-8044-a10409e23579", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762324415, "uuid": "e2b97095-fef6-412d-80ee-1ef540a762a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324415, "uuid": "97c49fdb-e98c-4396-8ecb-f477cd93a0e7", "value": "Ordine_100078670008860000052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c12e8c-b9f8-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1762313553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313553, "uuid": "dd05ac7f-0a94-4435-ba33-fa45c26c64c2", "comment": "Malware payload (GuLoader)", "value": "2ca12a121c0b8b56404f046551cb37f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313553, "uuid": "7d6d6775-f108-4353-9d38-57764d970f18", "comment": "Malware payload (GuLoader)", "value": "9cadf5999c3b712b48c5fa330d5959c5d9a5bf872d79ea04a246f3d27efbcc07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313553, "uuid": "e0092c52-353c-4b6d-a442-7498342e5d16", "comment": "Malware payload (GuLoader)", "value": "d1d435cd656cab13682237d02aaeeac0c8b87eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313553, "uuid": "05ceac28-18d9-4109-a2ae-e6ffa63d43d6", "comment": "Malware payload (GuLoader)", "value": "eb94ff19e151d1d46ec6f8a6a3bd84db6d86959b10b8a59b34cb4a88476f5cfb870d909b292d2806fd1cefd5b3fc14aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762313553, "uuid": "978664d5-709c-4d57-ae66-a6659732fbad", "value": "T1B4052339F6A5C403C7A19F715DDE989CE5E47FA214A5472E2F103FAA6E34B52C90E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762313553, "uuid": "f3f9294e-85da-4a6b-afba-46f2d3cbed14", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762313553, "uuid": "b269eee2-bcd1-46ee-9fd2-bd5ff87f686b", "value": "24576:5MwSXXwTFEa52SWM7Cc1fmP7khz1zuc7JK:5MwBppdH7CgOP2z1X7JK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762313553, "uuid": "26ee40ea-54f6-428b-b31a-b884d28cc17c", "value": 845768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762313553, "uuid": "ee284115-f2a3-471b-8dd5-1b49bfeced40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762313553, "uuid": "d1156613-fbd6-4aa4-89fa-ac4e464310ff", "value": "04112025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0d9daa-ba2f-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1762337298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337298, "uuid": "20e05649-b734-4a17-bcde-5cb8bb0a9743", "comment": "Malware payload (CastleRAT)", "value": "b2d494b1c71d1fe1a71126f2851ddbef", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337298, "uuid": "bf70377a-dc86-4616-a02f-325f66fe4ea4", "comment": "Malware payload (CastleRAT)", "value": "9d356492e433e068c5e71f73638180e3f6a5d992e55ad496a8dafa5174e0a827", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337298, "uuid": "537e1ece-7066-4960-b9ac-ba0822f0bfcf", "comment": "Malware payload (CastleRAT)", "value": "e3eb0264fe989ba6cfa08da6a7d6f60d63d19bd4", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337298, "uuid": "f8b1575c-7f34-4767-b0a6-7d8b097839a8", "comment": "Malware payload (CastleRAT)", "value": "fa57cd7c0b2cf14ec3dbf344dbd15746c8a30f0e527da475902901ce71c36342401c8b3ed0518944a5a44974a39c15dd", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337298, "uuid": "19f784eb-c60d-4bcb-b86f-2e8a8e6667e8", "value": "T12CD65C6F766186A8C35DC13FC0A38F45E93370B91733C6EB93A402686E569F05E3E664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337298, "uuid": "3e81275d-88d5-40cc-a7e0-d8d074346247", "value": "de6273c02bd4519d211a58c54c890cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337298, "uuid": "7139e13e-c6c9-4047-a6f3-4edb054a0e4c", "value": "98304:oRkyhrOHMsfh0V28cni6GB/amOtQEQ9evyAY807dQI:onhr/spCrcQB/7O+EQ9exY80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337298, "uuid": "38c6383f-2644-49f4-8b18-089cb53514e1", "value": 13041664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337298, "uuid": "5a3019ad-cfba-49f7-a05c-c16c571f40ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337298, "uuid": "50bdce7c-7de6-4a03-912c-bc03a122a30c", "value": "9d356492e433e068c5e71f73638180e3f6a5d992e55ad496a8dafa5174e0a827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5827a1e2-ba21-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1762331282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331282, "uuid": "ebbad38c-cb6a-4320-9a7a-080e0ed1a183", "comment": "Malware payload (GuLoader)", "value": "53ef72dd73b77f036bf092078d3844b2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331282, "uuid": "5fcd87e5-d687-4283-8427-40adbbb44f1e", "comment": "Malware payload (GuLoader)", "value": "9ddb59c316b28544619bd9f2e09d8869ab9a4a60251f3afcdc2c37cbf3152963", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331282, "uuid": "d97c069b-6490-468c-a46c-1ebb2ae6d1c7", "comment": "Malware payload (GuLoader)", "value": "1d664f0c7be1daf415aece83f56cea78c30e3655", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331282, "uuid": "806fb180-2bad-40d0-96b0-fbe2b751746b", "comment": "Malware payload (GuLoader)", "value": "4af15edd6a0a8c088c880a70087c11bff6ec4f1b76ab2c2af9f6599039ee224354f61db47bb1756fbd29edfffb4db7b5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331282, "uuid": "fc61aa24-5e06-4d2d-bed1-ea0c9e2484f2", "value": "T1C341F6802D82C7FBA0CFF0DE92C787916B8921BB6C197DD3106D990162BC370261C9BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331282, "uuid": "985c6caf-14e5-491d-a431-a9fbd5ee464e", "value": "48:ZSPw1tR0sX6XAHrOwZOvLZzAZA7qjPAqb6PZMAL8YCzsIgrLg:ZSPEtCsXeALxOvLZcG7qjIZhT2sIYLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331282, "uuid": "a6ca71ba-958f-4868-be94-8066fdcb7c93", "value": 2229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331282, "uuid": "4e846428-16af-4e3a-859a-d514ceedd26e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331282, "uuid": "6ef86f99-d346-4b13-81d3-c6ae02548a61", "value": "Zam\u00f3wienie zakupu.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9aca82d-ba45-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762346907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346907, "uuid": "7f141e97-6056-4763-9519-60eedc5fb501", "comment": "Malware payload (Mirai)", "value": "023d70d12e3f67ee3661f6ae9fef673d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346907, "uuid": "392ce39e-5935-4a08-9a21-1b5c612e6f07", "comment": "Malware payload (Mirai)", "value": "9dfcf12cd2a67572f917c855211da7c65355b045af76125242e7ea229c7fd288", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346907, "uuid": "8523684a-9398-4edc-ba9d-6d98da0b315f", "comment": "Malware payload (Mirai)", "value": "c3dc8f425e519167605711ee62cb9c06528c17d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762346907, "uuid": "024d2cdc-a0ab-4b14-bb1b-fea3a7e3ef9c", "comment": "Malware payload (Mirai)", "value": "6aeaabf6ae7b56f7b61365c770639769be2713d8125020e99ab0c17d57880603778538495a63af3cb3dc97dbd6505489", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346907, "uuid": "14e95896-2c96-4b11-b22e-ff5b18340299", "value": "T190256D5AF2B374FCC167C030836FDB62A835F46911226E7B25C4DA352D62DB01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346907, "uuid": "36bb6723-ab96-44d1-b91f-613db54af306", "value": "24576:8yO3LQCQL3w+NND67JPfH0/WOCOVzc9lD:8xgw+NJ6lfH0/7COV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762346907, "uuid": "1c89d783-f24c-438d-9527-47fbebb4d947", "value": 992320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762346907, "uuid": "3d944013-06a1-4578-a59d-da8e81d0de8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762346907, "uuid": "5b01ecb4-d517-44ad-b60d-f843334ada59", "value": "Mddos.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440504c1-ba58-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762354870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354870, "uuid": "e1204c70-d0c4-49c9-8251-5ba865a68269", "comment": "Malware payload (RemcosRAT)", "value": "54e4f136ed5612316fc49168672e02ec", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354870, "uuid": "d9ed18b6-7b02-46b4-805d-1919dd9fbe35", "comment": "Malware payload (RemcosRAT)", "value": "9e4dbd6dce5071580c8398b77d0724d1471367e8491f95f43ff832d5e20711cb", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354870, "uuid": "b506cb06-2584-4a4d-99c8-acbf5017cdfc", "comment": "Malware payload (RemcosRAT)", "value": "60fdbf8e0102b1da6da84b02f85ddf396280df9d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354870, "uuid": "792e8136-53e1-419f-a09f-524260e16a1d", "comment": "Malware payload (RemcosRAT)", "value": "7b7cd5b00248ec85f0540696a63209f723172438e3301d0305b6baa37de327faaec390a718cc1e9af9a6c3ed863e9396", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354870, "uuid": "1736799b-d0fe-430b-9314-2803a2eb4426", "value": "T1A8A370F29BBF21E76A1F329DBCD505D08B788DD5433250F9A5891E0B3133D68A27A139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354870, "uuid": "cb3cfc6c-4fe4-42ff-902c-2cb5dce25619", "value": "3072:R7rShlpT1l7DL1TTsVq8ReKvkLP8wjax4qU8W:R7WLX1vPKvkLP8SS4qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354870, "uuid": "805d086a-655c-4eb6-a3fb-8a3db57bed9b", "value": 103706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354870, "uuid": "17c5f3d3-f8a6-4a44-afdb-3e2531874f22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354870, "uuid": "5e2095c2-7102-41bb-b134-5bc8b690a3b9", "value": "Pending Invoices.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e430c46-ba66-11f0-91c6-42010a9c0006", "comment": "Malware payload (TVRat)", "timestamp": 1762360847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360847, "uuid": "dbbc28a9-deeb-49c1-b6a6-35d1f6cc088e", "comment": "Malware payload (TVRat)", "value": "b00eb3dada796cdfc0ff6389868fbccc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360847, "uuid": "c8b8d23f-da82-4aeb-8576-7d2643d8a835", "comment": "Malware payload (TVRat)", "value": "9ed3ba7d0c447b2ed220f00c5378e0c5be67e6818592b3f0ab61ff1a311fb2c8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360847, "uuid": "9860b965-df21-4bfa-87a2-f556ccd1d04a", "comment": "Malware payload (TVRat)", "value": "a122ea5ae106647fe3957c16126567608ce3ca56", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360847, "uuid": "d849a141-5062-4ea1-ada3-1edfba85a163", "comment": "Malware payload (TVRat)", "value": "1006a784a6f57d576e79b9a34d9c07782c149381e1c95bce51391ea0cb22e8731655e5353e8e5fabfd46ad53a4524d31", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360847, "uuid": "959333d8-2b08-4977-8788-b83dd0afde6a", "value": "T139B63306B3C10071E51A7A768A6225C1ACAF7DF728F5A4252CF8CDDE4E3786764B18D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360847, "uuid": "7a75ac1a-d717-4ba5-b8ef-0d1f1fef0818", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360847, "uuid": "4af1de5b-bf0a-496d-92e0-399b78807bd9", "value": "196608:bKyiIegGIbJd2PfhtgAN5QcEwzHzhiYBYNllBMzXd/L4r841WB134CNQFMoGJ0xj:+dIegnbJ2ptgi5QcEQiYByr0yM/fuM3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360847, "uuid": "271be23e-f3ab-4a22-8646-7e4cae7298ca", "value": 10990371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360847, "uuid": "bc1f04ac-35aa-4a19-9d35-ca802ac59e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360847, "uuid": "243c5337-6a26-48ae-86d7-53791a297387", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916a7bba-b9e8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762306897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762306897, "uuid": "e396aacc-d45f-46ac-a3d2-63369b3dec9e", "comment": "Malware payload (Gafgyt)", "value": "e98a9c62a8b69682574a0a0df6f95e86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762306897, "uuid": "16c7fa73-9459-4269-9931-571ffb3fed92", "comment": "Malware payload (Gafgyt)", "value": "9eeee17aa8af792b2f84ce3532df1a3dd60b3c469f5ae703171e9e81806edd8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762306897, "uuid": "9861bac0-6526-4dae-b76a-2c6e4e9024e9", "comment": "Malware payload (Gafgyt)", "value": "bbef3e361198adcfbf3044f605bc7c1c14263bab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762306897, "uuid": "eeddf12e-ad07-45a2-84fe-343aa58b620e", "comment": "Malware payload (Gafgyt)", "value": "00ed4cb8cc7f35080e9db9076672ff894153cac7dc4af4fa2786c454034178d354b70f4a7621f9b2984b32231066cb67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762306897, "uuid": "fe8cd2b8-672f-446d-b319-36614fac986a", "value": "T1ABE34C09F7408B57C0D22776B6DF524633239BA9A3DB33069524AFF43FC27A94E22951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762306897, "uuid": "603f1227-7bf7-4078-8021-09ef8317bd32", "value": "3072:Tdbmn8aAEHqgSkano1DTAh5hWTGHJWM/9lxXmpwTsL/QMyn:he8aAEHKkdDTM5hWTGHIM/9ldmpwTsLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762306897, "uuid": "de1fb438-c835-44e2-8e59-b711e2b06fab", "value": 154520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762306897, "uuid": "3b389007-38a2-47e6-80a9-73331d94d826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762306897, "uuid": "9e92554a-8733-48db-b3a3-5e89945871d3", "value": "hidakibest.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32807117-ba54-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762353123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353123, "uuid": "4ba80fbb-1a93-4358-8db3-dbaf9d2ad641", "comment": "Malware payload", "value": "b23abefdde3614a90fc9c2cf5dab1dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353123, "uuid": "1358c4a6-ad00-4d60-846a-33c4a4a69013", "comment": "Malware payload", "value": "9f2c20cd50b8d601575a1a7256806d50ac2679581b049a95b65f5e10b8ae790a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353123, "uuid": "de4127fd-1288-436c-90f8-0304682bcd9a", "comment": "Malware payload", "value": "f81c914da19a8b47a3e1ea143318852628f5dfba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353123, "uuid": "0e61859d-040d-486a-8eb8-df279470575e", "comment": "Malware payload", "value": "542f81b853b616581e80ac557c9b7f8fe885d4b99f15a78f50f128153df8ea6eabcb27192d7c02e75ebf172636aa6504", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353123, "uuid": "2bc8dda0-d4c0-4cb0-b1bf-8af9d7e7d7d9", "value": "T13BF42D7E5962912AEA4E80FC3459476249B1B33B03B41FF701669131271B9B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353123, "uuid": "0eb9bb60-848c-42b1-8b4f-9a781d2fdc14", "value": "12288:ZSj/lwadZsH3PVSqNU4IPxAY1olP/DLXeI1dG0k9UYNSh1Wmvz:Qj/lBsH3PVSAw5KV/LG0k9UYuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762353123, "uuid": "8208c767-075b-4248-af75-73f29ce65e08", "value": 794240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762353123, "uuid": "38076bd3-c60d-4f8a-996e-3c9c94afbc45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353123, "uuid": "ca45d98f-cd52-4199-af30-d4d2d2d7b4e7", "value": "lincense.ini.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b23835-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319592, "uuid": "c9cfd2e0-0ae7-4eb1-993c-710362ef5d3d", "comment": "Malware payload (Mirai)", "value": "ad46d93414d710a27796b86507a932ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319592, "uuid": "59a81810-8b26-460c-8294-f1c666d13fe3", "comment": "Malware payload (Mirai)", "value": "9f7f8208568981c9e22f9499b9aab95d317ff5d8518182ff59f99ca6ee2d4f3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319592, "uuid": "5a0f939f-005d-49c7-baa0-a4def2151124", "comment": "Malware payload (Mirai)", "value": "1569474d42344920b78133de6b03d41db0cc4b52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319592, "uuid": "90aa0f95-ad9f-4577-9ec1-eb335bd5cffd", "comment": "Malware payload (Mirai)", "value": "0434cf783d35652da01650ea19134f558d0d489e71cdb6f2627e6885e699f4d23d338513e663970cd48eeb685dc32312", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319592, "uuid": "dc23e6ec-fd03-4ef7-9a20-644b749e7369", "value": "T17D33F691FC82859AC5C057B6A72E568A73B2A3E4D2DF3353CC584B1026C561F8EB7E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319592, "uuid": "69c48dbd-e868-4288-9812-32cac2beb512", "value": "1536:VghW/cAGHpK367lJjnnJ3PTZhlHcFwGB8:qhW/cAGJK3OJlhlHUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319592, "uuid": "ceda142e-f349-451c-9089-d10c40da483f", "value": 53752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319592, "uuid": "79ccffa4-b54f-49e1-bd44-d0cff657cc60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319592, "uuid": "9f90c246-875f-44cb-b14b-1b90d5ef4e83", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689ea18d-ba5a-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1762355791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355791, "uuid": "2df15504-6620-4247-b8f2-6aa4b2614ce6", "comment": "Malware payload (SnakeKeylogger)", "value": "b5001006015a30aee2c31f80ff3ffda0", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355791, "uuid": "62d01da8-1fb1-4d0a-af64-21ea09a6ecfa", "comment": "Malware payload (SnakeKeylogger)", "value": "a225f13eccf11f06d3b27100ae30b46d09f21f0afb0154617c3d94906bfbb619", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355791, "uuid": "786fbf8b-2835-4975-8319-865ac4760aab", "comment": "Malware payload (SnakeKeylogger)", "value": "07630ebde399845e1f6b88565fafbe73391ece0a", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762355791, "uuid": "d7d99cec-b66d-4e33-b67b-81fd5382cbfc", "comment": "Malware payload (SnakeKeylogger)", "value": "756c0bb99e75361b4162295bf9a4a5b17021592f6d08fbe6df9691cff646f60917c2f03ace8880dd0295ecee8af00740", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762355791, "uuid": "3c43a0bb-a450-47eb-83bb-352f18bd38fa", "value": "T1D1730297E4B3497FD064B6C71BA760385DF6B9D0012E251E20C84FF61B1A9EB605CE6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762355791, "uuid": "74ac04bc-e20f-49c9-b7b0-0c72261b6115", "value": "1536:KcyMeGCM6cTGtFH/L5+0Xsw4VpdH1giRay4y41dUmTvuvdZm2QVsC:KcyMeO6cTGtFfL5+S+pciREd9oxQuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762355791, "uuid": "580d53a1-ff34-4acb-9a02-110b93f7f45d", "value": 79642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762355791, "uuid": "b7c4934b-7b2e-4727-8b88-11160ff1de11", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762355791, "uuid": "62428430-b166-4ffb-9fd4-0b152d439b61", "value": "Payment Advice-11-04-2025.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19212138-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319580, "uuid": "83be1391-4679-43ff-897f-98ac46b53019", "comment": "Malware payload (Mirai)", "value": "1df76e3d03e7d4eecd457fe8b3ec5a1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319580, "uuid": "79f844e4-6b34-4f7e-b85b-438fd657d7a6", "comment": "Malware payload (Mirai)", "value": "a23e74fa97fb64554e8b99d89395a587a950d1124843027e1f30d24aa32a67de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319580, "uuid": "74bcbd57-086f-4735-a0fb-bab95e457985", "comment": "Malware payload (Mirai)", "value": "da2dbd4b5ee5f44a4754d3fcead9ebd5fc188755", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319580, "uuid": "73f8921b-a4ec-4132-b2d5-bf3cfd93cd5a", "comment": "Malware payload (Mirai)", "value": "64c593f9d90a45f70bd2dc82d853af9bb3fc92bc7f57f59042cd2af69c1503f8c895fb59b371e29900c79018f1cf166a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319580, "uuid": "84d9af87-e6f6-454f-b5c4-135a24b43c5c", "value": "T1EC8328C1BA8BC4F5D80748304067F33FCB32E53940A6D65DEF6A9E26DE376416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319580, "uuid": "40e566fd-63da-4a35-bb18-35f7b7801631", "value": "1536:UMpfl9OnpbStfCVh5W4HIWRawsK2oXcK6W2EFI9z:Vt9Kp2tfuh5BgXK7XX6TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319580, "uuid": "f444c3ff-8808-4be0-956f-7e59a1db246e", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319580, "uuid": "c9639326-8f9e-4da1-aa37-8bfab018aece", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319580, "uuid": "ad5ca23f-6e43-4b6b-8d9c-d9c15883ef39", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57ed65e-ba77-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762368402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762368402, "uuid": "ec1e05bd-e3f0-44fd-a7ce-72f8eea69f34", "comment": "Malware payload", "value": "4d16adf1be3d1e5330ba70a9ee28b75d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762368402, "uuid": "839b391b-f58f-435e-b124-17f64cc38e43", "comment": "Malware payload", "value": "a2677edad28346f8bb1eae1b477d70b082316ae69a1e1da76a2863fc3cd6433e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762368402, "uuid": "5ab3d460-0d82-40a2-a2bf-6e322aab0b58", "comment": "Malware payload", "value": "129969a678dbf7433d0d9eddc44de43d5f5c1675", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762368402, "uuid": "012f616d-5396-4a6a-a5d9-29cd6955039f", "comment": "Malware payload", "value": "1e5b1200154c7abba9633a842aa1291f2fbb86723a5e690fa36a7442e24b4f45c0bec0915d3b2e8298fb3c346ca37528", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762368402, "uuid": "d257814b-952f-4263-ab5a-dbcc8761c941", "value": "T1EFE40BFC02A7EF65AE68214DF05D008534F35F679EAE118B79311AD72E275820AB4F6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762368402, "uuid": "2ad54833-f372-4537-bd6f-d02c68c1bf87", "value": "384:mx44NYBhIE1sGYKyslrM/PaBFE0KIAC1l2MZF8c4HxDX388vGn82OmrM/PaBFE0I:mi4KSy+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762368402, "uuid": "32edd95b-7ad9-4560-909e-daced1e00108", "value": 703398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762368402, "uuid": "5d8c13fd-2fd7-4dcd-840b-6a4117e5f365", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762368402, "uuid": "b59f1b77-ca3d-4391-871b-e3223a750e20", "value": "main.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059a9999-ba13-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762325130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325130, "uuid": "cdb4509a-238f-4074-a51f-c3fd5ed5b380", "comment": "Malware payload (AgentTesla)", "value": "a926890aeb8b28dc6daac375f6b2b608", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325130, "uuid": "0315edca-5ef8-47c1-95be-74e679002f04", "comment": "Malware payload (AgentTesla)", "value": "a2a5b76e8664d7b13773344f89d7a21d1ca2bea353eeace4ac32960e9fa25555", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325130, "uuid": "81106418-f5aa-46de-8063-d0ea92c11d53", "comment": "Malware payload (AgentTesla)", "value": "3151f6806dc1c4ef298ce34c0f568e0ec8caa0ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325130, "uuid": "03f21156-f2d6-4374-8bc3-65dc95ed0404", "comment": "Malware payload (AgentTesla)", "value": "9b217e21ebd7dada648bb923be7d7058c722053aafbabb3e86200252e5dc34fe155688e95bfe59129eb7ab24d123cf7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325130, "uuid": "75130a1d-bdcc-484c-ac1a-f4a9e247bc34", "value": "T17D25E092A3148916ED9453B61173ED7A02A7BDBEBCB0E11E69DEBDB33B737820405407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325130, "uuid": "5701bbc2-cd71-426b-8997-78bf79e13426", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325130, "uuid": "70301a31-4f64-455d-af64-71232d6ec0f5", "value": "12288:vWjJcOT2QmqDEi2Nnk2aPCsSw/r3yXQbhFa4SxtPi/30oIonwX2ROX4c8qE2:4cYmC2NkNbjb2Q9xSxt6coI3P4c0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325130, "uuid": "fa5bfd15-ef2a-4dbf-84ec-c66ba62453fc", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325130, "uuid": "cd613820-e709-4ac1-bc75-1a6d6383be6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325130, "uuid": "742b033f-f6c9-43b3-aed1-f0432cac79a1", "value": "PO#2306060147 95000K New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e018d1c5-b9e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762307458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307458, "uuid": "73850d71-de46-45c0-897c-649ef8e024f5", "comment": "Malware payload (Mirai)", "value": "298ef0317beb4d6c3e1f1dbe1ee6f244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307458, "uuid": "1029ab94-6519-4766-a95b-43d46ac75431", "comment": "Malware payload (Mirai)", "value": "a3876a2492f3c069c0c2b2f155b4c420d8722aa7781040b17ca27fdd4f2ce6a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307458, "uuid": "63abd47a-7d44-4b63-8452-d92611f36cbd", "comment": "Malware payload (Mirai)", "value": "a45ca236442a7ed36ac9dec298fb2eef7766652b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307458, "uuid": "774b33a5-de60-4934-adf0-938ab2b05b21", "comment": "Malware payload (Mirai)", "value": "186316b3b2e040a04563421ab222af6ce35e6f6f4405c32870c652c634936cff3baeaabdfce2b874207a452363378029", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307458, "uuid": "51222665-7b51-4830-82a1-4fb3d197adc1", "value": "T146936DAB6BA0CA74E4D1F9741CC7C2A25DB138F087199287B309C523A9CA7C55F1D39E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307458, "uuid": "cea15ca4-a57e-457b-be05-fde8c3bdddb4", "value": "1536:tM0lfe89al+7K227YtXeMyO4YUwnZ7hUOfwjFqKF:tM0l19al+7K2mYJxPxV7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762307458, "uuid": "7d1a0aa3-27af-4132-bedd-101ef2568661", "value": 95624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762307458, "uuid": "baae89a7-5fe6-4323-b330-9059ef56e35b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307458, "uuid": "a9b4f30a-03ce-4e6a-8241-7a9b886d00b1", "value": "nvd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063fe845-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319978, "uuid": "360447fe-30bc-4071-b91a-78c2442c4bc4", "comment": "Malware payload (Gafgyt)", "value": "4d8d9bbaf3b3899c055a1cc26977e0a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319978, "uuid": "aa256e28-6275-4527-b2d7-b4e029115733", "comment": "Malware payload (Gafgyt)", "value": "a40b1b7e86805276ee1ff9526f81bc1324a3aa02c3776d349bd65e79da67fb31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319978, "uuid": "67159238-5042-4c38-b40f-c7726d1c8441", "comment": "Malware payload (Gafgyt)", "value": "927c69d205262a06f2117666e9e953d5f16bdedd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319978, "uuid": "bc8b1da8-9408-423a-9e65-7d96f434e085", "comment": "Malware payload (Gafgyt)", "value": "ed0e66182a03600f380737c0a44100561770969a06cea427d1e189f8781b84a1d700802f6237992563a9a365209173c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319978, "uuid": "3b777834-87fa-43b1-9225-0fa55378eb6a", "value": "T19FF34279B7619EB7D80FCEB301D94912198C968742E93FABB2B0C528E75B94F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319978, "uuid": "c0511cb4-6d87-42fd-8c3a-df46bf21c621", "value": "1536:kreTQFZYcQivgV6IMrZKr12UEkgkgDXd3Aen5hvqplDD:kLFZYcbIA6R+dL5hvoDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319978, "uuid": "5e4532d7-4073-43ca-8774-e579d6c5c9ad", "value": 168340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319978, "uuid": "aaa62d01-0cfd-4a65-80b2-4659ddc7db61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319978, "uuid": "70788383-6470-435e-8fc8-476b5b10d9d0", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97a432a-ba56-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762354209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354209, "uuid": "b16f1fd0-794b-4eee-b6fb-99998d0e5450", "comment": "Malware payload (Mirai)", "value": "852c155e67ee7588cfd2f9970354d1a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354209, "uuid": "719767b5-65f5-448f-9460-e8b83e49d2c8", "comment": "Malware payload (Mirai)", "value": "a51819e212c049709751756483df85444604781ea025bfed0d4b66a716bc96f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354209, "uuid": "e9815be5-2ed8-47d7-b9e2-162b38b05fd6", "comment": "Malware payload (Mirai)", "value": "631d6a4c1bf121b70b310b064555dabfa9807654", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354209, "uuid": "fee1f3f8-865f-4c11-a403-b9d11a95faed", "comment": "Malware payload (Mirai)", "value": "6b9b068dad2f407404e323792e3594469839ff5923c20ac9fd735e111a958bcc23f1966a0497be08cd326dc6480821d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354209, "uuid": "88647486-ce55-4033-bd48-38ec7af78a2a", "value": "T14EE46C5377228F94E361D67005F38B655EA421A30AF390C5A3BCD3207A51A6D6C6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354209, "uuid": "d5330bbb-f82f-47a0-9f33-c94748d6436a", "value": "12288:DEehD4g/FwrPwqi14WbFDZSLAYniMr+Z2m/+vLZiQO8p559wEAM:DEg4g/iPwN7hZSLAO3r62wmLZim/wG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354209, "uuid": "1f661f29-761d-4590-9e73-4a6ecd2fc781", "value": 718492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354209, "uuid": "0d29b63d-b001-4459-bcc6-93c5686fb018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354209, "uuid": "e53a8f67-4d98-44f3-aa84-6e799294a29a", "value": "Mddos.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82f3a42-b9fc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762315632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315632, "uuid": "2fb7b87f-604b-446c-8f29-108c2d3c1b85", "comment": "Malware payload (Mirai)", "value": "6e004292f5afd20d76a95085b297b2e7", "object_relation": "md5", "Tag": [ { "name": "89-110-95-186", "colour": "#F1C79F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315632, "uuid": "fa461bcd-36c1-4854-ab93-6257f7e79cf5", "comment": "Malware payload (Mirai)", "value": "a7e448a5fcffc3c9459f66b0e17bfc8c902d4d622afabd5d8f926367aa499d25", "object_relation": "sha256", "Tag": [ { "name": "89-110-95-186", "colour": "#F1C79F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315632, "uuid": "eafcf6b5-c899-4752-b38f-4935d6ce61af", "comment": "Malware payload (Mirai)", "value": "7e195c30626af20e1d82cf7db0c3cdac4688235a", "object_relation": "sha1", "Tag": [ { "name": "89-110-95-186", "colour": "#F1C79F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315632, "uuid": "2e7962c6-b13c-45c7-9944-f88480c1f63c", "comment": "Malware payload (Mirai)", "value": "519a28706ec7dc9c70182f5ba15bdfd4f04e0163d06aee25c43f4c7d456b2446b49f4bf0d0d8676adb38640601ff9ca8", "object_relation": "sha3-384", "Tag": [ { "name": "89-110-95-186", "colour": "#F1C79F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315632, "uuid": "f642e10a-7506-4e71-93c3-3f6738436508", "value": "T146430755BC929A12C6E422BBFA1E418C372663FCD1EF7207DD216F11778A81F0EA7650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315632, "uuid": "40a1678c-3cbd-491e-86de-5edcd449fdd0", "value": "1536:yLA5Hwb/QJVIO/ndsya5Fit5YBgbWVBQ:yLA5HwW/dbaWb+4WV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762315632, "uuid": "feff2267-e461-4e3d-8137-72d4d83e5289", "value": 56032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762315632, "uuid": "552a00fe-30ec-49ee-8d35-b0d9957efa46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315632, "uuid": "319ddbd0-db5a-4012-84a1-f4d244aad030", "value": "a7e448a5fcffc3c9459f66b0e17bfc8c902d4d622afabd5d8f926367aa499d25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684aa3f7-ba49-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762348489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348489, "uuid": "2ae0effc-59ee-4b4b-8fb5-1c8beb614e03", "comment": "Malware payload", "value": "b12a45c4c7540439481ab30e8c777208", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348489, "uuid": "55bfbb24-6874-4b27-853f-24d73d849b27", "comment": "Malware payload", "value": "a81cdf516076f4e3798dfff393ce9d554740a9239de1bd54f6b571233573f322", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348489, "uuid": "7caaa8fc-5b19-42f6-91ac-1ae1636275ac", "comment": "Malware payload", "value": "1c411415d34da81636e1365bd1b7de0fe84607b4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348489, "uuid": "59715b22-8ecb-4046-b2b9-eedf9c965d42", "comment": "Malware payload", "value": "18bf3f84c64402946e3c472f8a979c23adb2bca14be31a5a6f85fbe1b5bb78c4d224d2614a5c1e4072caf3904d4e0477", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348489, "uuid": "b78fe5bc-967b-488e-b37e-5e687a5cd804", "value": "T1489533D72C20D168D7CF82BA9D4278735D41366E00FAE9CC941A81ED7FDB3A597E2881", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348489, "uuid": "7960aa39-5c0a-4527-a84a-787fb679017a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348489, "uuid": "09764052-346b-4c5a-ab0f-904139629bc7", "value": "49152:7ha6kwri6ajopB2cGNC9QLtj0cW3I5/EwVEXusCZA3TS7y:NaPSiPwdGY6J0vkcw6us+A3TS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348489, "uuid": "ab8efa5b-36c8-46e4-b453-75f4934b32ca", "value": 2046976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348489, "uuid": "e3c759d0-211e-46e7-bf9f-91d8fdc83cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348489, "uuid": "dd6eb1dd-4501-4f42-84a3-aab0eb413dbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72d9a37-ba27-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762334126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334126, "uuid": "debc3bea-9134-4b33-8a61-e841c23287d7", "comment": "Malware payload (DonutLoader)", "value": "96adb4020616092a33f06e74eeaebca7", "object_relation": "md5", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334126, "uuid": "65603532-f097-4875-bf16-4d2c738ff0dd", "comment": "Malware payload (DonutLoader)", "value": "a8756ff9efb824282d9b2db61b8269dbd14ceea05dcb4f22bfda3a379d61781c", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334126, "uuid": "94f18f9c-3be7-498c-a2e6-ae4c2a4b0e3f", "comment": "Malware payload (DonutLoader)", "value": "9eee2f799d4d076521cd39c7be0c6b4b4587d6eb", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334126, "uuid": "f18284bd-7c71-4903-8294-1e514e58c59b", "comment": "Malware payload (DonutLoader)", "value": "567387865086f0e0af41129e9ecae3a37d722147662495ffd726d9381e34bfb103cd42c307db25a594ea102f51272aed", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "p-i-attorneys-com", "colour": "#B2CEDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334126, "uuid": "4d851e36-e9f2-46c5-b3b1-5877c1e7a2ba", "value": "T18BF73316CFCE886341632F6BD4D85C191366EEFB908E106B91AEFC9AC2758490077EF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334126, "uuid": "dbad13d7-daa0-4082-9472-88d3e8554ff9", "value": "1572864:f4vv8bwhnQn4rpUuA/m4JD1zWanGO4AQryMQkQAPw5I377zN5L5LTg:w3UwO4ro/tJ43VryokonLxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762334126, "uuid": "2b43b002-bb61-4f4d-9d89-7bb3d7cfb3cc", "value": 74815632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762334126, "uuid": "aeba9a9f-f565-4251-8a4f-f888a1f7ccc3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334126, "uuid": "f7db65ce-c33a-4a66-b3b7-5f3398c13f13", "value": "a8756ff9efb824282d9b2db61b8269dbd14ceea05dcb4f22bfda3a379d61781c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87237a51-ba0f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762323630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323630, "uuid": "413e8f6f-2aad-4164-9a36-f3b8cd896520", "comment": "Malware payload (Mirai)", "value": "5e35b0a8f2d1167edb00acc47df67a24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323630, "uuid": "2df225a1-736e-4985-bf0a-086faffe0f0f", "comment": "Malware payload (Mirai)", "value": "a883eed629fdda419da40097b13eaaf470003cad9053f3ed17f9b71cc6a7f527", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323630, "uuid": "35acd856-fef0-4eae-907c-ed0156369efa", "comment": "Malware payload (Mirai)", "value": "9a903690df39da0590a065644477011482ea824e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323630, "uuid": "db746a38-2776-469b-9176-fa768671abf3", "comment": "Malware payload (Mirai)", "value": "87cb2e70447daadca34880e860ba1b5ca0cbd39dbfef9c04a48a30615b1ed5b1e5a68479640b0d626d07f7b8da0f932f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762323630, "uuid": "1827139c-b96b-408a-8b20-f1e7ddec4757", "value": "T12AA2E119BF18868BC832693551D9EAD61292FC61F2DCCC096940D16FB4A33E96474F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762323630, "uuid": "c1c74f13-07e1-4140-bdab-43cb68aba717", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKp:O98o08kxofBE+ZkXaqGbp2F2TWul0c5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762323630, "uuid": "aa1296c4-89d5-4419-9318-cb1d27baba17", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762323630, "uuid": "85a76f63-9cd1-44d1-839a-5aaeed441439", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762323630, "uuid": "f95e4443-4e0a-41d7-b7b1-f3f3af46f135", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d39930-ba84-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762373986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762373986, "uuid": "f1e9a9d6-56d7-406c-85a0-a37ef15cac9a", "comment": "Malware payload", "value": "b09639b8a140e9054391cc5f6fdea078", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Trojan-ransomware", "colour": "#465932", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762373986, "uuid": "a98aceba-8af3-45ed-b455-12b6990415c3", "comment": "Malware payload", "value": "a8960262124d83146569ead055a7719be9df1190f2df8b2915ee17d9e0e54f68", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Trojan-ransomware", "colour": "#465932", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762373986, "uuid": "51309a7a-2f84-42a9-83d6-16ca238b0329", "comment": "Malware payload", "value": "ff755a3bfd7819fb7d6678268be222b80c7f5825", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Trojan-ransomware", "colour": "#465932", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762373986, "uuid": "872c8044-305b-4235-905d-c4bcca0dfa25", "comment": "Malware payload", "value": "be5f1a3efca7b47d8b226680ea165958b98ed2435e26c9b828779efc7fdad8e11fe5a4be1c99b2ee367e9e971c97ec4b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Trojan-ransomware", "colour": "#465932", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762373986, "uuid": "2295c1ec-5d22-4ec8-bb62-717abdbab8f3", "value": "T137C2A81B1B5A842684D7D3A2C85BC592EF3491882441058B33DCD0F7971F1AEFB6BF6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762373986, "uuid": "bad49d8f-eecc-4645-b2e9-60ae39ce28f8", "value": "384:jnSpHfXdTwhq3nwfP5zCpiOSFdgA6VguA6VguFolRdBFolRn+73nw0PPYCogJdjE:TSpHfXdTwhCivFd3/Q7pNe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762373986, "uuid": "93142eae-f30e-4168-ac5b-d00d0fe6c9bf", "value": 27287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762373986, "uuid": "917b1573-e493-458d-a556-1f39d04c34e6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762373986, "uuid": "63ddbb00-eab7-4cf8-beb0-22c6f1bb88e5", "value": "Updater.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89ffbe8-ba6a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762362770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362770, "uuid": "4a5dbbfd-5199-4441-bd0c-a5ce5d92a288", "comment": "Malware payload (Mirai)", "value": "217044ee6850f304f494a59129845696", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362770, "uuid": "615e65a4-7df3-4f79-a537-8f74c4cd7ce1", "comment": "Malware payload (Mirai)", "value": "a8d167485985a6bdc9433deb006639186d759d20b3b902a0cca31644caacf467", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362770, "uuid": "8805ff51-e590-48f4-a898-424974bd6510", "comment": "Malware payload (Mirai)", "value": "a9d83fc7766f5f281809a23641f95e9a87ac61d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362770, "uuid": "27658d71-ac59-41f5-8d79-be57f422ff27", "comment": "Malware payload (Mirai)", "value": "0ac5221c2587329d696c004ad1f0ee9339fe028fa6fbf98a9f3c662e4290ec807cfc79b5f14e6bd37bae081f83b3b8e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362770, "uuid": "d99d6e4b-26c0-4813-8fec-b8d48a4d1466", "value": "T10B256E5AF2B370FCC167C030436FDB62A835F46911216E7B25C4EA752D62DB01B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362770, "uuid": "8bf10388-27fb-4366-a362-bdc126034220", "value": "24576:4WIN0NM50h8pZxnrNF64MkpqZfr8q2S/mTS:4pWgPnrf6TkpqZD8q2S/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762362770, "uuid": "9304df09-122d-4fd8-85cb-3b476dd1982a", "value": 1000512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762362770, "uuid": "85c649b2-8e79-4200-8770-5068931af45c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362770, "uuid": "47a33b6c-468c-4826-be2a-e3abddbbae83", "value": "Mddos.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b67741-ba01-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762317529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317529, "uuid": "19288fb2-25d4-474a-8b4e-ae29d1bd91d5", "comment": "Malware payload (Mirai)", "value": "75c1e0b54536ab73b32846d4895deb67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317529, "uuid": "828c9907-19ac-43de-a1dd-11d58a760214", "comment": "Malware payload (Mirai)", "value": "a8da53fa8bcca6006e8f8647a7bab31f7be8214e707675f5dbc71fbec7145329", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317529, "uuid": "12abc5ca-cff7-43fd-a35c-27dfbafd75b5", "comment": "Malware payload (Mirai)", "value": "3dc0ef9059798a74a2acc3e00c1c13ea37e2bbca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317529, "uuid": "f9fb7f30-1356-43a6-b69b-46e56146e216", "comment": "Malware payload (Mirai)", "value": "d5508de3402fcc4c14981c6a42905a266281eed819ca3c8a36dad059dd94119fb1e71a4fff863b569fc5a92c63d0ca54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317529, "uuid": "fb7a50fc-f5df-4801-b089-4a29471007a0", "value": "T117C43855F8809F61C6D535B6F74D42A873074BB9D3EBB2069A245B3037EB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317529, "uuid": "a8d5bf6e-f2f6-4f38-8749-2ee252edf253", "value": "12288:pU5GfeoSHDDgKTUN4ccaWmHHTYZbW+b93kQHHXH/r0gCxMh8pXkCq:pURUN4+TaZbBZH3HWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762317529, "uuid": "a81422bb-abc4-40c5-9bed-6e2730c5b84e", "value": 596172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762317529, "uuid": "de368312-461e-41d1-bfab-88a908f8a465", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317529, "uuid": "f4cbde1f-b1a8-455c-97ac-cb44873b8fc2", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651eab88-ba9a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762383273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383273, "uuid": "918e34af-ee55-43e9-9e5f-abf73f9958a2", "comment": "Malware payload", "value": "fa74109bf935320c8075c420bb5118a0", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383273, "uuid": "ff497581-bda3-4d32-bf5e-6e9e31ded32a", "comment": "Malware payload", "value": "a905be90fb26cc410c1a9ceec7ea59b934625188233e82ab486d05a900e18ed5", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383273, "uuid": "5ac93073-c43d-4ebf-9b43-185403ad2948", "comment": "Malware payload", "value": "ad3f3cadec2e96b761c5b48d4b7ce4e6a8000ee4", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762383273, "uuid": "99b78194-73a4-4e71-b1f4-7be971c07de8", "comment": "Malware payload", "value": "4d33579eec54e5fb468f9f8321f1c044c64dba3f2ed01dc686dde6b7a7d859e510a5012a9bb1f86f411577fa7b409629", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762383273, "uuid": "85f04838-0d18-41d3-948a-710470e0ddfe", "value": "T1A6541241AD96F051983E325E72E2638AE53558EFCD109D811EF6AF8B145FA8E2E8D304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762383273, "uuid": "09d14178-521a-482f-afc9-b25c7cf10d2b", "value": "6144:o5vs1EpGPtkF3o85vs1EpGPtkF3o85vs1EpGPtkF3or:ohs1Ep0231hs1Ep0231hs1Ep023o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762383273, "uuid": "7582f934-8d28-44fc-b71d-a9c9081debb4", "value": 294087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762383273, "uuid": "04bf05f2-4b6c-40f5-9720-33d0e91ebd54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762383273, "uuid": "df6c0f04-fe63-4840-bb2c-e3f2c84f5f83", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ffbcd5-ba98-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382575, "uuid": "94071889-e788-481a-820e-1729a3579e41", "comment": "Malware payload", "value": "f038fd59504f3aa1eecc50ccf84ede50", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382575, "uuid": "0af3025d-5a1a-4168-89aa-6302d2556d60", "comment": "Malware payload", "value": "a9ad367c3dfde9ad69ce2e1648938abd1ea714a5b4b8fef80db8543c1cff28cd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382575, "uuid": "2000f8be-74b6-4470-8bc8-a35d32ba9273", "comment": "Malware payload", "value": "a573ab03eba1a3141e002ec07b22556988842699", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382575, "uuid": "70f1023d-c21f-4421-a1ca-96a273f6b9ab", "comment": "Malware payload", "value": "cd97dd935ff327ac3c4b3e2b68e20105c9934da3544053082b7acc114ad4ef3f89c0cfbe6feea73898eed802d467cc64", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382575, "uuid": "2c38c5ce-bd16-45c8-b702-cfbd1209517c", "value": "T1ECC56C0778C0646DDD99D23A85709297B634B8358B2123E32F1A63B91E3F3C27AF5746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382575, "uuid": "ab1ebdcd-8cae-4ccc-bf87-d5afc2762bf0", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382575, "uuid": "662d2ad9-2ffd-48a9-b02c-7514dac98d2f", "value": "49152:NpuMmlNrQTqYmcCgJEmblcDxo5D1EzlWwI7Tfkv8T7:WMQL1muDZzlWwI7Tfkv8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382575, "uuid": "14f51ecf-f8d6-4713-8041-b8d8b8d431f3", "value": 2531816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382575, "uuid": "70abf693-fc0a-4dc8-8247-b603e323778e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382575, "uuid": "9913fdb7-7a22-4b25-b055-96125b7fab54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f92f93-b9eb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762308107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308107, "uuid": "d723c2cb-44f3-489a-a436-04c31717e4b1", "comment": "Malware payload (Mirai)", "value": "c051495a09546270be8d42454c72d4b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308107, "uuid": "3cd22c4a-9870-4c08-858e-e8f1c087460f", "comment": "Malware payload (Mirai)", "value": "aa5605453479a0d56c7c6bea4cadf52fb62eb0e173512e2f920130f651106f6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308107, "uuid": "b42673db-742d-43be-ba77-bfbadd3fe137", "comment": "Malware payload (Mirai)", "value": "36db46634da7a1124a22ce6c07b39a58bf3cbb13", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762308107, "uuid": "8c07056d-ea4e-4e75-90b3-b47f8645c75b", "comment": "Malware payload (Mirai)", "value": "a06223a22da7123bbe4fa7b9a419e4b1d602d4f2faaa80d49af372d9c5ce48dc50fc0957d2539d912bb2aaf62a27a870", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762308107, "uuid": "f8fbc5d0-1747-485d-b398-729425a6987d", "value": "T1D8412CED13801F7A341A5A24A3E359A88D468FD0B24A575CD5893C1B9C4F61C7BF9D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762308107, "uuid": "c07a3279-033a-4181-8a32-3a46e03cb3db", "value": "48:YI5d7spa5nhdapwMZBCZ+VjRj7AF3OHSZNr4:YwBEWjaGuBg+Blcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762308107, "uuid": "c8ef234e-329c-409d-b604-ac1f3c7bbc4b", "value": 1987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762308107, "uuid": "fd40a0cf-faf1-4cdd-a2a7-80fcb61316d8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762308107, "uuid": "87a0fd3b-345b-43a0-80c8-6a28319e4be7", "value": "imcuming.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f041222-ba3f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762344178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344178, "uuid": "46d77390-5f0a-418d-99f0-8819170b98c9", "comment": "Malware payload (Rhadamanthys)", "value": "193458c62b0454e597508e5ad5698c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344178, "uuid": "890c24f7-c162-4f2f-8216-feb56f9973c8", "comment": "Malware payload (Rhadamanthys)", "value": "aa5f9a756310b14d1fe637a33f2347693dfbb81a4c714ba760bed9f7dd2ec739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344178, "uuid": "15af0a97-08af-4abf-8675-097c03ba7082", "comment": "Malware payload (Rhadamanthys)", "value": "0d8fdc722843572b078dacb56ebe0a64007df34e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344178, "uuid": "6beb1afb-dbef-46bd-840d-5ea88c77efae", "comment": "Malware payload (Rhadamanthys)", "value": "ee99cdcad8ce9fbe7e2699035d8b7c8e59a555a5d24681be46c6c789b122e74b5b04ec1f5ae0801db0ce10ad7192ea65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344178, "uuid": "e94eb9d8-5fac-46f4-abdf-e3c9e53af4dc", "value": "T11785239B6FD40032D0A863B62DF9114B187ABC628774829B931076CD59B2ED4D9733FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344178, "uuid": "046451d6-95e5-4b48-b32e-8dd9fb9cba6a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344178, "uuid": "b1689ea9-d88e-4f42-94d4-ea0aab1b474c", "value": "24576:qfy0vvW9JVJ4ImCKdLGPn+iyEDgn0y4BxbmpO+BCfmdFd1x0MDP3jyn5aMGTI/XP:l02VcCKamoB+ofOxjy5Rr/XezFo75+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762344178, "uuid": "2ecfddf9-1400-431f-9a9b-7681989598d1", "value": 1851824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762344178, "uuid": "4360de94-4d52-4551-8266-45009ed97940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344178, "uuid": "a660215c-63fb-44cc-9827-612ca13b2955", "value": "Aura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca5e92f-ba12-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762325089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325089, "uuid": "4502ffe0-d6db-4127-98b3-d50f0824e66c", "comment": "Malware payload (AgentTesla)", "value": "9c3b487757afb5e97774cce1a6fca348", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325089, "uuid": "41158beb-3d63-424d-9568-68e6b204b94f", "comment": "Malware payload (AgentTesla)", "value": "ab0dc350db685bb8649aa0c94009340a6c3e696ff005fd886beb478b4fe4fe23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325089, "uuid": "6f821acc-c446-4cab-9d81-f8515ba805c0", "comment": "Malware payload (AgentTesla)", "value": "32affedb1ede70fd27a87a2f641c459565cfc7dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325089, "uuid": "88dedfa1-52f8-4e3f-a7c1-e4e5bf3f6ad1", "comment": "Malware payload (AgentTesla)", "value": "4e292ca1fa90b6c38911cb5da88ebca0590945ef749a9617edd9b89afa050292bb9d19ff46feba5109aaf164ea99760e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325089, "uuid": "ab53e778-3e86-450c-a66f-ff6a0a1798a0", "value": "T19E0533F9496B8E0AEE1EE6BC57C107915C96290B7ECD7FBB47CA00EA6C6C55102F044E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325089, "uuid": "5e7d0f28-51b8-4ae2-bf59-4f3c7e1f8bb1", "value": "24576:aTwccV/tgwt6qJVNI08DQ3nF3CxJRn54FfT/T3rk:aHcVlZJvI0b3FGh4F7Trk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325089, "uuid": "ce06779e-d536-4f65-953f-812907cde9e8", "value": 845201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325089, "uuid": "26decea4-c6bb-420f-ae2b-e6eaa51b42bd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325089, "uuid": "1f63b328-1385-4b43-8269-eb32005d7afd", "value": "ab0dc350db685bb8649aa0c94009340a6c3e696ff005fd886beb478b4fe4fe23.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191f8336-ba13-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762325163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325163, "uuid": "0d52ac93-384f-4e81-be2f-597245d9e70e", "comment": "Malware payload (AgentTesla)", "value": "b880085acb8d907c1d0047c056d1eebb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325163, "uuid": "ad932080-0ad7-4294-91ef-250032f17591", "comment": "Malware payload (AgentTesla)", "value": "ab4b2a4d87385bc2573b5664961fdb18345cc858b15ddd2502dce14b6281e3ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325163, "uuid": "feafb670-be9e-43cb-9e38-6780cf48c70e", "comment": "Malware payload (AgentTesla)", "value": "1ea6a25f8e3c17c49d2d9360bea4ccafe114dbd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325163, "uuid": "2f04451b-4e1c-48be-893d-443c7799249e", "comment": "Malware payload (AgentTesla)", "value": "349c497787d71cec2ba8d83c0446ffaed782757d0b1676dbfb77d7a2b4c95a5de253907bfd4fa3c2a71a4f3caf75610b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325163, "uuid": "1d97fefc-ac4b-4c5b-94f0-c6eebbdd3b9e", "value": "T15045F11189C86FB8CFAC9A1980BE161EE3E04A8B445B7549FB37BD46BFF794841071D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325163, "uuid": "7dde7d11-b392-4a42-ad80-e2713ea3b5bb", "value": "12288:eBq5Iuklun24yMt91UST3JKFPNt2H4dHHZzNmr5AjH5wOA6q1Whk/S9Sv2QbcBxu:rD2pMt92372YJ5UNAjH5UEhSrbNoyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325163, "uuid": "a2d4a2ac-cc36-470d-852c-9e17350b41de", "value": 1237806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325163, "uuid": "bac72b9b-784d-4d01-8ef2-1778870ddd89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325163, "uuid": "c1ccb237-0919-4c78-be77-ef94562d30a7", "value": "ab4b2a4d87385bc2573b5664961fdb18345cc858b15ddd2502dce14b6281e3ad.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c827bf3a-ba98-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382580, "uuid": "0dd1fd17-a62d-443a-8cb0-69cbdb323f58", "comment": "Malware payload", "value": "da6d4a8529058e5ce65beed78671f4fe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382580, "uuid": "e469994c-4662-4caa-8d13-38c7f1e38fa7", "comment": "Malware payload", "value": "ab8f4508595ecd0edace13c58c19bb0a2759256712769850bea3474968ab97c2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382580, "uuid": "5d17222c-07fd-4dae-994e-baa328fd8548", "comment": "Malware payload", "value": "8f1358f125b7e1bb398f5e0232e403c1638dae32", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382580, "uuid": "8d906150-03a2-4bae-a812-8ce0a50e00d6", "comment": "Malware payload", "value": "a9cd681df05330e4cfa1fac219d37104b781bcad7dec0af9d29f69382bf6a6ed917bd6ff7273cb20eee4cc632b2ef6e8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382580, "uuid": "a7e2a7a6-2c32-40ec-b6c7-83e22e9378b9", "value": "T1461318053A98C26AD6BF0F7CB8B20E6152B29266C102DB453D8C55DE6FB3705CF1639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382580, "uuid": "0b7207ae-01ca-4d3e-84ae-c17f0dff66ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382580, "uuid": "e1078b8c-8fc6-436a-8fd3-423d2f673fa7", "value": "768:JCnWZWFTwL7wuikjZO6W9epHHolkgeIOt7BXAY0Q1C6XbYC1OkV0Y:JOpwLXzJpHHolkgVY31C+b1V0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382580, "uuid": "89753654-c55c-4fa3-b2f7-67b9102c2a42", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382580, "uuid": "b1673e3d-669c-4bde-843f-23edb052622b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382580, "uuid": "49e7da44-2c6e-40f6-aecd-4dfa9910c684", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2034835-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318628, "uuid": "3aea97a4-0e50-491f-ac5e-9fcd49d0f1f7", "comment": "Malware payload (Mirai)", "value": "2ec5d6be2642df6a035d0ae0a89f27ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318628, "uuid": "3cfd5980-782e-4152-ac26-e4ba9eaf6d1d", "comment": "Malware payload (Mirai)", "value": "acf729832751671ccc645af1efd3fbf2e41f6e0700dd93a40b8b09b4cd5f20a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318628, "uuid": "494903b2-4513-4db5-84e5-a9b7d0b4a6a5", "comment": "Malware payload (Mirai)", "value": "a3489fce84411d623c7c2fd4c0c478355ee161b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318628, "uuid": "f7f3a06c-7ecb-4ee6-b866-e83886a6ca65", "comment": "Malware payload (Mirai)", "value": "e65207da84890e69c2107badd1426f4fd6435a247329d9839d6623abae4e7f21ca02cc7c60ff21467fb53e7e1f570159", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318628, "uuid": "c6b3cffa-dc82-403d-986d-c215a5e5b45c", "value": "T1B6F3C50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318628, "uuid": "2fb053a1-8731-4d2a-9c10-6dabf79bf9ba", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiw8:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318628, "uuid": "3f6cdee7-2810-477b-8b1a-c30958a0594a", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318628, "uuid": "f7eb9294-46e7-4203-821d-beaa9602c849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318628, "uuid": "0a3d566e-64fa-49ed-b7e2-0c4884689337", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575cb79b-ba01-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1762317537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317537, "uuid": "437f0d54-58f8-4869-a9aa-3b8076c8c8de", "comment": "Malware payload (CoinMiner)", "value": "d99c605b5a2baff33a2d458fb85c3f06", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317537, "uuid": "de960b62-d6a5-4a60-994f-87ce120ff371", "comment": "Malware payload (CoinMiner)", "value": "ad4d76cd6c16e1e923a9fc4120b353debc2ae9ff5c493b2d260bdba3a0b13c8b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317537, "uuid": "4b1365bf-bab1-4ebc-ae0c-df90704a0e50", "comment": "Malware payload (CoinMiner)", "value": "848447212d467be24d4fa6629f139ad361f55d95", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317537, "uuid": "09b14c08-f344-4636-aa2e-6f6ef435fbba", "comment": "Malware payload (CoinMiner)", "value": "cd631d536cd85ac4b70ad806cbc542aee10f44782d3c6f9c5ec5c8d5cd9d1fff684513f03e2c9920c24f976e5c3fbfd9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317537, "uuid": "cf22ef23-674e-4460-b33f-54f862461dae", "value": "T1E946F168F3133D56C8DC583E514AAA446741ECAB39EBC2C73E71506EA8ACE305B67374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317537, "uuid": "61839f7d-a049-4cf4-b492-21970f227c8e", "value": "49152:up4Yw0xJYHX1IxrCST7iAMNv5aqCQyVO+OCfX6/5JU020isYrc5MPIIPSmeK92uc:MYHX10XibN3yrC20iblI7meK92u7R1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762317537, "uuid": "b0b622ac-47c2-400b-9527-f27c8ab0341a", "value": 5813160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762317537, "uuid": "2850d7a4-73b4-4102-996f-0942e4dcf1d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317537, "uuid": "2e45c1cc-ee25-4d18-a09f-8a6493aed284", "value": "xmrig.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabf096e-ba70-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762365458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762365458, "uuid": "8277915e-68c2-435f-8ad4-fe4832b3d372", "comment": "Malware payload (Mirai)", "value": "8426392bc100d63ce9b05b6e6ecb18bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762365458, "uuid": "5cd096ac-77aa-4d68-8619-4909ba5e1111", "comment": "Malware payload (Mirai)", "value": "ad4dd945e70dbad172e6316bc83205e0da18b7c0ae5a7d02f120471bcd0242a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762365458, "uuid": "d127345d-1a85-4dce-84a8-f7c032714c22", "comment": "Malware payload (Mirai)", "value": "cd220e3802521b4e64fb84802ae775b725b6de82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762365458, "uuid": "06cddac9-18d0-4e5b-abcd-af33da270b3a", "comment": "Malware payload (Mirai)", "value": "91728eaaecca96ecf6f3828dacc1c9c531bda254053bcc86c048512071a88f38fb4351ac62950b2d6eda4e58517aef8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762365458, "uuid": "ff9642f5-b9a3-40a2-a4de-712bb0949988", "value": "T176D43845F8809F61C6C539BAF74D42A873074BB9D3EB72069A145B3437EB96B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762365458, "uuid": "b0869f40-d9d6-43c7-960c-bb8879ff95a6", "value": "12288:4f+qbaWWZMTV4zCdS1D/0A3CEVJcjk4oI297t48pVkChp:ImWWZMTzdscAyQJmkFlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762365458, "uuid": "b39ac771-42de-4ba2-9fd7-d6e9621d5695", "value": 604376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762365458, "uuid": "418d732a-7618-4517-8f9b-b247f442ecab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762365458, "uuid": "755c71f7-9531-43a3-a89d-f5607186cf9e", "value": "Mddos.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50c8061-ba47-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1762347785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347785, "uuid": "01e1aa37-72d6-484c-aef9-23f3598c240f", "comment": "Malware payload (Adware.Neoreklami)", "value": "d3ba70c41295e2a1fb231a87d17c9aa3", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347785, "uuid": "8c8d5a7c-b64f-44ee-b00a-7365bf0eff58", "comment": "Malware payload (Adware.Neoreklami)", "value": "ae408337e8b6e4aa50ac326fef3667a754a57bcb8d6af8470854cfd9de91702d", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347785, "uuid": "97fc19a6-e330-464a-870f-5d1abc80ddcf", "comment": "Malware payload (Adware.Neoreklami)", "value": "96e8381b3257c6105c8bad184febcbb5f87afea0", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347785, "uuid": "07caa1f8-b898-466b-a36b-c49c1a6ceb15", "comment": "Malware payload (Adware.Neoreklami)", "value": "df4b1660feb43608e8444338abfc2e79b961f78c47310d27fd4c58c32d4f426dc1965f34c2b80df3db8e3b0f449b05a5", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347785, "uuid": "7ccbee09-26f5-43d0-9abf-0b1876d5fa7c", "value": "T1FC6633533180CABBC50525705EF84FA065BDD6BC27620DB7A78E56286FBCC818E2973D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347785, "uuid": "4476bec9-5f19-4128-8c21-8f121e56cc17", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347785, "uuid": "ec257184-978c-4afb-a056-827d67d3b2f0", "value": "196608:11OO99PlrqP8wjXxK3271Tu4hTTlJ0ACFtJ5s:/Ocl2P8wjXI3OZBhrJCnDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762347785, "uuid": "7766136e-d107-4442-87b3-9e2bff7052dd", "value": 7073743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762347785, "uuid": "59e89681-648b-44b8-bcba-11a56a793ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347785, "uuid": "efeebe74-6109-4949-9fa5-71a69fd78abd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05a6294-ba4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762349039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349039, "uuid": "05ddcf17-3b90-4770-bb46-aa8364dcc64b", "comment": "Malware payload (RemcosRAT)", "value": "30dc0d90a1ff8e008a3aef5b3049b1ee", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349039, "uuid": "34794a0b-856b-4b4e-891d-3d6d78600f9e", "comment": "Malware payload (RemcosRAT)", "value": "ae4b72157878c56308cad85523d212c9f7fe236fd38f7b83ae55aa7e530341f4", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349039, "uuid": "bedbb929-7e87-442e-a99b-03fe7f3f20df", "comment": "Malware payload (RemcosRAT)", "value": "1cada374d56647825c1159284ff500971cf9cc9a", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349039, "uuid": "14f6e98d-e9a9-43c8-a3fd-6fdb498ac0b7", "comment": "Malware payload (RemcosRAT)", "value": "887e29781c20ab6c20c21eea9ab66d36074f92e0f493b57b89fc7679dce5862d839b94eb8f4fb2b702939917818bec12", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349039, "uuid": "c5521b8f-fa3c-4e42-9ea3-00bc0ae521f2", "value": "T14875E05AD9D0BD32C12B197CAC1F87E9B4297A503E25FA8769D65F0C0A3479EF0E1183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349039, "uuid": "5d81ed24-b6b5-4ede-a555-671210c347a4", "value": "edbf9c24038ed410f74ed1fd9f229a5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349039, "uuid": "bb0054c0-9256-4f85-a25c-9a6edebc4d98", "value": "24576:Or+6HvYXmCNgpOx/H78XTpTT0TKsQ2q0Q00dMb/tRYEmJTnC/ivk+/7H+ae9:Or+LEpzTVTZsQ2q0Q0djtcvk+j+ae9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349039, "uuid": "18389e66-c06b-4d14-889b-51a676bbacad", "value": 1650688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349039, "uuid": "e8755a20-e1fc-4397-aa83-7d4dbdbf43e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349039, "uuid": "3314a34c-c2f1-4e6a-8b0e-ca65094568e9", "value": "ae4b72157878c56308cad85523d212c9f7fe236fd38f7b83ae55aa7e530341f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f4c3fd-ba2f-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1762337182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337182, "uuid": "66952c2a-f6e9-4f31-bbb3-19af98f2e09e", "comment": "Malware payload (DarkTortilla)", "value": "6e47672f1bfb1599a063136003fd57ba", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337182, "uuid": "87dba5e8-d292-457a-bc63-74244a0d67f1", "comment": "Malware payload (DarkTortilla)", "value": "ae78caabec6a4241c64357ca5ca05de2e181fe253963de528807bf051fc3608e", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337182, "uuid": "e98682e6-a941-486e-8551-537345340196", "comment": "Malware payload (DarkTortilla)", "value": "697807696b6fe55e2398fcd0250cbb13a9b9bc5b", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337182, "uuid": "65e8483e-c791-4901-a80a-44aa0c94bcc3", "comment": "Malware payload (DarkTortilla)", "value": "ccd93f69170c3462eed63091667d947cccfafeb4582b82184982c66952247d6eba1cb8b98e6fbbce9636c360bb24f479", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337182, "uuid": "fe5c31ab-5596-413b-94df-483bc1077b02", "value": "T107E5232933D39592C6FD46F542214248E379ECB7AA0AD37FA9D8F1FC4AB32515346283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337182, "uuid": "385d17fe-4e98-4831-a61a-63bc220110a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337182, "uuid": "519add8d-d3a7-4860-ada8-54f71aeb06ec", "value": "49152:SwPqj4GDQEqNmXwjPuCFnVBEy+HIamZVsBsMHXg/24vvHx7p:JPjGym0uCFVCpIZyxHw/24vvHxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337182, "uuid": "c75cfa83-fbcc-445a-b9b1-e21aba2cf4e0", "value": 3233792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337182, "uuid": "730a851e-4b90-4162-92a4-f8ee1c951c30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337182, "uuid": "f2696983-d633-46a0-ac7f-04eb70249942", "value": "ae78caabec6a4241c64357ca5ca05de2e181fe253963de528807bf051fc3608e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3d19af-ba56-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762354218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354218, "uuid": "40f04f62-0cd9-482a-9c26-c2995c7d8b3f", "comment": "Malware payload (Mirai)", "value": "c635bca1624e245a1ddc3790d3572a2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354218, "uuid": "cfca172a-146e-443f-97d4-56e136daa0df", "comment": "Malware payload (Mirai)", "value": "aeef43f5c1eabdd34d47865b3d0401b88eb45e7c7828e6be4dbc24f15dbb040d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354218, "uuid": "dd55734b-6408-44b5-9cbb-4e34bf5250f7", "comment": "Malware payload (Mirai)", "value": "5d9f894d205d421d7b6832bdcbdc67e3730c4e13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354218, "uuid": "e4686b21-de91-4b47-a003-6a4405f376af", "comment": "Malware payload (Mirai)", "value": "e5724d5e0cb92657f49fbb9f1f3ff4cf7bec7fbfc4aa412f7ce63dc87f2d2c7940e53f6be2c6a7f7c0fbf04865ce6a29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354218, "uuid": "ccbcae24-f04a-48e1-aa4b-3b8ad7043733", "value": "T13E256D5AF2B370FCC167C030436FDB62A835F46911216E7B65C4EA352D62DB01B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354218, "uuid": "842165a8-eae1-4aca-9008-da882cd4b11f", "value": "24576:pqIpNLZy9sg6/bTcYJxtcuwYqURhEMmh2:pH7z/bTfJ/cuwYqOhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354218, "uuid": "2fa2dabd-7493-45fe-8331-83cc6454ae26", "value": 1000512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354218, "uuid": "4114ef28-dd71-4267-a75a-83b95a014177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354218, "uuid": "e32f50ef-3d3c-4267-a603-92073bde4052", "value": "Mddos.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0482c8-ba5d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762357171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357171, "uuid": "12fef123-770f-4be0-a676-46b7a96b3846", "comment": "Malware payload (Mirai)", "value": "62c04674e61926f858790d3529372e25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357171, "uuid": "204bdb83-fba6-41e9-9ef0-6d15c7f1cf9b", "comment": "Malware payload (Mirai)", "value": "aefb4b20ca48049784a56ae9bd35b4d4f2bb0377979471c1fc4f6673279551c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357171, "uuid": "39b082a9-612a-4273-9d63-fde896971953", "comment": "Malware payload (Mirai)", "value": "32221eb3c05b65d60f10fa6c93234dd4851a2478", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762357171, "uuid": "15f3ae35-8090-4e75-be6e-7e4eabc04b7e", "comment": "Malware payload (Mirai)", "value": "7dbcbe577228d3aec1f8bd6bad8bcd8aeb3487e581f59e2644d1484246bc0523628039a0a3b037b77b4a86ab8788687d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762357171, "uuid": "ea5d11de-c986-4fc5-a1ea-7f83440c09ea", "value": "T15164D086ED00BF65E4D161B9FE1F034973234BACD3DAB211E6249B2436CA65B0F7B185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762357171, "uuid": "dcf9a65a-2ca0-41b2-a924-f6e553916eed", "value": "6144:2IIKXhZtL7jOTyIG87XL5wKSDP99zBa77oNsKqqfPqOJ:ZTj8w6LDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762357171, "uuid": "568144f6-3508-4cc8-897b-dcbcbb356b70", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762357171, "uuid": "2947b4db-6681-4a86-a5dc-4fd395314c2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762357171, "uuid": "d5cdfd16-56e1-41b5-8fc2-c577b4baa3cd", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb17a60c-ba51-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762352091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352091, "uuid": "5df3f967-1acf-41d3-8dac-8272757c3d11", "comment": "Malware payload (RemcosRAT)", "value": "8d2af6cabc7d269d1a73dcf47919997d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352091, "uuid": "8549cad4-8e42-4257-a4e0-0d321ade28a5", "comment": "Malware payload (RemcosRAT)", "value": "af2fe8381a8dbcc5878e080919e5afe3354c1fd2080ff646e02f274d70abf6ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352091, "uuid": "bde86398-82ec-44cc-9b90-448923e0c49b", "comment": "Malware payload (RemcosRAT)", "value": "87e3feb7c6b245735af7f212631cfc06bf26e83e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352091, "uuid": "3a1045c4-41d2-4c4c-862f-9bdcde9e8def", "comment": "Malware payload (RemcosRAT)", "value": "413838ccb4a6b92ea548af4805d2769b0aceddf136571d5f2b58c4587c5c6faec8e0f9f8b06276df039c49d7254c6d41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352091, "uuid": "2f304a96-d5eb-4f32-9582-d00316f08dc0", "value": "T1711546EED8F07CE582AC2F53BD620E1E2B5A06615C243D468661B3E429F5F5A93DD00F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352091, "uuid": "f3671b55-1e19-4b30-889e-9a17e58b050c", "value": "12288:OkJNJ6z9NuOLGTo/t4r0rLXV/Zti7G55h09Smg5etOwKJ6G6XBYuxfQAxq:TJ6zmTet9LXU7G5z09nw/JNLUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762352091, "uuid": "59399a08-5eca-4a14-be43-7bd3fc66b43f", "value": 900047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762352091, "uuid": "bb8a37ff-cf93-4e45-b8fa-7eda876cf1f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352091, "uuid": "5bb6ebc1-0b1a-4b97-8a72-9265ad5cf611", "value": "PO NOV2025_1762289702.xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113aa2ae-ba2f-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1762337176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337176, "uuid": "2dff4954-8c1f-4ae3-b69e-24801e6ed704", "comment": "Malware payload (ACRStealer)", "value": "f6ebab2c29256aaca8f8b8b6da89e6eb", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337176, "uuid": "d9a99887-af08-4383-a880-0ab28c48231a", "comment": "Malware payload (ACRStealer)", "value": "af88dc52b37022583a6687214bb5e345b606c6a0a3f37cfe41576d89c3d8e65d", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337176, "uuid": "3fea730d-e68b-4f83-ac25-daacc6d15ff9", "comment": "Malware payload (ACRStealer)", "value": "cae987b47865e7956a5156b97eb4f4e36ef13451", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337176, "uuid": "fb568e4a-635a-45e8-8eeb-9e56ce1955e9", "comment": "Malware payload (ACRStealer)", "value": "6975dd432c953cb842698854f3153283eaf59bf734f40eba83a7ee189b421e0790048558d06544b3b6d6ae9174e19049", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337176, "uuid": "c48bad39-66cf-425a-b568-85bad6db9851", "value": "T1461633A1B868A972E66153B533F71BD019F21E07FF9BE0673869792809B37D81530C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337176, "uuid": "58a17dbc-b812-48f4-8890-97d42d4699fe", "value": "98304:oueNOQXpA8QPUURzt/B3VrJ6sfb7ZHg+tm2r5nA:oBNP5RQDL0sBY2rVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337176, "uuid": "0c5aacd4-547c-4331-a2fb-2535e7d92119", "value": 4132864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337176, "uuid": "c3e7e099-e6a1-488b-8e04-2f1d6b549715", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337176, "uuid": "fc95f6b0-2398-4f94-93e3-ba43fe6e34ff", "value": "af88dc52b37022583a6687214bb5e345b606c6a0a3f37cfe41576d89c3d8e65d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3d8645-ba46-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762347311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347311, "uuid": "cde2c86f-d731-4104-920c-79a85968a168", "comment": "Malware payload (Mirai)", "value": "a5429b0120a2731cabea069833858edf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347311, "uuid": "10f3e42c-73aa-4cf9-8051-31250289adb3", "comment": "Malware payload (Mirai)", "value": "afcd9a29fb2dc0c677c8dca15c32829b8f2bafed0d61150ec8d19ba74acdc588", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347311, "uuid": "67c77478-e492-41f4-a0a5-5d2e2b37f2e9", "comment": "Malware payload (Mirai)", "value": "f782293bb19189bcc702573a5e0f6ab426905a55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347311, "uuid": "012d63b4-a227-4601-a6ca-3a51d17d6514", "comment": "Malware payload (Mirai)", "value": "29f5f3f3ffd63e5a21308f0d415b0667c5b4e2f02b35f7ccdc3dffdbe1c3b1dc11fe486a22026b831306a3e8e3f83b60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347311, "uuid": "0e5a5510-eef1-471c-86c0-a3a8809f82c5", "value": "T12DD47D59FF0E3C42D3DBE3389B4A87A1622B75E4D32351727981421CD8D6AE9CFE1A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347311, "uuid": "b74d5993-bad7-4119-8a45-03b51528c41c", "value": "12288:YJnM5Da+t1nK0VZhmhXeV3ATtl3Wlvc2HPs52fJq3j:gM5zVtmhXI3mLy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762347311, "uuid": "1e1ec88b-44ae-4143-bea6-717cf393365a", "value": 641056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762347311, "uuid": "3b9adbdc-f2ea-4f40-ba04-96ee444db75e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347311, "uuid": "5e0c4c33-b996-43da-a14b-0ca1afb598ca", "value": "Mddos.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e60e0a-ba01-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762317533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317533, "uuid": "a1074e22-7992-44c9-96b8-0e5d6153936c", "comment": "Malware payload (Mirai)", "value": "de7f326e04a59dd62f827bdb9965a732", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317533, "uuid": "fea5c0b7-14b9-4c86-87de-1256f877c00b", "comment": "Malware payload (Mirai)", "value": "b00feebada36921de473baebf4fd736905e9f6ddc44070695e9195b6d1e0ca88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317533, "uuid": "2e04c37b-ac64-41c9-b254-7619304a5641", "comment": "Malware payload (Mirai)", "value": "80d1b391c846f286af6f469808ba240b60b0a158", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317533, "uuid": "39065e18-e7e1-40f7-bcf7-195823d72139", "comment": "Malware payload (Mirai)", "value": "bc6887ac85019b7d308af7b181808da54591c30f9860137ca1de8e8900156cf133bfa2a52bbf69c492548fbf97e1a6d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317533, "uuid": "4cdc6522-2ba5-4f5e-a000-6f8451015b48", "value": "T18DE47B9377218F94E361D27105F3CB259AA421920AF290C6A37CD7207E51A6D786FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317533, "uuid": "59b91395-d56f-4a2b-bc2a-190c5cad87bd", "value": "12288:myqJan4DRbegPcUbuJt2imJM7Xuo+8QFJugKmnC2/8pf/wBg7:myp4DRbegGJwimJMTuoPQ7HnC/wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762317533, "uuid": "b0c4678e-bc9c-43a9-a6bc-8f8c4e3408c8", "value": 710260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762317533, "uuid": "9415a94d-16ad-4469-90a2-bb25d6a6252d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317533, "uuid": "4cd30303-466f-4a43-8af6-5feeb8a623d1", "value": "Mddos.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d55cc8e-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319641, "uuid": "94137f7e-b40a-4f4a-8ed7-671557452a33", "comment": "Malware payload (Mirai)", "value": "4f017fbbb8e28c0ea87677ac994237e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319641, "uuid": "65a36ea8-cbf9-4199-820e-9bc6c1aec132", "comment": "Malware payload (Mirai)", "value": "b014e54593fda355cffba78161588f5a6863968d1cf2db37b6fd939a3866ac73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319641, "uuid": "ce22a29b-3429-4f6b-859c-2460881e42f5", "comment": "Malware payload (Mirai)", "value": "feac2ccc59ae5b97443a4e9d19d43845e6e95aa9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319641, "uuid": "8c9467ce-5ae5-43e9-a38f-bcd0569ef3aa", "comment": "Malware payload (Mirai)", "value": "affd8943ee0f3a423a403e57f7fb0603c30acc08b9bc5a7bfd8cdb6fbd74f024b36211d2237fbfca14b685d1b852a9c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319641, "uuid": "6311b613-d81a-4401-9d73-4dea32639419", "value": "T1ABC3F609EB610EFBE86FDC370AFD070525CC651722A87B7A7574D928F64A24B09F3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319641, "uuid": "b0cd02ba-ef7b-4a2e-b1ba-957b638206f9", "value": "1536:pOWeUSZ25TuMePxR0hFXlgguwHW2qDOUu3up+5iQ1vZZO2WNEMvlOKvj8tjlBqD+:0WeUSZo2R0x+k5iQ1Zdgjuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319641, "uuid": "5d083c5d-60b7-4b6c-9f72-de9ea637362b", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319641, "uuid": "7c527d63-4564-4312-b730-ef5b237a6731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319641, "uuid": "b884fa68-1c97-4559-855e-fbc7ce422fe7", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3090da7-ba66-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762361177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361177, "uuid": "35c7724a-4614-434d-bb44-ce2ea50dd896", "comment": "Malware payload", "value": "3154cd0289aee452e3c5e2dc1b0a6eef", "object_relation": "md5", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "KoiStealer", "colour": "#1D3760", "exportable": true, "hide_tag": false }, { "name": "TA4561", "colour": "#6114C3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361177, "uuid": "418b1b65-0901-4425-ac78-4cdad53c9c40", "comment": "Malware payload", "value": "b0aa17c8f1c66aeb0af5dc6c9c9d2bb0d591c07a133347e2a5a8fafa48f80410", "object_relation": "sha256", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "KoiStealer", "colour": "#1D3760", "exportable": true, "hide_tag": false }, { "name": "TA4561", "colour": "#6114C3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361177, "uuid": "03d684d7-6d68-42f6-b505-78a2a2737d79", "comment": "Malware payload", "value": "fce0a39169582124de7d5b11360fe43f31de86b5", "object_relation": "sha1", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "KoiStealer", "colour": "#1D3760", "exportable": true, "hide_tag": false }, { "name": "TA4561", "colour": "#6114C3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361177, "uuid": "86a16311-f371-453d-bc90-1c4677b82ef0", "comment": "Malware payload", "value": "28c35e39a737047a3feee0ae49d5700c38302e156ac071bd8c70e23a0728b021a4cc6df8743bd7f053878ec8ca86a74a", "object_relation": "sha3-384", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "KoiStealer", "colour": "#1D3760", "exportable": true, "hide_tag": false }, { "name": "TA4561", "colour": "#6114C3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361177, "uuid": "53480a29-3525-4d38-ae83-bdc0dc509c6b", "value": "T13811BB51B73D4261C994037233474788767C71ED2043E3F7432097FFA515550168F094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361177, "uuid": "5c81e70d-48ca-4c2d-b8d2-b858d5ef91bb", "value": "12:5jenC2EWw60PO8aa9oJweFMpTWjNvp4w2zcBdST8pwcRmijqMSQBCJDmi0jd2ARx:9WY3fPya9o/MhWNLZE8ecRP0uCYfky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762361177, "uuid": "f516cee7-6984-4146-b720-caa53d9ba59e", "value": 930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762361177, "uuid": "1243839c-bd1e-48d4-82d0-b435ff455b06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361177, "uuid": "9c924a8c-18a7-4f35-af6b-5031fdfecafe", "value": "chase_27_oct_25.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9b00fb-ba2f-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1762337462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337462, "uuid": "261ce6ec-ae71-4a0e-a79b-1dcf036e931e", "comment": "Malware payload (CastleRAT)", "value": "ab82a9477c8c2f6e1753f8903ff1f99b", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337462, "uuid": "d0624bbb-0100-442d-839a-094660c73076", "comment": "Malware payload (CastleRAT)", "value": "b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337462, "uuid": "c764b3b4-85a5-4515-9800-bcac8c1aea20", "comment": "Malware payload (CastleRAT)", "value": "f149d16af6a3e224cdad52a6d57f2b90522ca395", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337462, "uuid": "55d3f58f-45ef-4c5f-9240-786fbaecc167", "comment": "Malware payload (CastleRAT)", "value": "7b873fa3eace2b4ca0c9b4054631ff4995c7223236e7db9d8db1d12eee6d4da2002e2db03b06b43bf05dc4d4e0228f1a", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337462, "uuid": "aed51b66-a085-4332-9a5c-8bb845f81200", "value": "T1B0765B7B62A4826DC96DC33FD1E38F40D5F371B52B33C6EB429103698A068C59E7E625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337462, "uuid": "c2a70d3d-4f2b-421e-844f-efe4f716fd08", "value": "1c0dd8cf4de1b0654b64d6ba3da24259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337462, "uuid": "70a84ee1-d4d7-4867-a9c4-c0f396f5663a", "value": "49152:MCiAb9key/HOSt9/uW2P5asIOd0S0IBRQVvOIQrDM1jP4yIJgWXjjtJSbBNNgiW9:MpsZ4wbJ5zQQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337462, "uuid": "96c34c56-f85e-42a3-b70e-b85f45545097", "value": 7557632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337462, "uuid": "2bd2bc6f-9b79-4a4a-8508-5b28ab8160fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337462, "uuid": "2cc27013-7102-491e-a702-e8f7038f4a2c", "value": "b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8234ffc9-ba86-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762374732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374732, "uuid": "96867dfe-6ec0-4da9-bd64-06e1b25f5dd3", "comment": "Malware payload", "value": "6a1d8f0c2a3e41af85fcc78ebe4fea01", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374732, "uuid": "7b79a42a-4099-421c-9525-5d1f59a00995", "comment": "Malware payload", "value": "b0b780f4116aac96eabe742d51c043fcb9db148eb7838d8ea5997e0aa296d8e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374732, "uuid": "ae277960-3010-46d4-80a4-1f5efe7e3d3a", "comment": "Malware payload", "value": "336b55a9c516f1b0dea4560e056c1c076a6dd865", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762374732, "uuid": "31e3a937-8fc0-49f7-9969-5bb11ca788c5", "comment": "Malware payload", "value": "ad0a57cef17080882b526b6d6dce8f8c6c441347a85c7f7d43e8e2541b69138d6f1c07736f566242ae03a66ee36689ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "newest", "colour": "#AAA720", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762374732, "uuid": "e5f1c78a-fe4c-42e9-bbec-73785381cb70", "value": "T13D53CC0E5B6559238173B3768E479417FB2950671260E6063F8C93E22FB3058DEB2FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762374732, "uuid": "2068f064-188e-4519-82b4-93662a3df536", "value": "384:kWJ69p22D5/ra7afs5yfA6VmxA6VmN42FolRTXFolRZFjkhGKR2DF2YG0hsxtP4t:neWOs5ypsXP4H4vgppIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762374732, "uuid": "3ffeae42-e385-49f5-98ce-4589a2707862", "value": 66384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762374732, "uuid": "aa08fd9e-038c-46c6-90e3-e887975da163", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762374732, "uuid": "866aabaf-9192-4eb1-9ec0-d22d1f76a4e9", "value": "Updater.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0875d6ac-ba96-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381399, "uuid": "59ad1f06-4c4a-43d4-b925-5ae144d11863", "comment": "Malware payload", "value": "30a0e4128d53f3f70ee691b65140fe52", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381399, "uuid": "5ed0e6db-8e49-4bea-b6dd-6488569fe65f", "comment": "Malware payload", "value": "b0fffc6644fe612a8c96b5e1b871b018cdfbacd6d02e7eba60335723c23b21a4", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381399, "uuid": "dc67a1d9-fea7-486b-a88d-860b8656979f", "comment": "Malware payload", "value": "e5af6a2d226df0e5dd6b20e0ffa43a9065588785", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381399, "uuid": "eaff1f5d-12f0-42f5-9eb4-f7d4f76ba363", "comment": "Malware payload", "value": "c99fceb4c53faecafdf18b9f96ed272cc3faba2c28578e5a885d2e9478ced9f5dec84b103ddcb06f135ec9a7b4da27a5", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381399, "uuid": "f453642c-7880-40ba-88f1-4e27f7e8ea6e", "value": "T13554122DDDCC89BDA86A09C553E50C9FE603C1E4379CAD5284AFC3FB5668E504EE4E48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381399, "uuid": "b76410b9-33f2-465f-ae52-1c582f38d0ed", "value": "6144:feCG1wy0kF9peCG1wy0kF9peCG1wy0kF9N:fU13bU13bU13T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381399, "uuid": "b57d5970-9a1f-47ba-8b1c-ef9e1f233940", "value": 295416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381399, "uuid": "39c97aef-5671-4c02-b46d-e0afab269116", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381399, "uuid": "cb36fb5f-f6ca-41b3-8f7f-138ac1d7e88a", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db9eec0-ba21-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762331264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331264, "uuid": "bc9c232d-f834-481c-bb93-05160cad8164", "comment": "Malware payload (RemcosRAT)", "value": "016df21832bb6c64366168e8e76f5a61", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331264, "uuid": "8acd108a-3141-4273-a7d7-552f8ad690ee", "comment": "Malware payload (RemcosRAT)", "value": "b15f6831c7e73cf0ebdc70c9e793fe2493f268fa04f2a6a1bb392036c288d26f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331264, "uuid": "39432967-78c8-439e-a3e1-53babdfaae0b", "comment": "Malware payload (RemcosRAT)", "value": "44106523ac32fba07129d5baf1419593fa656f92", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331264, "uuid": "dade51fd-25ce-44a9-8b44-2ce862f4847b", "comment": "Malware payload (RemcosRAT)", "value": "5e2d666db3fb86901d292d9fc744b108a5df68fd0cbd9e0580e579ad3bd2493058c1c150a44dc9a65c0825a51ff13aff", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331264, "uuid": "308e5a91-f499-4084-a122-f67de45fb10d", "value": "T1EF23027AF07BD84232FFB57892563A2CBC9957173E777A135EA52F8441809412CBA284", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331264, "uuid": "a8de77b0-a07f-4b7b-8cea-67d11b7c7e13", "value": "1536:BQ9KatxAhXC0JYfrQqjg5l9pb1kaR7tH/7+aSP8o:BXqIPs1qlzb1kaR7tHSa3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331264, "uuid": "19c22233-4b8b-49d5-81ea-ac11c452ced1", "value": 49609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331264, "uuid": "343a6ff4-a25b-4693-ad03-d9e33cf3bbcd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331264, "uuid": "2a93082d-a542-4136-bb5b-c61c558e3bcb", "value": "Swift payment advice-4567688978676564.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947c34f8-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1762336108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336108, "uuid": "2e858653-6e7d-4bad-9643-d7d89205ba92", "comment": "Malware payload (SnakeKeylogger)", "value": "778c3c2b1f927713599ffff8639f3373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336108, "uuid": "aa580c3c-ec41-4ebb-af12-ac7b74556c2b", "comment": "Malware payload (SnakeKeylogger)", "value": "b1eaf7292d2c9921d42609e68b206ae447a4b9f0c67e026dda22d0bd1810c3a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336108, "uuid": "29216404-cf73-4f42-8c96-f62e1cac1d76", "comment": "Malware payload (SnakeKeylogger)", "value": "c142ac1922d3d5b502d349cc47622d404435d396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336108, "uuid": "48f952b4-485e-4608-9e63-484ce2847119", "comment": "Malware payload (SnakeKeylogger)", "value": "30f9564d57b8f4f3f2a9dd36e794be2667698a17b4cde71321c7acec86c3a48644a2cf37fd7e85c17ffcb43dab4815b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336108, "uuid": "f1bb229b-35db-422b-84c6-d84b69ccbc68", "value": "T1F165122076C08FF2DA6F193519A172256A3B7C201F758FDF9B403E693A305C19A36B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336108, "uuid": "b73cf472-9570-4733-9def-b3e3f9433926", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336108, "uuid": "97d4a11d-2632-4090-935a-e0a6767709c6", "value": "24576:AOtT5xqs8XNfnKzXnBy9yEwn7ybtHzXHCy1faP5V5OhzdzuQhJ87qcFUv:AOtTzwtnyXByIf7klzXHCuSPjmzdZhJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762336108, "uuid": "6dab6916-7fcc-44d6-be83-f8d66457e7cc", "value": 1435220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762336108, "uuid": "96e8aa9f-da1a-48f7-9c01-2b2837d372b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336108, "uuid": "c507516d-79fd-4261-897d-e974a669bd17", "value": "GLORIOU SEA PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad93344a-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316822, "uuid": "baec888d-a503-488c-b44c-200f2f610d05", "comment": "Malware payload (Mirai)", "value": "3e71c86ba8138b4199a37cc57af66d7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316822, "uuid": "f7daa4eb-006f-46e6-97a9-a6bffff31329", "comment": "Malware payload (Mirai)", "value": "b214aeb26564b7ec06185ef4d37e2c265e54431a3d7601715cfc85631c3b6c47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316822, "uuid": "7bf373b5-9f98-47ae-af93-6dd76ef38435", "comment": "Malware payload (Mirai)", "value": "8036f7c1be20a84b64496314f6fadf7578a0db4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316822, "uuid": "66129777-5e40-4d04-82c2-46a7b72b9755", "comment": "Malware payload (Mirai)", "value": "783905bcd8dd081eac6fc022ec484036349d6afaba896843519817e3dc00cd79a2c02decef2e1e212683a2a5ba0bfffa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316822, "uuid": "65f34669-4c37-4e09-ac50-52e1757f24e8", "value": "T122435B0273180E47E1625FF4293F27F083EEE99120F4F588664FDB568275E33258AE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316822, "uuid": "3c88f1cc-c169-4bce-91b0-1b440ad3e337", "value": "768:E2AtFP96vX+qg88oE2acxM5yRn1tQ31TwpG79LqzMqSCuoAYa/A3jv3XUtZAIs4E:EiGqscxM4635jPqSTdT43jMjsjJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316822, "uuid": "387a56e5-9efe-458d-b5f8-e6bb2436c9e5", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316822, "uuid": "db15db75-5012-4330-9fbc-a65a99e17e62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316822, "uuid": "d5fd5b95-2425-4d7e-92a9-6134d9ae124c", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf823d8-b9da-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762301062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301062, "uuid": "e26f612c-c161-414a-9102-40e348cc0615", "comment": "Malware payload (Mirai)", "value": "d36d31837c861de820d6107bfa2bec41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301062, "uuid": "5ee83c5f-046e-486d-90cb-8ed506e1a607", "comment": "Malware payload (Mirai)", "value": "b2dc005e6b0393dc6bb301f70ea6b2cbe89177626d59f39e8e9a1bc889ba1fa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301062, "uuid": "8fce24f8-e62d-43d3-b956-5268e31a759c", "comment": "Malware payload (Mirai)", "value": "9c445a0a30cf0a8f3b45ff544d352635a7c71de0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301062, "uuid": "67d08f95-066a-46a3-8263-3d4cf96e8c7e", "comment": "Malware payload (Mirai)", "value": "11351526384d3b8ebf01233d9570723827bd0728fa0a172b42fa91d0d4c780779d657a4272b026569fe572d593200b28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301062, "uuid": "a4827a3a-6ace-4ebc-8e30-9e1f0b9b38ef", "value": "T128B3D64E7F329F7CFBA8C23447B35A21A65923D227E1DA85D19CD6011E7024E681FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301062, "uuid": "d825eff4-6c26-48c2-88ab-da9c742e847a", "value": "1536:WkUa7xt8FyhmfntOhLEmCvqmKD5WmXEXSiy7APk2PK6e/BdHZlNZ:Ia7xRw/8EmCCmKD5W4EXSiy7OkAKBZlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762301062, "uuid": "84de2237-7ac1-4457-82b4-9afe14b8b296", "value": 109760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762301062, "uuid": "5e69eadd-ce2c-41a9-93ed-d0ce92597df8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301062, "uuid": "26dbcdd2-9662-4ffd-8ea8-2f2ba774a61a", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4595d2-ba4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762349056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349056, "uuid": "12c9edd9-b7f6-47d3-acf1-50177e4029f3", "comment": "Malware payload (RemcosRAT)", "value": "6d07b8db06b2967d9dd43a647febfa3c", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349056, "uuid": "f85b5b82-c8ce-4076-b480-621e2a143538", "comment": "Malware payload (RemcosRAT)", "value": "b2f9b18ad98c5825888d23056b3864d8eb5a595f6676f5293c05eb12bfb55583", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349056, "uuid": "582c74ca-5120-4c58-aae8-1b2027924d55", "comment": "Malware payload (RemcosRAT)", "value": "d69d66d121792070c1a73e061b8ac89946a5868f", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349056, "uuid": "7415074d-ccdf-4dac-92f6-c82332f3d428", "comment": "Malware payload (RemcosRAT)", "value": "e8c7fe9ce4925296f8c2438a2499c778bd5ae595ce3ba28ba9eadaa8e57c38b12b995caedb3f1b29e6ddf8df04706d53", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349056, "uuid": "4067321a-d6d2-4b89-9273-99a43d1224fa", "value": "T15075ADA7637C2C3FF192E471ACDED6DCF73475201A29652149A45FF86A3A2C1E42234E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349056, "uuid": "6aeccca0-fe26-4548-90a4-7ae7adafe093", "value": "4f8435306da721da0e7bb19b02092344", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349056, "uuid": "ed9aebb4-6215-46fa-b42b-d359f10e8449", "value": "24576:svsd6pIOH82nA3SQPXIYNs1id+qc0FlIIf+mfI6yELVZMJKBg8pL9f5KBACs3:svrH0bs1idYeIBmfLRuWg6L9fk7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349056, "uuid": "185b3231-e380-405c-9eb3-7b15fef0352d", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349056, "uuid": "59fa246d-69d8-4553-9816-a13c7f8d5cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349056, "uuid": "7e09a126-959a-48d3-b7e7-b54895e8232f", "value": "b2f9b18ad98c5825888d23056b3864d8eb5a595f6676f5293c05eb12bfb55583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8919dc0b-ba96-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381615, "uuid": "3fffedf2-940f-4cc7-9c1c-145114709a1f", "comment": "Malware payload", "value": "a68f0e5bedf05dae7a99369197b40509", "object_relation": "md5", "Tag": [ { "name": "Miradore", "colour": "#AF339F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381615, "uuid": "b9cd3b44-4c3d-4448-a650-3fb30b201b46", "comment": "Malware payload", "value": "b333880be92db1dab595ec40c507fa328bda5aa54ce61b7209c206cf3caba127", "object_relation": "sha256", "Tag": [ { "name": "Miradore", "colour": "#AF339F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381615, "uuid": "94c739ed-2d8d-40da-8b13-40106ed960b4", "comment": "Malware payload", "value": "7e94c9011f4271064f1d39ddaa233736c9678471", "object_relation": "sha1", "Tag": [ { "name": "Miradore", "colour": "#AF339F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381615, "uuid": "19c3e553-dc2a-4fdd-8cf8-194c768eab2b", "comment": "Malware payload", "value": "3da143b32d6d84be00f2c78de7edbd059f23a152b162307212f9d35421a76ff006e4c4f15e13fbb780cbe212d2851387", "object_relation": "sha3-384", "Tag": [ { "name": "Miradore", "colour": "#AF339F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381615, "uuid": "f00ecb5c-1ea9-4ca1-a537-3267dd94b8b0", "value": "T158C73350A2B6D252D23D34F5FCA0F88EA340F853A68BE52B445D754DEB9F2A8470B14F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381615, "uuid": "f071d1f9-6c29-4b33-a65e-98dbe6009eea", "value": "786432:sjW0vYKxrFsccH8g0xRdpVVyj5DsUkPjqBmTwn7Ipl6dUFQmLuzHaYgwVoQkOedF:o+ZCRdpVMOUkysjl6OTLuzHaeKb9vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381615, "uuid": "07b8c1e7-155d-4b96-9d34-d77683820620", "value": 56363368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381615, "uuid": "6b59036d-8cf5-493a-9e37-f5a0da6e57a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381615, "uuid": "b63d4963-b622-47d4-be8f-d14802c87ea3", "value": "client.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564b133a-ba25-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762332997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332997, "uuid": "a6e8b55a-375d-4e25-974a-e6a881f698f2", "comment": "Malware payload (Mirai)", "value": "0125cd9abe01c77e71f8b024bead10d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332997, "uuid": "9d2dfdcb-3402-49ca-88d4-130190a8187a", "comment": "Malware payload (Mirai)", "value": "b400aba1ca28b530e03b0d7957fcefb69abffce403e323ea761facb842f349cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332997, "uuid": "4144e217-18c1-4f45-80d4-5ab051d84c74", "comment": "Malware payload (Mirai)", "value": "c6d398e8856b90ae6aeec85e399b9e633caf9678", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762332997, "uuid": "5ea5216a-1f09-4aaf-8af7-d17ab1319c77", "comment": "Malware payload (Mirai)", "value": "974fcef523a118cd6b3be620109677d7a26ce4cab6bbe5130f88509041a0ed0337c3e4b90afc0f9989dc9800e4ffafaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332997, "uuid": "2d9300e6-0339-41a1-af53-53f16afe50ab", "value": "T1F9431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332997, "uuid": "fe752d83-b262-401a-a854-aeb97beee161", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762332997, "uuid": "ec2bb139-f0f6-4295-8984-b4f21cd12ac4", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762332997, "uuid": "5225a6b2-fe35-4bf8-9226-8edf55dbd9eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762332997, "uuid": "f968316a-8265-464a-aacb-24b88fdad784", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bcbab0-b9f9-11f0-91c6-42010a9c0006", "comment": "Malware payload (XenoRAT)", "timestamp": 1762314205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314205, "uuid": "80fa2a5b-495b-420d-8fe5-eae92b27db41", "comment": "Malware payload (XenoRAT)", "value": "3072d0c32ffedbdf1f9f5df9f02e4257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314205, "uuid": "7daac271-7d6f-44a8-bd3a-f27218f80620", "comment": "Malware payload (XenoRAT)", "value": "b564ff977533173152028f7e29034fe63e39f1e7b1e210b9bdb106e6fe8eb780", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314205, "uuid": "3cdd7056-fd80-4b66-a1ed-dc694eafb703", "comment": "Malware payload (XenoRAT)", "value": "cd66747259b530f83872f0ed0ad20fc827cd50be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314205, "uuid": "45809d7e-8d85-4d14-96ab-0e82ea1167fa", "comment": "Malware payload (XenoRAT)", "value": "df2176c8206334792870c2cef7a383c66fbb7641a346a552c264a8241f2cf063bc40ba3b7835964085147adb1c0a3eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314205, "uuid": "06f1f6bb-8253-4ca5-929d-f5880e37f56c", "value": "T19B23F84C57AC8923E6AF5ABD98324263C7B3E3669532E38F08CCD4E9379338554053A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314205, "uuid": "67eb6079-6ad4-410d-b2d8-334a89fee011", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314205, "uuid": "7461568f-ee1d-404d-b6c9-7f96fd67ef8a", "value": "768:cdhO/poiiUcjlJInL3H9Xqk5nWEZ5SbTDa7uI7CPW55:Ww+jjgnTH9XqcnW85SbTWuIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762314205, "uuid": "96412068-a682-4dd2-a8e1-21313bca63c6", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762314205, "uuid": "b29c8a66-77ae-401d-984a-4863e2c29bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314205, "uuid": "b1c7ad3d-8084-4553-bb84-6d64cc682de2", "value": "xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c618e8-ba3c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762342759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342759, "uuid": "644ee279-d50e-48bc-b9ee-b9cb032f07cc", "comment": "Malware payload", "value": "4ca2c28202a1f4eeb574b765c521b7d5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342759, "uuid": "de015fe9-acb7-4ba3-adfe-7c7d92018ed6", "comment": "Malware payload", "value": "b63529341c0c0cff4e5e02341a3398441583bee92cdced536ab50af3be313d71", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342759, "uuid": "50cbeedb-b194-4642-b284-eb46f06c21d1", "comment": "Malware payload", "value": "82b6a95bbc9b848760f0a8f6a9138db079fa8598", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342759, "uuid": "006f7de1-95ca-4981-a871-3f3f508e39ea", "comment": "Malware payload", "value": "2db0839d333a6e71c66b263648fbe27a97bc1a93c0a3dd6cf4e537f762fe220d3adcd1f44edc0acac80811b78c09ef17", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342759, "uuid": "4064ede1-f206-4eac-b744-563c8b38352b", "value": "T19F4423B87ED7F49693423779104D456B0C4150CE92BD6B8167CDFCA2BD0383A58EDA92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342759, "uuid": "32274f66-02f4-4ed7-914f-e975cf66382d", "value": "6144:uEV47MmiPwMVVYuOshCxcH1L7ow50sdlZKBsCOLZPr/oPG:PV4AZzVvvhcyLyYlZOsCmZPDoPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342759, "uuid": "e6c0146c-5c15-4c2f-827f-66494febe4f8", "value": 271161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342759, "uuid": "93aa7521-7085-440f-ae75-b4bebff130ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342759, "uuid": "f99c5d79-72f9-4477-80e5-04d42c92d529", "value": "dae9172b36ace80ea8bf82313c8260695460ac5cd0e7b5b2e9e81fea7a5c5aee.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acbc148-ba99-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382772, "uuid": "c8179298-f88a-4cef-a647-75181da37790", "comment": "Malware payload", "value": "5b30c54966ef316d147320e9917b5c42", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382772, "uuid": "f24d060e-2515-4db1-a52c-0fbfcfd77711", "comment": "Malware payload", "value": "b6a12186538d110498383cb2871a8abcc4c077e4b9b48045312772116312d60b", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382772, "uuid": "8f761b1c-459e-40e6-acc7-4543bd2a0396", "comment": "Malware payload", "value": "c9fe5500286aa1dbc4a11f4067da1277b5752ef5", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382772, "uuid": "dc7f3776-4d1b-48c0-bf9b-d475bd9eea45", "comment": "Malware payload", "value": "362141d1c2c80b3e679d2dd0f74d84a8223746851513f33f77bc300d28d9dd00cb05ec0cef9cbd6af48b0870184be0cd", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382772, "uuid": "7e027579-0306-4b1a-9d47-a4b0d2a58102", "value": "T1F854126C77EEFD2B0ACE21D1761C1AC0EB048E729D0DC55B1AEE499D69D0BB8244C882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382772, "uuid": "aa8f75c7-8adf-4179-a425-e7a8e449f04a", "value": "6144:LtkclRxb1jgC5q+JHyzG7tkclRxb1jgC5q+JHyzG7tkclRxb1jgC5q+JHyzG3:hkcdnk6S8kcdnk6S8kcdnk6S8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382772, "uuid": "6920ad4c-1cea-4c49-9334-69886a6380e6", "value": 294630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382772, "uuid": "caf859a0-32d0-4d34-b0fd-0fe04bb8c747", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382772, "uuid": "a23c54e1-c417-48a1-8704-b64d3a45cfde", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ba3182-ba4d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Latrodectus)", "timestamp": 1762350114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350114, "uuid": "d9b168cd-dd45-4325-b736-77895189b933", "comment": "Malware payload (Latrodectus)", "value": "96b45278e1a1cf09b38c23375613c4d6", "object_relation": "md5", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350114, "uuid": "14446e94-f4ac-4a75-a5f9-296471de611b", "comment": "Malware payload (Latrodectus)", "value": "b78dbc66a99cdec46ca38ee09f7804edf082987e8fd832c612479bf5d8a46df0", "object_relation": "sha256", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350114, "uuid": "7a244312-d0b7-49fd-b318-c2697157e518", "comment": "Malware payload (Latrodectus)", "value": "cffcfd14610aebe775f383b2fe8dad08d2546c93", "object_relation": "sha1", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350114, "uuid": "6ba9fca2-b6ba-4138-bb3a-9f0aedadb990", "comment": "Malware payload (Latrodectus)", "value": "c92ce7b196d7edb79ec85c7b345176c478aceef4d85a0addffd444a8c3a9d04b7b63981c44d01b95b2d2b833d9e0245a", "object_relation": "sha3-384", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350114, "uuid": "795ffe47-6a33-4615-9a62-b41122cbd3f3", "value": "T1DA95E0217396C637C96E02703929879B517DFCA74B7080DBA3C82D2E9DB44C16639FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350114, "uuid": "3163caf6-71c8-4465-a15d-27190ae80d4e", "value": "49152:VNMHYUZKumZr7ACI1KKcIvAGxN+UiUpx7MNt3:uY+K/ACIDc8XWKxoL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762350114, "uuid": "6bbf51a8-ccdf-4b6d-a7a9-ac5a8cc19d01", "value": 2012160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762350114, "uuid": "1e3aa3d8-fce1-4eac-9dad-d27ed263e4fe", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350114, "uuid": "8f010ded-686c-4be4-aa5d-f5cf68e23fca", "value": "temp.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502252e3-ba68-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762361763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361763, "uuid": "df51edd1-809d-441d-b8b1-8e3d7b17a230", "comment": "Malware payload", "value": "e137f50283050010910481c47c5f173f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361763, "uuid": "17d92a42-bd04-4b60-b3fd-2ba03a79165d", "comment": "Malware payload", "value": "b7df1ca221d8437e9f0efc0ec9e8b52c0aedd050d13c03781146422f44479b74", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361763, "uuid": "70ea7487-4781-4d0a-8f60-9436db555f54", "comment": "Malware payload", "value": "c6c9397e636645da13ae785c33f5a599ddcf3186", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361763, "uuid": "5248e9c4-0da7-44dc-896a-9a0736191650", "comment": "Malware payload", "value": "9dab4a55923c4ce509ebaede5f34086f3efe588c94979995e46688104ee8c0c62fdb6ecf309beeb07e8ab159f0a8c573", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361763, "uuid": "af8cbdd1-9cd5-415c-a451-ec996aeef8ee", "value": "T1B5241A57F35368FCC866D13445976332A6727C290134BA2F4BA0EE316E22F50BB7AE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361763, "uuid": "fffef315-410b-4bcd-9ea5-3a5665008596", "value": "a0daabc3a80e7d0785538c2055dc8341", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361763, "uuid": "3db54a8a-2445-4fbf-b5dc-ac5400768bdb", "value": "3072:pZURS3I9jiTwZ25o2dL9oVakGs88bHZOjF/3OP23ydQ9B3nOhP65a2V/5CS+jZju:fURZjtJ88t1dQ9tAuLBawh/x8nAFVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762361763, "uuid": "e6cf93ef-1e45-4417-b2f5-eceb2cf30367", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762361763, "uuid": "4b78db47-1fdc-4d73-86cd-14b6234ee3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361763, "uuid": "ff8b3e64-e43e-459f-b016-9a14d825fd93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c53d111-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762336013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336013, "uuid": "5c5ae2a9-5e62-4c06-a42b-a4e5640056bc", "comment": "Malware payload", "value": "e8902321fa9ee77948fdf42f1769f8dd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336013, "uuid": "01fdc441-5c79-4400-9f25-365b13e70313", "comment": "Malware payload", "value": "b992d3124f8efd92123bd9337976ff4bd7880ed9e1f38d6ad6d4c7da53c47dc9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336013, "uuid": "8260a5ab-ce4d-4020-9be9-b55993462295", "comment": "Malware payload", "value": "aabaa19df99f056228f017122a7d86bc1d3bbf9c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336013, "uuid": "03607d46-606c-4cde-b7fd-41961e0366ed", "comment": "Malware payload", "value": "0f4ca434cb540f3a46a5ed6527e414e5ae67bc85690b99b89335bc6778ad228484ae9ed94dcd5ba083532beab531b0e3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336013, "uuid": "086ee748-7d49-4c5c-b92e-dc554a373e7f", "value": "T175663361B37A3C3EC5AB906CA39936C53196C428E85CB5DB23C985CF4746DFA4AE1433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336013, "uuid": "e5bce331-99f4-4f5c-a164-c0991ec26666", "value": "196608:9nlqF7hQJ5p7mJdXSffyFkffnHe0R5eE/4uRoog6Nmy:9noFMLepSffyGnHeQ5LVRo49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762336013, "uuid": "06dba1ef-b720-427c-adc9-98ddf4d2d494", "value": 7041652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762336013, "uuid": "8d8f8773-81dc-4396-a02e-990fc3f94631", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336013, "uuid": "d49f255a-3c46-41b5-b736-5e8c9f2f44f1", "value": "a8756ff9efb824282d9b2db61b8269dbd14ceea05dcb4f22bfda3a379d61781c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c6e71a-ba57-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1762354654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354654, "uuid": "899b3b0b-1ee0-4e3a-85aa-c9462d4f7ff9", "comment": "Malware payload (GuLoader)", "value": "1d8dde3f6b8bea3329369c65ca22c7e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354654, "uuid": "599415bc-943e-4e33-a9d4-6dfe02aa9b9d", "comment": "Malware payload (GuLoader)", "value": "bb5fc7e49f6281fc8df937ee858b84bb283c589d4d5ef34c4591e095204fde1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354654, "uuid": "bf510b79-2bfa-4630-9c7c-df75f955d912", "comment": "Malware payload (GuLoader)", "value": "b2d15d5a6d91c71b3331f30f3bbf223061c519e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354654, "uuid": "e4d012f5-db6c-4422-874a-8a58d8dbfdfb", "comment": "Malware payload (GuLoader)", "value": "952341060031d955992588f73583b769c38f4d68752044c05b60b0bd231d9bc49267106a335c0331a1cdd39edd11c4ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354654, "uuid": "a5168056-1295-4840-b96e-2c0d6b735e3d", "value": "T1D4152339F194D447C6A08F715EAE899DC6F4BD9119B94A3A1F103FAAAF31B12C90F305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354654, "uuid": "2709337b-5f14-496a-85c0-e2bfa57aaa4e", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354654, "uuid": "3c332c3c-748a-4e59-8790-715ae632cf54", "value": "24576:QMwSlTnK9XRBM9CEknM7Cc1fmP7khz1zuc7JM:QMwOnmX3MYVM7CgOP2z1X7JM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354654, "uuid": "a3c51f4f-dc23-43ef-bede-5786d7d33471", "value": 911792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354654, "uuid": "1cf24a4a-576c-43c3-90c7-367d9a7d0975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354654, "uuid": "c3fa6747-6cfe-4764-89e2-e76a5f23678d", "value": "WSAPW0650867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3855abaf-ba43-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762345831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345831, "uuid": "caabf7b8-d7aa-46b5-91c1-0c7533f1a412", "comment": "Malware payload (Mirai)", "value": "6292aba0ed67d925e9ea358fd6d41578", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345831, "uuid": "a9ae7127-98f6-4704-b9af-ac4a5236105f", "comment": "Malware payload (Mirai)", "value": "bcfc949f8ada1100805076320663bcfa57c59114ab46be6e6b93dc5761a99e29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345831, "uuid": "30392042-5a0b-4d67-b102-d1294405a611", "comment": "Malware payload (Mirai)", "value": "df143313b8096dbe38d1b50d27bd756fc90d1671", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762345831, "uuid": "d888bb88-10cf-4e67-9791-db0203d01bb9", "comment": "Malware payload (Mirai)", "value": "f7c10be6c574524aeebd8855a8a5b0a9fa71a60b26f29aad3c0d98a8c77aa04145dddd1bae4c704cb7220e69ed5d1a50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345831, "uuid": "9b6ab62e-de08-458f-a5a3-f32b59f1151f", "value": "T1F2E47C5377218F94E361C27105F3CB259AA421A20AF390C6A37CD7207A51A6D6C6FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345831, "uuid": "c492edfc-36e4-4776-9926-cb798958d24f", "value": "12288:oBt4Z4asc4RfZBOHwf7FOHu1M7QvYHyKITi+eju2XXyZd8pTKwEEV:oBY4asc4RRwHu1MqKIm+AHXyjwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762345831, "uuid": "87f1ba46-864f-4651-87d6-8dda4a547c61", "value": 710268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762345831, "uuid": "887d3746-bf12-4a80-979b-d6c5c74ec92b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762345831, "uuid": "2b45375b-a23a-400e-8a4e-64c277e83e23", "value": "Mddos.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7935ff37-ba95-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1762381159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381159, "uuid": "d4459d61-8be4-47e9-acc7-ca638db01409", "comment": "Malware payload (CoinMiner)", "value": "9716d84888b1fc1e2a544df0a52aac6c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381159, "uuid": "d1110950-9f8c-4595-ab21-3b1585bdcf4f", "comment": "Malware payload (CoinMiner)", "value": "bdb21a7f3ea3e2b79dc1b0882f47aecce8cb7b2b592298d94e6e3fc32cdbc1ab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381159, "uuid": "06fb0fb9-9fc1-477d-b39a-7c0b3ef278ac", "comment": "Malware payload (CoinMiner)", "value": "11b55311b487b516a634f972609d9858a344cd53", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381159, "uuid": "4b0ca604-527b-4d9b-9efc-ab02544a512c", "comment": "Malware payload (CoinMiner)", "value": "d599985e2dabdc802f081ab0af3ddb665b9a9b095ef15a1439a0278672791ab0c7c30ea0f01c5500b103121eb5041910", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381159, "uuid": "a4c3d3ef-b3e4-42e7-b6e3-7d411daf02a2", "value": "T1CF666D8329CB0DE6DDC737B875D32339A775FD62CD2A1E6A9644C13069632C06E2EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381159, "uuid": "65b900dc-5b48-40eb-9af7-3c9f235684dd", "value": "c6d4063efc1eea7d5163a7cb25a07083", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381159, "uuid": "b9060665-6cd6-4232-98bc-4fae950b6167", "value": "98304:BtLMInJpLjDTefBAltFrPfjheuizYZvapOmRe9Bo:HLHnJp3DTHvUYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381159, "uuid": "18c73fd8-eedc-466d-ba3c-e3c60cdd96d8", "value": 6590656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381159, "uuid": "2f71d8cf-8605-46e9-965d-078759ecdb65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381159, "uuid": "1cf2980a-b706-4e76-8f53-b87cfe2089d1", "value": "SecuriteInfo.com.PUA.Tool.BtcMine.2799.27443.29396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40fab1b-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316806, "uuid": "81e21fd2-ffbb-40dd-bd4c-a396e19475c9", "comment": "Malware payload (Mirai)", "value": "c26a90f7fde605221345b15eb8b034ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316806, "uuid": "a479707a-19e7-4c3f-951d-841995849d54", "comment": "Malware payload (Mirai)", "value": "be5cdd7fa8e206af1675707eb9ca01385a883c969017db9f9fa36b3ec0f90b7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316806, "uuid": "2f4bebc0-0ca1-4338-bd70-07cdab993935", "comment": "Malware payload (Mirai)", "value": "c70de717b295a38c5bc1c41703b7789f1190cf07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316806, "uuid": "22b26c75-6c3f-4873-8e5b-71e8283c9e34", "comment": "Malware payload (Mirai)", "value": "b951be596dd878b7ab649ec13a7c259894a58e556464444659f97e468926c1b8dcfb38d7d8c82a9aee23c5d704e3629f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316806, "uuid": "84bbb337-a0ba-4edc-bce6-c9be26075a84", "value": "T1C5331885BCD29A5AC6D463B6FA2E519E3321A3E8D1DB3217CC204B1437CA51F0DB7B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316806, "uuid": "549b76fa-7ddb-4c41-894e-512d9ad16545", "value": "1536:t1AzmE7Ok0uBsWiPRD+aAb76rL2yBCNt5sw8Q:vAzmE6k0vgkvkbsw8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316806, "uuid": "25d966b6-9e5c-49ef-864d-37f44053f250", "value": 53348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316806, "uuid": "520eaa68-e7be-4a92-824c-c65353266299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316806, "uuid": "3cfe04a2-9343-4bcd-ae6b-04d1b6e87079", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4140f399-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762335968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335968, "uuid": "2c67a75c-119c-44b4-90bf-c55ed83ad575", "comment": "Malware payload (CastleLoader)", "value": "669fce84d112e62291e96f49d42be557", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335968, "uuid": "9b1fbf56-a7bd-416b-80ce-5f36a7ea70cf", "comment": "Malware payload (CastleLoader)", "value": "bf21161c808ae74bf08e8d7f83334ba926ffa0bab96ccac42dde418270387890", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335968, "uuid": "b6bd48a2-dd7d-47e7-a740-d3191a7de896", "comment": "Malware payload (CastleLoader)", "value": "f161adfc02666f0b7bf91de2f057dc7a969ea14d", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335968, "uuid": "add559e6-1480-4f15-afdc-13646ec186d1", "comment": "Malware payload (CastleLoader)", "value": "0276add19cd235cddd5d586832b455b8330599866a11be96d129aca41f45aae611e4b3c648409e4bf1148505240ec345", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335968, "uuid": "65a1e0e3-d833-4a15-968d-e4c9423c2a98", "value": "T1E1159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335968, "uuid": "5fa1f8a0-e005-4e43-aa70-79004691c4e0", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335968, "uuid": "63ff32b5-16f2-4432-ae7f-9536616cba31", "value": "12288:5qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaZ7D:5qDEvCTbMWu7rQYlBQcBiT6rprG8a1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335968, "uuid": "2ecbcc27-7df6-4854-b46d-0ff23be9843b", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335968, "uuid": "3f21b23a-abf0-4aaf-a3c9-67d1aab06c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335968, "uuid": "c267a0e4-8dee-459e-91c9-df05b3735166", "value": "bf21161c808ae74bf08e8d7f83334ba926ffa0bab96ccac42dde418270387890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ddf6b2-b9e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762307198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307198, "uuid": "5af800a1-33b5-4d68-b46a-cd218f0dcaff", "comment": "Malware payload (Mirai)", "value": "019c00a0d1236f3784ffc78a51440965", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307198, "uuid": "96fcf17b-4765-4233-b6d5-f617938c1975", "comment": "Malware payload (Mirai)", "value": "bf51757c1cc3e78700f913d323e8a520c22f2caa808a86cdaf2327a7404be121", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307198, "uuid": "8d6117b3-8b17-45aa-baaa-6066c31d427a", "comment": "Malware payload (Mirai)", "value": "f0ab5ab49e595c80d97b42ac70a5e680bcef19fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307198, "uuid": "7fcf1028-2518-471c-800b-0525bf8c59b3", "comment": "Malware payload (Mirai)", "value": "b593a90cec863a0e61cbedada66f511d69f8575a1f9900c5a72ebd194b7e64db96b5a4c83d0a151137ce414c69c2cf36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307198, "uuid": "b87e80e3-1e38-4e6b-9d92-871290ebd7b0", "value": "T154230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307198, "uuid": "0c443723-543b-4557-a057-f4921d806915", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THh:5DmKF7Gxyk8cqoHAmWurAufsG5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762307198, "uuid": "bedc7d70-d916-4f63-a1db-9cef87551792", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762307198, "uuid": "14379b69-6f99-4d28-a5ce-2315c574741f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307198, "uuid": "e61e52a9-c555-4b53-baea-bb2feaa00b98", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00da77e0-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319969, "uuid": "433b8664-7374-42db-8011-5a43727c8b3c", "comment": "Malware payload (Gafgyt)", "value": "6c74cdc5217e972b336c5956904d2422", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319969, "uuid": "7351bc5c-74a3-4a0c-9986-5f09656ad35c", "comment": "Malware payload (Gafgyt)", "value": "c00993874e11fb2c7a2e96d69d2b46f1313ac25572e77ed6ca4bda86679abf49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319969, "uuid": "235d9281-7422-47bd-aeb0-cc3654a148ec", "comment": "Malware payload (Gafgyt)", "value": "c4e6533a9622ec981cd4bbd186dd7d369dfc4b49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319969, "uuid": "b7c42b6e-7542-430f-bf1b-19cceaa20436", "comment": "Malware payload (Gafgyt)", "value": "e36e461d85b549458a3cdd1e86fa7cc580d8dcce7dd959e8846818d9bf8dbfbecc9a4ef0dcecc0605632304d56270917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319969, "uuid": "b2ccf8ea-9744-4bbd-b6ef-121e7300aae5", "value": "T1A5C3D9BBBA180753C49305F12E3B3FF25F18A6F311E660C52A26DA808B739B61551FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319969, "uuid": "b9a9ba67-687a-49cb-b095-f886c4dcc40c", "value": "1536:CQxjjq+aV7MP3rrkqu2opvHbYkbnlopBqtlL15he+:CePWMP3rx8/5bnloix5he+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319969, "uuid": "8e1eb485-608c-45b8-a5c9-c18fb1963d85", "value": 123540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319969, "uuid": "811ed7b6-8647-42f4-958d-21127159defd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319969, "uuid": "8a9f4fa5-d36d-4896-81af-ade55cb3ad9b", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e1e67f-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319982, "uuid": "097dded7-cb2d-4312-afbf-f814bb56d232", "comment": "Malware payload (Gafgyt)", "value": "1cd7eaf63e010ce27d43f22cb3025689", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319982, "uuid": "d0bbd80c-1eef-4b2b-9a55-362a069e5025", "comment": "Malware payload (Gafgyt)", "value": "c0217af6675f9fe2e3971eacb58f3637ced860bf24140d592f3381b72393bcab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319982, "uuid": "65763b94-e7e5-4a02-bcad-485d0a03756d", "comment": "Malware payload (Gafgyt)", "value": "f52863e553f8c7473e961a4fda17f438992e87f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319982, "uuid": "4fc62656-ee10-416e-9ac4-072d181afc38", "comment": "Malware payload (Gafgyt)", "value": "bcd4e775ec7d94917ce3c12f50e79097d90e099581ace147c90ead0cb83a60e958f061d48e3a9cfc3609e08088eeb58e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319982, "uuid": "0d20613c-cf24-40a7-8e45-ce22ef695c6f", "value": "T11CD3963BBB130F23C0C610B111A76632BCA9C7DA34FC52D75AE16C9C5E2A58934A5EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319982, "uuid": "ef7b8fb8-bbe8-428c-9fc4-dd30b291e53a", "value": "1536:yqneiU0skP4q/YaojDgxNM5hktxtvphaWqvdk:C70sk1/YalxN8qVphaWqvdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319982, "uuid": "a03751c5-cbeb-42e0-ab6f-123dc3a5ceee", "value": 135560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319982, "uuid": "559fa0f3-75e3-4823-92c3-0aec901c2c8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319982, "uuid": "72787a45-7ffa-4b1d-a84d-271cc8855f8e", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5869578d-ba01-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1762317538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317538, "uuid": "415ec702-5409-429c-9a2e-0a356858f2e2", "comment": "Malware payload (CoinMiner)", "value": "aa6577ee7aecfda0e8576f92807122c6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317538, "uuid": "e70ec647-340b-426d-8c9d-607a261bc60e", "comment": "Malware payload (CoinMiner)", "value": "c02981d526107b33e266291291e8f47fca4d8719d22ebddbd2c02e8b40973a0b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317538, "uuid": "5ca69305-6af3-47f8-a741-acff488bce6b", "comment": "Malware payload (CoinMiner)", "value": "098dfb5969c6025f2bc133dd9f89535e0730deae", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317538, "uuid": "8321a57b-5bff-44e3-8cf4-d80b6fe3501e", "comment": "Malware payload (CoinMiner)", "value": "8834e1313f45c1cd182455e127d0168d4d255c3a36c3c698a8676e5e9c333b6cb87726bd1e2b67a0ee862618e2fa8069", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317538, "uuid": "528868dd-c4ea-4d62-a23d-c0b943a159e7", "value": "T188768D59B90F3C52F3DBF37C9F4AA6A1762B76E0D22240B27E55424CC683AD4C6F1921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317538, "uuid": "ebcacdd7-d0a1-428b-a134-c8b72e53a2c8", "value": "98304:pIGoExMf6XapaWG8FtYsuVBzwZdbj1Eu8OfKNt4mLzCwTCrTm7theps:pIaxX7swaZRSU6SmLzjjtheps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762317538, "uuid": "5f297609-9ed5-444e-8bb4-064f102b093a", "value": 7648168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762317538, "uuid": "e0fce28a-f8a8-4f7f-b73a-40eb03cbca92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317538, "uuid": "858e5f4e-820b-4615-a3fe-ba530652e1ad", "value": "xmrig.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e3a0ef-ba22-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762331756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331756, "uuid": "59ffe295-5baa-458e-914b-7173eecad471", "comment": "Malware payload", "value": "eb63e6d0757a54818e1e74596222d581", "object_relation": "md5", "Tag": [ { "name": "eG7gpv3PDKvcrdMkRs3nwTsoc", "colour": "#7AC8A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331756, "uuid": "a26a886f-ef10-4eff-8043-f792cb49f2bf", "comment": "Malware payload", "value": "c04aaf2f57a3879b34bc629b024064030fc11fb2f9e5a5683c8fcfaa831675d8", "object_relation": "sha256", "Tag": [ { "name": "eG7gpv3PDKvcrdMkRs3nwTsoc", "colour": "#7AC8A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331756, "uuid": "4c5186f5-3ff1-4dbd-b55c-d87e9f075aa4", "comment": "Malware payload", "value": "ed3aaff346ba6ac7f19227b98863bb02a9821c3c", "object_relation": "sha1", "Tag": [ { "name": "eG7gpv3PDKvcrdMkRs3nwTsoc", "colour": "#7AC8A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331756, "uuid": "eaade9fe-65f4-453f-b161-7fd53b9ea82d", "comment": "Malware payload", "value": "00b4ca1cb867951f1b0a6794781d9bf8b7870840aa9f81b8affd94f621dd301249a48e98af11e8786e968df4f17de329", "object_relation": "sha3-384", "Tag": [ { "name": "eG7gpv3PDKvcrdMkRs3nwTsoc", "colour": "#7AC8A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331756, "uuid": "340bd17e-65b7-41eb-ad4f-6826e20e5c33", "value": "T120C6129462DC40A5C0F5C778C6EA5807F63A7C144B7AEBFF02A196162E366E1DF39720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331756, "uuid": "cc7e914f-8409-45d2-81ec-b8667267e98a", "value": "da7c7889a9af299fe69cc0665690e327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331756, "uuid": "ef386649-795f-4399-a13d-e33724fecb59", "value": "196608:+zVQBGUA0XCcucVaiZnU8uHlojqa3pA1F26SzFfQMR:3BKkhrXUBoj73KMFfQMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331756, "uuid": "cd5e5f75-ae22-4bd2-a332-9832c38a7bed", "value": 11962192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331756, "uuid": "3b0ac435-6857-4a6e-bc90-cdf847a5ce7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331756, "uuid": "82b57b5a-6c89-4902-bac1-a5f253945dbf", "value": "eG7gpv3PDKvcrdMkRs3nwTsoc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fe79c1-ba21-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1762331169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331169, "uuid": "40f037f2-3d60-4a38-b66b-887b72429707", "comment": "Malware payload (MassLogger)", "value": "a1975008ece68fae1ccb17df20a61290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331169, "uuid": "653ed270-eb44-4fb5-aa08-8b92f92f47a2", "comment": "Malware payload (MassLogger)", "value": "c0a6d0d1479d793eed9afdff1ce6c68be109ac586b0ab209721286bf2eb4a8bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331169, "uuid": "ee115a65-57d4-43e5-a054-36da6f9df404", "comment": "Malware payload (MassLogger)", "value": "885804ce1078349f031bafe439d104f13fb8907f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331169, "uuid": "571f54eb-dbb7-45bd-bece-62f96e256533", "comment": "Malware payload (MassLogger)", "value": "b7d5ba11382c4e41b32d5f606c5bc8b851ebb406477f20d7131264b4adf0291f839b9c7178998182a1a3a7266e29dc25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331169, "uuid": "10549612-ecb4-4209-abc8-06af47bafc00", "value": "T10D259E0273D1D062FFAB92334B5AF6115BBC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331169, "uuid": "85947070-de6e-4ba0-a295-2c39874bed72", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331169, "uuid": "c0faaa2c-7bc3-4f0e-b1b5-86a0828d8b6c", "value": "24576:c5EmXFtKaL4/oFe5T9yyXYfP1ijXdaiplzHPFKH:cPVt/LZeJbInQRaippF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331169, "uuid": "9380633d-8c9f-462f-9d60-57fe0539248f", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331169, "uuid": "5a92a371-9d69-47c5-9f3b-596708ac4919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331169, "uuid": "da3e6537-4939-4009-9a8d-981c63d6bf52", "value": "Important Urgent Review-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b896c71c-ba8e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762378259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762378259, "uuid": "e03e5239-45f6-4d98-b59d-8e8b114e85c2", "comment": "Malware payload", "value": "9eec6d87064e816154aa1e43978dfa12", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762378259, "uuid": "25db0b24-15f2-4c69-98ea-f22fc1347bd4", "comment": "Malware payload", "value": "c2058efc76f1e7a71e056b09774e52aec03c63c5124583c053f3738ec75f16a8", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762378259, "uuid": "6abbbcad-6ee1-48c8-b090-089e3b745e40", "comment": "Malware payload", "value": "2eacf365d7db98859d9d07011a1bc169095b6102", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762378259, "uuid": "448eb5de-0cf4-4857-89cf-de9391ba2418", "comment": "Malware payload", "value": "67e0caf96d4c91cb826ec8386845c6a269f2c09f7d3f636d5f5dfd7b3a69a93a9cca0c57ccd4b7f092ab544a8dd4e969", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762378259, "uuid": "89e7414b-6405-4b0f-ba43-256aae0077e6", "value": "T1B854128432C0B42EF9481AB27478C5F52BD6241E97D78B87753DE04AB9DA6B7AC039D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762378259, "uuid": "0a00bbfe-2e03-444a-b08d-b50d5b403f1b", "value": "6144:vAcXQLagTbJz30w9sMFAcXQLagTbJz30w9sMFAcXQLagTbJz30w9sMZ:4ZZJ70w9EZZJ70w9EZZJ70w97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762378259, "uuid": "4248aa35-2943-4254-8e08-187d6d67c180", "value": 293559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762378259, "uuid": "4eab0b72-287f-4bbb-b035-3b8279ab3880", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762378259, "uuid": "ef8c7436-dee8-4814-a995-1ae9c9e15a85", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc15b7d-ba56-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762354216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354216, "uuid": "b6771977-5bd7-4b39-b81e-f1d5e48bf601", "comment": "Malware payload (Mirai)", "value": "5f7a0f23c2e6367817067d8c8e8a99d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354216, "uuid": "fcaf0f5c-1fd7-4f65-9150-ee7b4c721323", "comment": "Malware payload (Mirai)", "value": "c20d3c02c256b72e08ad5da2733d7671df2308dacd8ee5d5ccb1c51dd157a06c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354216, "uuid": "3e652592-0ba2-42b7-83f0-f1060990205e", "comment": "Malware payload (Mirai)", "value": "f63277fdff1f211550b275dbe78229b5af6c1f17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354216, "uuid": "f6a62753-c587-4f21-9bf5-3fa5f854e7e5", "comment": "Malware payload (Mirai)", "value": "35570c62e96e4d5485167cac655c90bc996d4b14c9a79c0ce53afb9648fc51524709bfe3cb22a74fd785dc52bfe8bdd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354216, "uuid": "746f58e3-7af1-484d-9e58-ed5a0f96870d", "value": "T1E5E44A06EF440FEBC4AFCE30852E835B15ED9D8702D1A679A0BC8D4CBA9D5694FD3948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354216, "uuid": "3fb49e88-6bd0-460d-89a1-e4ce7bd2f7cf", "value": "12288:mHLpTldKbE9WC6f5gglvjXE0+eLIaA0WWf/+SHrBDmhB4amKcLmlHPInxbj1F/O4:X6ryPkr9jzp5bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354216, "uuid": "5f6a257e-8205-4a25-9d02-ed04b9a368ac", "value": 722588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354216, "uuid": "04361a2a-194d-491b-ad4e-9cdc4c73e364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354216, "uuid": "dd82c8e6-903b-4d35-82b5-ed2f62b25df7", "value": "Mddos.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cb2a02-ba63-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762359517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359517, "uuid": "cc7e7412-4f33-42af-8ff3-87ca5d65d272", "comment": "Malware payload", "value": "3b579f26404f83f19ce44a0142d5ffd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359517, "uuid": "49d235c5-f99b-4861-920b-0ec649dd86fd", "comment": "Malware payload", "value": "c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359517, "uuid": "f5c14686-3bff-4fa8-abce-9c4f0fd0c221", "comment": "Malware payload", "value": "c120b2fb76ce910f99cc536d3b70a1af82733976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359517, "uuid": "8aa5cbfb-3a4a-4e6b-bc0b-d8ec91176a23", "comment": "Malware payload", "value": "98b18a62bb904ee6196e40f40707f87ca3a336f131c2d88f9b5a2650e1709973b1e5499933918c8596d27bd5b7f45433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762359517, "uuid": "13206797-dae8-41b6-869f-f5f8f13c0d14", "value": "T189255A5B72A534F9E1774134C8A21A42F7B2B47517719BBF07A0877A1E232E08D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762359517, "uuid": "9439bb04-8493-4bd8-a6f9-0daabcf044a4", "value": "4ee1a6456f7ed7de8beffa6389d76874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762359517, "uuid": "a9d92d9e-f610-4143-824d-e07f3f04e153", "value": "3072:7gPoDgu8V8GdjRMyF6/bX414H0qJ9oY4Z2mMM:d0u8V8G/3FcbXb/oh0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762359517, "uuid": "6b0249d5-c5d0-41aa-82c6-38d7a36c3e4e", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762359517, "uuid": "33cefee2-d9c0-4ac9-b25e-61e9520b0bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762359517, "uuid": "0f2016eb-3669-4ff9-b8b9-46e4bfa7948e", "value": "SecuriteInfo.com.Trojan.Packed2.49365.3421.30139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbce4f60-ba56-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762354239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354239, "uuid": "93a48bb4-c3a9-4a04-93a7-bc199582c061", "comment": "Malware payload", "value": "691e323a8109d95706013bb09823ef56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354239, "uuid": "c4c14009-e6ff-4640-aee8-66ffe056d961", "comment": "Malware payload", "value": "c364862eec13d8f6b00c910eb43aaf7f7c9a0080a4e5f9452e4ac4e937a66f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354239, "uuid": "e96ba1b0-9c1d-4ed0-9ca9-8b8e3915fe74", "comment": "Malware payload", "value": "dc47b65ce66a93d7795ed5949667579613ecd980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354239, "uuid": "1a5d71db-323c-4ba3-9b90-bf840d590233", "comment": "Malware payload", "value": "af396d8f305a1649b10baf2c2b9ecf5c00b848d05f908a469514863afbd570b4097973972fcd419e01eca6b9d825e8e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354239, "uuid": "62dca3b3-02cd-4d2b-b0b1-d9e7048e0c5c", "value": "T1D33698E84DA16B10F6D683DA7056F5C4ED2B382278D9CEC8F77FD8A424D6C21F905A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354239, "uuid": "db99b169-733e-4d5f-8c74-1c9852b9479c", "value": "24576:15DnyOOCzV7Iplm0lJ2UBjDnkJ83FaEjq/qgVfjgB93Y/wYKhAk9W0v:ZzV7Iplm0ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354239, "uuid": "29d70b7e-c00c-4e07-9e87-a45cae7639fc", "value": 5324587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354239, "uuid": "0945cf7e-baeb-4970-bb16-91f3859c4992", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354239, "uuid": "f689c3b2-86db-44ce-b3f5-e1d85d503cfd", "value": "Insight.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9a4808-b9e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762304474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762304474, "uuid": "8639324e-506a-4e29-9b65-d2f8578fe90b", "comment": "Malware payload (XWorm)", "value": "f6c22772cbf9d609d7ea7ece081ae7fd", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762304474, "uuid": "d6f92abe-9245-4d2e-a69c-56162a5a2426", "comment": "Malware payload (XWorm)", "value": "c3b6ec7c083b42ee8fc740390176c8946d4e1334eb6309f3b52119db1107948c", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762304474, "uuid": "cf41dd6e-f7ba-425b-bede-a7e25405a668", "comment": "Malware payload (XWorm)", "value": "d9d1bc0756a34b7eca60bb9ec3f4f7aa50958b42", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762304474, "uuid": "c8619804-9a8d-49c4-8411-71816d7d2aa2", "comment": "Malware payload (XWorm)", "value": "b421c4c52573c83b74ec64c2ab0c006dec6d55ac66ed979fadfdbd6a5f1d60da6588bbceead6b92a49b4a41b65051832", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762304474, "uuid": "8d0a6e1b-0b38-4cd7-a525-175753e2594e", "value": "T167344A35F510AB7F1A13286271721F7B03EA394F5BA33A379586C5282E109245BEF1DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762304474, "uuid": "024b9cf4-19fa-4deb-a8f8-d5941ef303fd", "value": "6144:AW69f/Ape/AOawp7J4/LAfYKtL4lWfFeobfBWSI4Ez/RM6VYvuH0COc:HeWSftY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762304474, "uuid": "7487ca57-7bc6-4387-81fd-55e1e8fce6a7", "value": 238297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762304474, "uuid": "0ba76665-61ca-43c8-a6c7-44cc467ba452", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762304474, "uuid": "02382ab1-7bf6-42a5-92b1-6006acbc7020", "value": "z22output_1762289360.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cbe9cd-ba39-11f0-91c6-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1762341472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762341472, "uuid": "2fac91f5-e368-49b0-8d06-9fcf19ec372e", "comment": "Malware payload (BlankGrabber)", "value": "7b9df806a0b2815a9ddd4b741f7c09f4", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762341472, "uuid": "12e39467-9361-4d09-8594-9b4832069d90", "comment": "Malware payload (BlankGrabber)", "value": "c3c082c1f914e112c05c7a729692aa4051975087cd1b6aee154983a17b9d9dcc", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762341472, "uuid": "ca6e42e3-7440-4c36-9baa-5d185d645893", "comment": "Malware payload (BlankGrabber)", "value": "42296a90f604fcec270b9c4b1a191b66259b9ca5", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762341472, "uuid": "d19753a6-6880-4019-aa3b-9eb71303bd49", "comment": "Malware payload (BlankGrabber)", "value": "8d84ed99a290331f1ae97402eeab4a08a1b6ed4ffd3e2a174deb75b6a43796ca33b142e77c15143dffe499331dd80cd9", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762341472, "uuid": "cfd5ccff-bf73-40d7-8efe-192e92e81ab5", "value": "T15BA63312A51140FAEAE3697EDA52A641DBB335426320D2EF03D85779BC730F51C3EBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762341472, "uuid": "f801fba2-f6f4-4061-ae66-25b55d781dae", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762341472, "uuid": "f2eeb2f0-d5f3-44a7-a0ec-538c36e74cf5", "value": "196608:w1dbp3rwfI9jUCOORird1Kf7LOYgPg0uc+wit4e5jkhMg7N:wJYIHxQ7676g5wC5jkhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762341472, "uuid": "12874533-5e43-4e00-821e-bf1cb8de3f2e", "value": 10327870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762341472, "uuid": "ea094317-e0b9-4a7b-8347-9e11adf67d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762341472, "uuid": "bdc366d1-0034-4cb5-bce8-8d7509f1f971", "value": "Synasx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01996e14-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319540, "uuid": "0ecde714-b05d-4a5a-9c96-d66e0a84a64d", "comment": "Malware payload (Mirai)", "value": "707b54a142bf628b84715e468f16be04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319540, "uuid": "d56d7844-f150-4439-8013-8498b709bdd8", "comment": "Malware payload (Mirai)", "value": "c3d7ec62233b511d43d850c716e4eeb8cde98c3c5ffac55644a2baed6de41751", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319540, "uuid": "31c3f378-d13a-4ec3-b387-35199c39312e", "comment": "Malware payload (Mirai)", "value": "c033bca515a74aa1ee12906ec6a41f64f02859c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319540, "uuid": "213b9e6b-1fc8-4606-b9e4-a5a528897d12", "comment": "Malware payload (Mirai)", "value": "6fa6c9d0998812ed8df7529c48e5b7f7290e5d83c7d7caf3d1558e75c73896d50d3e509bd6adf64a4df1bdbc67b40d72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319540, "uuid": "344c46ee-bbd2-4de6-ab9a-6d7ede554eb6", "value": "T1ABB2D030E09645B15F70043EBC3DD7A27B8A07F1E27A61721A68873A53C650ED6F8767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319540, "uuid": "e516b78c-f57a-4249-a351-51a2085757e6", "value": "384:HjsMfG6LoRi6vOIGq0NDdeg6zWYWLqIB4itX/D4WW+4Y2IT1hymdGUop5heIi05:DeWoHvQqTzW1qdiJcWWPmps3Uoz6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319540, "uuid": "42987f80-95b9-4523-ab51-673d5ee1f93f", "value": 24000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319540, "uuid": "d25b0448-ed41-4cf0-a1fa-d284bc5ac179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319540, "uuid": "d8eca0d9-fdae-477c-85ee-9d4c3e5eb812", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc1911c-ba22-11f0-91c6-42010a9c0006", "comment": "Malware payload (SharkStealer)", "timestamp": 1762331798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331798, "uuid": "b0336e8d-0a2a-4778-b9da-bb74ddb93140", "comment": "Malware payload (SharkStealer)", "value": "a20834b8baa8d3e7a7d1bda6abdb29c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331798, "uuid": "58e4c6af-99b9-4bf8-9ff5-1f47f45666a6", "comment": "Malware payload (SharkStealer)", "value": "c430ac30d22f1301939ae0f1e21892a02aeb6f6772e7fa45dc2cc93037cb3467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331798, "uuid": "51005850-ad0b-4a67-ab08-1a5a79d794e4", "comment": "Malware payload (SharkStealer)", "value": "3fb0e46541d7add1867eb1e71654f364fe56028f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331798, "uuid": "34c40141-79ed-4d04-b088-65bc149bd1a0", "comment": "Malware payload (SharkStealer)", "value": "afa4fe1e14ed9445127b7816df50b10d1c46774cfdebc82c8f36ff39a334b610f073346b8ac1346ca472c94c2e38385e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331798, "uuid": "4bf4b521-f72f-4b0e-8152-a3ac63611e33", "value": "T185C6129562DC40A5C0F9C778C6EA5813F63A7C140B3AEFFF02A196552E266E1DF39720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331798, "uuid": "a0e17a7a-6deb-4e1e-b172-9ef26dc894ae", "value": "da7c7889a9af299fe69cc0665690e327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331798, "uuid": "b48deefe-1d9f-4799-988b-be286db68979", "value": "196608:2zVQIXlzPWRSICRJRU2OryiE66kY0soQWItZypdmt9XKn1UNFfqJEFMRW:jIXASISzv/VDca7tZybXn6hqJEFMRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331798, "uuid": "2858edff-ff64-4146-a342-24bfbdc2d7b7", "value": 11927120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331798, "uuid": "6585a5ec-573c-48e3-8aa9-683f23f8ca70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331798, "uuid": "da84fe42-685a-40f4-887a-0d344ad8088e", "value": "GfHsN4jfntw526LfXfSFcxEjoeP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242690c8-ba48-11f0-91c6-42010a9c0006", "comment": "Malware payload (Phorpiex)", "timestamp": 1762347945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347945, "uuid": "64c4aeb6-3642-439e-a33b-1a63b9f52a54", "comment": "Malware payload (Phorpiex)", "value": "55ad9839fa570d8986de3ccdf80adde8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347945, "uuid": "1a7d851c-3593-4075-b2ed-1f59b5201159", "comment": "Malware payload (Phorpiex)", "value": "c44375c99dd2886d0438f3c088439072604168cb53b90216f9a6f1b8d18db2fb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347945, "uuid": "1b4aef58-73f0-4f8c-aaaf-f96666f139e8", "comment": "Malware payload (Phorpiex)", "value": "0a91bb2d643c658927399ad73d2d72c6913f5b47", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347945, "uuid": "1c06fce8-931f-44b1-b758-fb4d8fd8eae6", "comment": "Malware payload (Phorpiex)", "value": "c041dd1e20e59657e822b0cb7b1451dda29f77c01bcd1803bf4fc1ac7f862cd7c86be7f4edd3fc2e438d2853d87e0452", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347945, "uuid": "19602ccd-0ba5-489e-8eac-1cfb043f80dd", "value": "T157123A1B7E8A0071D3A14DF06AB84B9D4B7D542337D662EFF373C18A1F64345A0472AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347945, "uuid": "bb33cd8c-0cbc-4750-8c2b-c45eace0f233", "value": "9db3169f0849392a7cd91364b6f1368b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347945, "uuid": "f70f021a-bc0e-4c64-8714-a46e7b044d6a", "value": "192:F7gEffYwcoBPsZ+C8GKFJxTZ+zmFhyMN:NPfoX43GKFozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762347945, "uuid": "6f9e155a-888f-4842-9bd7-16d0f846e199", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762347945, "uuid": "f9b532c2-1c07-45c2-8eb8-93e5f359a9f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347945, "uuid": "b4ac4030-ef3b-43fe-b18e-bb41ab6f57e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13b7e47-ba10-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762324184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324184, "uuid": "36e6aedd-6307-4556-b95f-7c3d4508b38f", "comment": "Malware payload (AgentTesla)", "value": "540ec781a007265e4fbedd5cfd375569", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324184, "uuid": "99151c2f-3047-4553-b952-0e5d9b49a897", "comment": "Malware payload (AgentTesla)", "value": "c4d42916164de106fcbb3514a3dafad03242e516664c0b7f8d88be99e6217683", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324184, "uuid": "46e756d4-3865-4775-934f-2e8a71b87e0e", "comment": "Malware payload (AgentTesla)", "value": "b4b881db46fb2aa2dd2e27ef373454b970ade761", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324184, "uuid": "9db36b34-e7d7-4670-b39f-6629dc3d24d8", "comment": "Malware payload (AgentTesla)", "value": "05d998b357908d0dbdf796fc9fd09699aefabc09a4bba8b0777f0b243fb5583b0d8b49b5f6d621a02d729b3bc053103a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324184, "uuid": "ffd664ed-f741-400e-8190-c66a9b2c302c", "value": "T1E94512049AC19863D5F25A714A7AE337C638FE2022C61A97770C7FAF6F5906213938DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324184, "uuid": "2b23557e-efe9-455e-a534-dbcf2fa04bfb", "value": "6144:jqC56ALcmpQFbVySc2pMOooOZFC7PPH9OvuGnzH6JOSOs+VrPfh8RBq/q4+96YJo:cA9WL5c2pE8PHZGT64P5aRIle5FVaFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762324184, "uuid": "ebabfe04-89f2-4d6b-9843-42cfb0a6aad6", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762324184, "uuid": "356c09f9-2c41-47bb-b52b-f8d283f468bb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324184, "uuid": "45a01f89-e942-43b1-a195-0eb037eaa0cb", "value": "c4d42916164de106fcbb3514a3dafad03242e516664c0b7f8d88be99e6217683.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db23c194-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318617, "uuid": "a3a3f743-f066-4fa2-b472-92a4cfb68cb2", "comment": "Malware payload (Mirai)", "value": "f4b86bcda873459c53dc54d5ea066d42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318617, "uuid": "7e03ff0d-eb66-4dd6-9403-f55ffe4dc215", "comment": "Malware payload (Mirai)", "value": "c5bb96ea93ee9b00464d67b12366c697b6db94c6d9a43690101d3faebe3a5f80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318617, "uuid": "0d3839f8-38a4-4e3f-94c9-35fda7ae9302", "comment": "Malware payload (Mirai)", "value": "5aee6bb156f502ec2b2cd0ba43f267405f4d6685", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318617, "uuid": "e5b7c926-d86a-4193-bc90-0b603c829018", "comment": "Malware payload (Mirai)", "value": "bc683fe3fc6af9165f3e8eb458f80713d19c5d265ad44a43df67922d4d649ab32ba975cb210bcbba839607a6bebb0312", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318617, "uuid": "573c6630-c32b-45c9-8bd0-4d12421696a3", "value": "T15E93D561BC82562BC5E423BAB6BE668D336577E5D2CF722BC8214B117B8551F0C63F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318617, "uuid": "37186c78-1ef5-40ab-b54f-5f389dbe49cb", "value": "1536:Ud+d+6yn9H/NTzULgW4W2luLaN5q00brz9ikZcxdw+7YU1:++dAn9eL6w0ecxdtV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318617, "uuid": "abed18fc-d038-4c04-8d60-759e94549541", "value": 93800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318617, "uuid": "9e4b192e-5f10-47cd-aaec-98f895704bd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318617, "uuid": "85dd2ddd-1077-44a9-8ddd-9d55bd9ca0e3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b2ddf8-ba4d-11f0-91c6-42010a9c0006", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1762350119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350119, "uuid": "f4b9dcd8-8cbc-4dff-8dd6-64d623828c28", "comment": "Malware payload (ParallaxRAT)", "value": "c34786a3be6655ca7fb286f56b86d6da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350119, "uuid": "533e14b8-d2ee-4858-926e-8d599c40d1c6", "comment": "Malware payload (ParallaxRAT)", "value": "c5bbf28f21d6c63cfddcc38da0278a505a7d6b20cb346501f2c19d93f6f410e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350119, "uuid": "d2a53dfd-263a-45af-8067-fdbc2255db28", "comment": "Malware payload (ParallaxRAT)", "value": "11fc73aa7cf454c48ddcafc869c7542b0c0398c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350119, "uuid": "7b1fffde-abde-4f20-900a-b0c16abde961", "comment": "Malware payload (ParallaxRAT)", "value": "fa3993d36fff406273466dafba4c02da55b413a1e6d5ebaaf64c41e93612d4abafea822ee8ca2fd185a646f34ee21bb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350119, "uuid": "9c47478c-49d2-4d9c-a04f-156d9c5d3803", "value": "T11C075C167698C920D1A30A74ED3ADBF1947A7E6AD970945B73EC3F0E7BF0A802851353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350119, "uuid": "1a2861a6-5bbd-41e4-927d-6c3efbc27290", "value": "79950a840db30321bb8cc67a78164f1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350119, "uuid": "97a3308c-dabf-45b6-a042-4d2f42554a86", "value": "196608:v4GdBxJzErPVKaJRPeVaeECSZp+ewca9xFIjxj1M4OZq:pJFErPVKaJRPmae2ZWzgxja4mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762350119, "uuid": "7a26d917-40b4-4fb6-9e3d-12b4bc6d949b", "value": 18257968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762350119, "uuid": "4d72692a-f48c-4398-b2de-3054d36432cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350119, "uuid": "7a8b1bc5-7c67-4c85-abdf-d4399c2f7f19", "value": "AVSVideoConverter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe66a81-ba27-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762334113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334113, "uuid": "0a2f68ab-056e-4de0-a1b2-7a3b7d0c9087", "comment": "Malware payload", "value": "307757e687af5523ce5230a31a4ff52b", "object_relation": "md5", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334113, "uuid": "0f7fc621-dcb7-41d8-a929-576e9dcbcfe0", "comment": "Malware payload", "value": "c6bb0f40f0bb31044ecee7ae1720c653798168a707e388114982e4befef12e29", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334113, "uuid": "b52f37df-ece8-4068-b647-17153cc2c76d", "comment": "Malware payload", "value": "2f595223d21600d32877afd759a83d63dbc5328e", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334113, "uuid": "1ca511e3-4abb-4c21-bcec-4d2ec2af36bf", "comment": "Malware payload", "value": "e158724d1c07163f7a2a647c0ecd53000a0633e18c575c489d7a9ba37c0e373c664be03a14b105d51d6d1b35794ebf5d", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334113, "uuid": "cecfc5e4-24c8-4da8-af55-8211e9cb7ba1", "value": "T12302E860762A1DF543C6956FC9EED20CE1EE46230A597894702DD3883F28D1083F57BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334113, "uuid": "296e6429-b009-4e96-bde5-f09dde9ccfd8", "value": "192:FtsF4AEuYfaIiCS1guvAIZTmTF13hFZij279Sh+QHSv4OlQz:F4HrgurTOlvQ2BSjHA4Oli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762334113, "uuid": "eb11bd8a-e54b-4097-b082-2bec0c1af684", "value": 8689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762334113, "uuid": "7e9d7656-bd58-4781-a2d2-eae6230cd581", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334113, "uuid": "89078a17-edf4-4b8c-87bb-ab5c4cf08051", "value": "c6bb0f40f0bb31044ecee7ae1720c653798168a707e388114982e4befef12e29.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831e9a47-ba87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762375163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375163, "uuid": "49a35eb9-c904-4f16-ab59-6101591757ea", "comment": "Malware payload (Mirai)", "value": "cb7a7c245835ef9a62bdbfa3f974cd78", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375163, "uuid": "4f87e967-a9d5-4d24-beda-1116e0d41175", "comment": "Malware payload (Mirai)", "value": "c6db69c0c10b139961cddf5252573f45ff2483a1f981aa28a171ed53503e0738", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375163, "uuid": "3fb1bb55-ae4c-456d-b179-a27a19381849", "comment": "Malware payload (Mirai)", "value": "5a20d31a825aabb74f815c6d49d4ce6b0a45bb26", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375163, "uuid": "17630afb-386a-4dc8-aa07-d405e2cb774c", "comment": "Malware payload (Mirai)", "value": "8bb30e9f289adf3c6c6115150f6736e514839138c784bc1b0bae84489a4d04fef5357aa5b092328125eb0dc067c58deb", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375163, "uuid": "7825f778-efff-411e-b4ff-6baceaec8323", "value": "T1CBD43845F8809F61C6C539BAF74D42A873074BB9D3EB72069A145B3437EB96B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375163, "uuid": "3dc7fe0f-53eb-4450-a789-b57042ba03c1", "value": "12288:7f+qbaWWZMTV4zCdS1D/0A3CEVJcjk4oI297tm8pVkChp:3mWWZMTzdscAyQJmkFle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762375163, "uuid": "c8a593f6-4823-44b5-a7db-674df7f91a90", "value": 604376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762375163, "uuid": "a8290a34-4429-4ad8-b84f-bad35c662c03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375163, "uuid": "96b77771-9bfa-44d7-93ba-43963cc8cf78", "value": "Mddos.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda9b45e-ba47-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1762347773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347773, "uuid": "6b651fa0-3d59-44cc-a790-ed9fc1efc673", "comment": "Malware payload (GCleaner)", "value": "e07dfc62117a5db74a362a299eadf431", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347773, "uuid": "2c58d6c7-fe71-4ccd-8554-508466a04a9e", "comment": "Malware payload (GCleaner)", "value": "c8c9366bfd88bfac1f910421425a8c1b0f7a6fe41aa9d1d5363851c87231fbd9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347773, "uuid": "f48522a9-3b56-4170-8e90-6a535aef2cfe", "comment": "Malware payload (GCleaner)", "value": "7cb6aa33635a896ce15ae9ba01b484ec1e311d62", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762347773, "uuid": "368a9ff5-8e59-4d1c-9fe5-b76a8cbb1c9e", "comment": "Malware payload (GCleaner)", "value": "2f297befc26198c30bb7f529045a3f12c58c56c89e670e151529615b64b56e42755f8978f12a37ca26d73b017a7025c5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347773, "uuid": "b6b34fb5-e738-4814-a12a-6fea3add94e4", "value": "T15206DF0690E04B39EF6BF879A91FFB389BC5D33F0435DE396B804B684B21547A325646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347773, "uuid": "f3b38b4c-1c8e-4bfd-892e-ed37f46f7cf2", "value": "da69e04b921ba242383b7a8376a58523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347773, "uuid": "45d8167e-0dd7-4af2-9e8e-63f63775507f", "value": "98304:IbAdD7FkTdGFu/9XKf1mYuxFGNpiA2fHFNy:QADpkw8C1Yopt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762347773, "uuid": "97badc0a-7b8d-4979-9b71-97ae0feae2f5", "value": 3912992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762347773, "uuid": "c66ddd26-1ea8-4c33-914d-6ea08ad509de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762347773, "uuid": "2f582787-6c60-44da-b1db-e574e40d213c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e94851-ba6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762363331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363331, "uuid": "183e45c7-a698-4fc9-b24a-5dee2360ba97", "comment": "Malware payload (RemcosRAT)", "value": "c43b2d3f0ddb038f18a84ad471b580a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363331, "uuid": "7469a995-7da2-4c3d-baeb-041ab0c2037b", "comment": "Malware payload (RemcosRAT)", "value": "ca54ece8f6070eeaac4fae0635129df2ecb9664683cc5bdfc3998d7a351e651e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363331, "uuid": "f7788ee6-1fb5-4087-aa03-b93febb4abcb", "comment": "Malware payload (RemcosRAT)", "value": "9a9517d0b8f26c8456bb6c8824587a2d1edffddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363331, "uuid": "31dbca3e-5c25-4488-8b13-d60a98c1b079", "comment": "Malware payload (RemcosRAT)", "value": "eb34759bad01b03de84b468d094b90a2f02f09bd8e2af9af475b533d8b6ea8fcf4fdbe1f73149ac8c685c9e86dae889f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363331, "uuid": "9e87c6fc-8993-48e4-a4bc-c3dd911fbe7f", "value": "T14155D02373DE8361C3B25273BA257701AEBF782506A5F56B2FD40D3DE820162525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363331, "uuid": "dce600ba-d7b0-4d86-b44a-7e445fe2ba09", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363331, "uuid": "e0608a0c-7784-4789-b4c2-e76d00c73c60", "value": "24576:2tb20pkaCqT5TBWgNQ7athzo1wJyMWP7J25YVxX9xNilGFy0tdTnHZ6A:jVg5tQ7atW1wucW3X9x0lGIu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762363331, "uuid": "717b013b-edbb-4036-b0ab-ebc14e797c2b", "value": 1340928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762363331, "uuid": "4bb4015b-6d04-4094-b9ce-686c04f1af17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363331, "uuid": "6c20dd17-1e09-4722-9298-33a32aa20cf9", "value": "PO NOV2025_1762289702_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272e1338-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376726, "uuid": "976cc6d9-c09f-40c6-9643-f0883e4e140c", "comment": "Malware payload (Mirai)", "value": "ca4137cd2e4a6617de0bf04f06185fd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376726, "uuid": "a85acda1-e55f-43df-8415-c21f54b93662", "comment": "Malware payload (Mirai)", "value": "ca72684a37847296daccb5ae1afc9096301e41e86c21bb10101a2376e4e0a72c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376726, "uuid": "f18106d2-a8c9-4723-a55c-5d1cf1f1ff7e", "comment": "Malware payload (Mirai)", "value": "793288b3eadbd48f5f3d250ad4a24abbd242138b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376726, "uuid": "24f78927-2105-4b88-8e71-9d8d27183e5e", "comment": "Malware payload (Mirai)", "value": "e90bdbe3d1e4681544d642ddc990d65638f93ef720b7c8ccfa11e63a0d03ce912d6a264724768dfefad51b194ea1d987", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376726, "uuid": "32171d99-a762-46d6-9f34-acd2008bcbe5", "value": "T1D7336C36E029DED0C6560234A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376726, "uuid": "de8d8e45-87b3-4d14-ac90-292ab364a2de", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376726, "uuid": "777d317e-0453-45d9-bf3e-a0bf4fe63c64", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376726, "uuid": "7be9d822-d844-4b1b-9b42-b2513a656b62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376726, "uuid": "5530cee4-6880-42ef-bf25-727297cc65c6", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fbc158-ba29-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762334634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334634, "uuid": "1ef08093-d21f-4846-b9b6-7bdcfb3813f8", "comment": "Malware payload", "value": "b7a6b03b38fabf2660936efc20e8ecd1", "object_relation": "md5", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334634, "uuid": "e4ff2fb8-99a5-4447-9474-46a416cc16e7", "comment": "Malware payload", "value": "cb9410b5d9b0477fa4ec8a099614191141cf9f6bc363cef98eb8200c6f59b1f3", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334634, "uuid": "107f9752-379c-4272-ab44-3c7c102882ce", "comment": "Malware payload", "value": "cc5a7ac698198ba77342b85247dd70909f1e56f8", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334634, "uuid": "931aa664-a061-41ef-81fd-60f75cdc7bca", "comment": "Malware payload", "value": "15a28f9ef591afbd58b4e92d144914f2b0658616335cbb4e050feb40e94d6ac0861f4afe327cb1b4f5d3cdd88b48ef68", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334634, "uuid": "64d60a19-331f-4d8a-939a-26f5fe4e77c1", "value": "T1B5F7223ED21C1ED6598166D63BDCCD573240C7CB65282B0BAADC843DEEED8526D0CE68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334634, "uuid": "603348e6-406d-450f-b0a0-73171b4ca294", "value": "1572864:IBNEuEjK6AdufIW5pHEfy02Tga1/Sj31TfiSCjPt4v:2BEjKTdGf5xV02TgaJSjFb/Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762334634, "uuid": "861d2ee9-983c-47de-bcf5-ee9057570822", "value": 71663224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762334634, "uuid": "3b1f6ed8-8677-417a-a072-bf661251e779", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334634, "uuid": "6a81d709-f0f5-457e-9e7e-029f081d8c32", "value": "29437feb574e602b71a4debb1b68eb51f14ea6ed85e6cd253bb240222c8714b2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da7bf3f-ba96-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762381408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381408, "uuid": "730ab5fa-6ed7-429a-8f79-6f65ed855be1", "comment": "Malware payload", "value": "5411c661d06bb0e6c45fa2cf0a4370a3", "object_relation": "md5", "Tag": [ { "name": "Miradore", "colour": "#AF339F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381408, "uuid": "8023d724-9160-4e56-8ecd-166fdd7c78d3", "comment": "Malware payload", "value": "cb96f5ef1afd6df13c55ad0cf307c4fd2b18e6cd67b984a5f8a72d29da848257", "object_relation": "sha256", "Tag": [ { "name": "Miradore", "colour": "#AF339F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381408, "uuid": "bc7893c8-a5f6-4060-81e7-c0b890fd1a02", "comment": "Malware payload", "value": "8fe70069ef0af8e1264febf4d9ae4d7999b3a564", "object_relation": "sha1", "Tag": [ { "name": "Miradore", "colour": "#AF339F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762381408, "uuid": "4469865b-2b80-475e-bc2c-c3d6e2242a86", "comment": "Malware payload", "value": "c70bd3b6e9218818fba298ffaf68d93cbda49b9e24693d7da8eee51cccb3eafe170ab260c64930b121d4aee89eed3ccd", "object_relation": "sha3-384", "Tag": [ { "name": "Miradore", "colour": "#AF339F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381408, "uuid": "44f7c6ae-4c2a-4fb7-b5d2-b50a81e88733", "value": "T194B4BF017580B331E1AB1A38093796644ABE7D604F71CB4AE778B61D0F706DF9721AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381408, "uuid": "1bb00ebc-77d0-403b-be42-adb7a8560b7e", "value": "6144:7ArptraBqLlAGXNZXxWaAb8s8K1aVo4uJ+6sai0jR4kQJJOHUD4V:kFBaimCHxWbJeSJFsaFR4QHXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762381408, "uuid": "c16419e5-d673-4094-baab-0d65fda09dc8", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762381408, "uuid": "c0b9b40c-f15e-48a0-8931-abff6feccd02", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762381408, "uuid": "eb44919e-52a9-4ec8-8e7a-fbe886253cb0", "value": "Statement_ID2331312.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cefb93-ba57-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762354692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354692, "uuid": "69d914e0-f1e4-4f26-a7d3-99e11879e7db", "comment": "Malware payload", "value": "81f12a90c79cc1649b2706b9b33ceb44", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354692, "uuid": "da2cdd19-03c0-497b-8cb4-261769ca0d6a", "comment": "Malware payload", "value": "cc520460163ced71f23750955c1f3382bcb338a74d4ce765faa27f6f889b2294", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354692, "uuid": "139064c6-5119-4c2b-82a6-5bb4f52db2e9", "comment": "Malware payload", "value": "c105e47e6764b60d97bd8ae27c30f18fbc7321cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354692, "uuid": "a7947202-625f-4dde-be14-4e713dab5f1f", "comment": "Malware payload", "value": "5ba73739b43641acd6dca8985d26bd6166461bda150ebd4eaa316628cb491f44364440354eb44f7ec3e4a34dba3af386", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354692, "uuid": "62303145-2e3a-45c6-bd96-9353cf9c8c89", "value": "T167056B70DD2805990F4717EEFC6506A0C8BEC91A123764F2F6D51B5D730AA9CE3BE268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354692, "uuid": "4d825ef3-ceec-46f8-b577-6b463e445932", "value": "6144:bjSU1gw2ElietciIT3f9bjdjlStU6/vXT:KET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354692, "uuid": "8eccb7da-9ed4-4e2b-8fc7-9e7c015ef71c", "value": 811455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354692, "uuid": "f443230c-2400-48fd-9e1d-c59637aebf3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354692, "uuid": "e5f7be99-bb63-4bc1-b204-636d0be62cdc", "value": "PROFORMA INVOICE DEC281025_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa9479e-ba49-11f0-91c6-42010a9c0006", "comment": "Malware payload (WraithNet)", "timestamp": 1762348493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348493, "uuid": "eb94aedf-bd67-42ff-8167-994f176587e2", "comment": "Malware payload (WraithNet)", "value": "090ced3bbde0c008c3685657383c70f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "WraithNet", "colour": "#B7FFA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348493, "uuid": "66fff97a-118f-4c61-8408-eba32e573d55", "comment": "Malware payload (WraithNet)", "value": "cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "WraithNet", "colour": "#B7FFA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348493, "uuid": "b6d9c48c-d8e9-4efc-a76f-807b881111fa", "comment": "Malware payload (WraithNet)", "value": "481a68daf3460745bb9b257ddcb48a4dbea7db80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "WraithNet", "colour": "#B7FFA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348493, "uuid": "982bb406-5cc1-4261-a75a-71b1507d1574", "comment": "Malware payload (WraithNet)", "value": "3ef63724507804eff279fe1afa31eb5df08c7c96bc1ae1afb4b8979538338180447836d2cb85d045ef0866782507bbec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "WraithNet", "colour": "#B7FFA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348493, "uuid": "6d048957-bf86-4294-9769-181ccc611b0a", "value": "T189454B27E26385F8C56FC074865387B2B970B8694234BD6E1D98D7212F36E605F6EB30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348493, "uuid": "25606ae2-c062-439c-b53d-6b2aa56efd6e", "value": "fe34b4c19b3a91d5abc0521fced5201d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348493, "uuid": "8ee9ab5e-f1cc-4edf-87c1-bd29e513b778", "value": "12288:9zB7JvOHde81v2pRHGhrbJSiA4+AZDonxcOm8I34Osmor711lW:9zB7JvcdHv2/GhrbJSip+ACeMbOix1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348493, "uuid": "71cd25c0-1578-471d-be68-a82f8eb870e6", "value": 1209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348493, "uuid": "72de858f-857a-40a3-a146-b0376318d379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348493, "uuid": "a4f25bc3-8335-49bf-9472-2a25e7f84885", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31accb70-ba13-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762325204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325204, "uuid": "ea48bb03-1a43-42e0-9288-c21a5a0f02dc", "comment": "Malware payload (AgentTesla)", "value": "28e98a118e21ffdfd4a1350fd504bcef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325204, "uuid": "3c51095f-35b1-46d7-880a-50b838c22dc4", "comment": "Malware payload (AgentTesla)", "value": "cd7f84ed727c6d99fc45ee16803cb55f4ff7fcb1a8fb088e730b77ec11b5e470", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325204, "uuid": "637dc6ab-fe1f-4f97-8f68-518dee218c1c", "comment": "Malware payload (AgentTesla)", "value": "cd175c7fd223d7e1695386f9be9d3b1664f3bfbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325204, "uuid": "3f8f0783-5f5a-403c-bcaf-e2965fb1278b", "comment": "Malware payload (AgentTesla)", "value": "d387c09ee961ec4d75e6b2cd5758605d69e2d391d7a449de9fc9317d782470c050d56c3b83ef90dc3bc5060480ae808a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325204, "uuid": "439a8ff9-1848-49f0-914e-db268251116a", "value": "T17C340F037E88EB15E1A93D3782EF6C2413B2B4C71633C60B6F49AF6518516825D7EB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325204, "uuid": "91e43901-0e4c-44b9-b802-a22d32f14126", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325204, "uuid": "ab61c43b-5866-4346-a4c6-3fe1a66ad837", "value": "3072:ApR4RVplpeJKmPrbwVudhBEe5TyCSFqX:ApR4RVplpeJKmTbwwSVCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325204, "uuid": "e5203544-e7d4-4e17-a63a-09503f18ffea", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325204, "uuid": "8dbf8c8c-459b-4db8-9986-f3a7d53b7e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325204, "uuid": "e13567a5-3353-404f-bada-e563e0115a7a", "value": "cd7f84ed727c6d99fc45ee16803cb55f4ff7fcb1a8fb088e730b77ec11b5e470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eac354b-ba3e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762343614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762343614, "uuid": "833bf393-fc50-456f-9822-59d8fa2b40b3", "comment": "Malware payload", "value": "7952732716e671cb16fc6915d49ef2a3", "object_relation": "md5", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762343614, "uuid": "b8416c8b-6e7f-47b8-a356-9f35068905b7", "comment": "Malware payload", "value": "cdd264163c69872d88d14b74f9b51fd1eb4e014efd62503c54a0a853d850f621", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762343614, "uuid": "d927eadb-835d-41b5-b88c-6f09c88908f4", "comment": "Malware payload", "value": "3dace12ce323edd79ec24515eb77bf93fc717aa2", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762343614, "uuid": "cbe4ac3b-b51d-46f6-b7da-649673742f34", "comment": "Malware payload", "value": "ee553aa8ea6687415840318a30eba85365af33fe67b20b9f3f8f4864b80d9e320c4fbf6c77c0f83fa75d17b98dbbccf9", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-247", "colour": "#F79962", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762343614, "uuid": "1dc4e6a4-ff88-4b0d-8f0b-c65cd71129a9", "value": "T178056FAA3742B48C88E475DFBC5E1893C7AC01D519A2B77E0563E02D7056DC3E922EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762343614, "uuid": "c25b9934-102e-4532-bc96-7cac58c484de", "value": "24576:71+lvnGSJ45uFVkIgDwJrKrzW2miu8TkoO3CH0bVbfJlXwpmYastptPMYSXIIicV:71+lvnGSJ45uFVkIgDwJrKrzW2miu8T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762343614, "uuid": "768549ee-9173-4526-aa3d-3e2e3bb78577", "value": 803318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762343614, "uuid": "fcf9d87c-25e7-4170-9a20-0c7692a5b9d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762343614, "uuid": "83f0ca5d-2201-4455-a8f8-16f9dd82c2f2", "value": "sextz.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f80c65b-ba66-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762360822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360822, "uuid": "9cb4e4ba-21df-4fbe-8f0d-bb18f2e4cb06", "comment": "Malware payload", "value": "0e60fefa9317d7c86cf25a92afb4a976", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360822, "uuid": "14aa7334-285b-4707-956a-9f7290842572", "comment": "Malware payload", "value": "cf37c65721f06542cf7a8492a476a8e7b9b4c7ab27699e6596bb0f5dad65f0cc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360822, "uuid": "80aff0de-0ecc-4a89-8e74-13fdb86e4ce1", "comment": "Malware payload", "value": "83c27b11eb3e47eccb17049868687d580c9d2761", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360822, "uuid": "9525a249-5031-49c4-9017-87dc72937df7", "comment": "Malware payload", "value": "13ed1259723a4f95f306eb030cfc9e251bd2a78b61ab4b35416af27c9ba46cd824c43bfdf565c9ac015e923bf4c9f27a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360822, "uuid": "1af0af03-a2b6-48a0-b7df-2051437f13de", "value": "T1FDC51A4359DF0DAACDD677B8A1835336B734FD308B295E3EAA48C23119536C4AE1BB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360822, "uuid": "85bb9d66-23ea-4967-9146-91d309dad260", "value": "96ea0a05de9bd8786a471a32a5c6040a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360822, "uuid": "d2fd71ce-5543-4040-b53b-9dffc5cded4c", "value": "24576:R+PvfeJVxthwuHIy24rIXRuriBobEtPYMRox1WFjfpdJ6clMi81s3Adc+zM8f:R+PvfaxthwuH17rIh03ohhFjIc+o8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360822, "uuid": "5cb883b9-1f76-4bd4-b95b-6245c55f0ff5", "value": 2650167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360822, "uuid": "7c087089-6ced-4116-9103-f2c8acf3c814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360822, "uuid": "44d15640-e970-4cb4-87e1-a0f4ca0d3085", "value": "0e60fefa9317d7c86cf25a92afb4a976.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23159e47-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376720, "uuid": "03f93a94-677e-4874-86e3-07db6d72643e", "comment": "Malware payload (Mirai)", "value": "788cdc6b418c52f0a36bfad1abc00604", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376720, "uuid": "6ab4b287-3f3d-4eb5-9f4c-abce53143f9f", "comment": "Malware payload (Mirai)", "value": "cf66771a1f64316a3e2b56bce793cdc97886233bdffb478dfcbc790038d8e6ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376720, "uuid": "b04302be-719f-4660-8bb3-52227edb15d3", "comment": "Malware payload (Mirai)", "value": "466ea49de9e99eec63b8abaec154a71a44e03c0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376720, "uuid": "7407e891-47f9-48c8-b3fd-343ed4ffda3e", "comment": "Malware payload (Mirai)", "value": "22a52a225b1a4b193da4f62fb9b94b90293c212ab61beb0a376b3a1fdff288684264e942497cfd5073f461718b085690", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376720, "uuid": "d6edde66-71ea-4e85-8f83-b5c9321c9981", "value": "T1E682DF30619B75F5DBF10430EAAECEC6A7160BF8D0FD369316596B78894210651FD2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376720, "uuid": "4da2b0bf-34f1-4c58-b8b0-cc666bcc4401", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa9xhymdGUop5h5lQ:6GV0P6+kom0tVAoNvm+to1zs3UoznlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376720, "uuid": "f527a5e0-4cff-454c-aa65-962ce5f09f6a", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376720, "uuid": "bebddfae-e2db-43e5-b68b-186ae06694bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376720, "uuid": "17b1ce10-b668-4aa0-bb49-7c7169986415", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f84917-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319549, "uuid": "d21d7187-c1fb-40cf-91d4-9999ef8e3944", "comment": "Malware payload (Mirai)", "value": "f99df45565e50431c13e49c089eb88b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319549, "uuid": "9cf0658e-5dee-48e4-9afe-c53e92d77d72", "comment": "Malware payload (Mirai)", "value": "cfee5c898cdaf6b80e842642d7a761e3978ef95c48522c247cfa2b7ed4a20349", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319549, "uuid": "53a889e2-71ae-4be3-831e-db3e4b1d3c0d", "comment": "Malware payload (Mirai)", "value": "649fbdf62a7b6a613b045db6686382af1ff3f7f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319549, "uuid": "3a3585a7-73d4-4c2b-b5a4-d9b4fb596d0b", "comment": "Malware payload (Mirai)", "value": "f00263cf90b03db7b1bc197fde4039f88fee7298cc9c20b81e74ae8092f09aa8c4f03f29ddccdf2543be658dfe3fb8f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319549, "uuid": "f7099ec5-824f-4bad-a3c1-72e2c617fce8", "value": "T19913F1D34237F5F8E45F60B60067E194F86329570B8A637311DA80EA9C6DD833767A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319549, "uuid": "90f4b80e-1a07-481b-8c40-949520993cd7", "value": "768:UObobL5OXRR5vQtqTu0Ny91Gd7C6YIIn0NwWl147B0q13QYkAXPBv4xwJxx0KN:XobERRtS0+c7C6YICQexlu4vCkPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319549, "uuid": "daa2e66a-f7b9-482d-bc49-ea195fc3918a", "value": 41876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319549, "uuid": "88bc237a-5c1c-412f-a289-4cd90eab482c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319549, "uuid": "be8cffc8-8b35-4fd1-a558-be322aeec8d9", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b987cc-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762376917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376917, "uuid": "c4200127-2d45-45d9-b263-037cd86abc6d", "comment": "Malware payload", "value": "7c0ada3f925a73abddf9464182411e8a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376917, "uuid": "af75a4af-cfcf-4ed2-b8c0-565a7af03d63", "comment": "Malware payload", "value": "cfeff8b9217403ece28877de1c15b32c04b4f569a5341860ed4ccab4d7e68259", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376917, "uuid": "da75c541-65ab-419b-83f3-92e81ad9c5a6", "comment": "Malware payload", "value": "09afaaeab88f7b0c713042d7cfd3916ab698f94f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376917, "uuid": "70a13734-6221-473e-b034-a8da5842d5f8", "comment": "Malware payload", "value": "cd0f7c27e22e0332ae3d09e13fe5aef9c43b4fd873909ad548c447d127459cb6f9f7a518efd1bfd06beaca6dcf676268", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376917, "uuid": "a11c2d78-7f31-4cab-8ddd-7104db6f9d9d", "value": "T160819DD7B43006A3E2611F8611EDE0F3463143A8F87A3EBDC19E9D783404D89E720AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376917, "uuid": "be330d83-bc91-44fd-a62f-e8440c194164", "value": "96:vQT664AT4qr0UDeSHCk1mXNmJiMJTFXLJe4tCkWSejZtcZP/ISX:W6G0qpPP1m0EMJJtH0SejLaP/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376917, "uuid": "b07a7e4a-c593-44dc-8d6d-7e4629caeca0", "value": 4006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376917, "uuid": "6c857008-83cd-4992-a05d-9b142712b1ea", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376917, "uuid": "4ef89f5b-21c5-4bff-b8b6-747480303437", "value": "PO00009226.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaa7aae-ba4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762349087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349087, "uuid": "ba595d6c-3b33-4af3-8e44-375e6827859e", "comment": "Malware payload (RemcosRAT)", "value": "9f08305b8d7e5ddf13ac1d4c7d49f45a", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349087, "uuid": "d0be9621-27b9-4c70-93fe-42f732234fd2", "comment": "Malware payload (RemcosRAT)", "value": "cff8f4c0531006285d239f2dc16b7559c5c87a8aa6f1b4f08b074389faad42bc", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349087, "uuid": "ac1d0c6b-5824-47de-887d-4bbf47ce54b4", "comment": "Malware payload (RemcosRAT)", "value": "7f020bdf4f2b3b349d527d81953da5fcc09e3b4c", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762349087, "uuid": "35f708c3-d860-40c9-b37d-1f1402ce7554", "comment": "Malware payload (RemcosRAT)", "value": "25bdad71c5475db5ee174863df2e6975f2d5e761d6421aab2b65a626c4e715e864c72c36802c102e00ea0fc4b8ce5acb", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349087, "uuid": "aea09ad7-7755-4890-9aeb-61d0d407ed39", "value": "T19E07A75B3DF19099A29819F0AF134DF81E31EAB5CCAE6C8DFAD4D20C291C671908797D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349087, "uuid": "0f232f0d-0bac-4371-bc23-b6951b3fdaef", "value": "6144:1qgwHhhcomVi8yQIOOdMydOfeOrv41D2GtFQGTAAYuyZ:HohhcomVi8yQIOOd74x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762349087, "uuid": "97bd6f74-6d81-4aa3-91ce-cd8ad41d38be", "value": 17917952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762349087, "uuid": "9b8e68a0-397d-4aa9-bd82-1d2fc4b9d5ec", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762349087, "uuid": "a755f304-ef0f-4b54-b6e6-13883cfe98e5", "value": "cff8f4c0531006285d239f2dc16b7559c5c87a8aa6f1b4f08b074389faad42bc.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53c2959-ba40-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762344752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344752, "uuid": "0aae6712-6d28-4b89-aa12-d5dd08f9fba0", "comment": "Malware payload (Rhadamanthys)", "value": "219d3a0b721e1380dcc8a2a1ec506579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344752, "uuid": "779b9392-517c-427b-94fc-0ddc823d4860", "comment": "Malware payload (Rhadamanthys)", "value": "d179b3ec3d7a8e8b41a2ffa8024243b8eefcc9236cdaabb94892a7418ab092c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344752, "uuid": "d83aaefe-a080-4f99-be3d-578936121931", "comment": "Malware payload (Rhadamanthys)", "value": "b8014e125f68f0ee1a4f4a102813285029662559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344752, "uuid": "d9f2286a-600a-4e61-9569-9ec398858be1", "comment": "Malware payload (Rhadamanthys)", "value": "946e4a13359a5ea6580b0209f12cab29c96a852d0115c20e19892d3f4153af3f03b9f1bfd5c9cf76245c20438be3eeaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344752, "uuid": "4c1f794b-b540-4792-8fbc-3e201fc4d1e0", "value": "T193663B0398F093C9C09EE6385DB6A256BBB43C45433637C39B52BBE51E766D43A39318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344752, "uuid": "f3e31c15-49da-419e-86e7-6c2e61ca00f8", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344752, "uuid": "20c79d95-6248-437b-a02c-a27525f812a8", "value": "49152:o7LWx5WZaXlyW04qcmlc336KDjeyyc/cH88yDLSKdLfNwR4VzLz0jwQ+JFHdH9zU:octrxxLSHkYCsmdOQgzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762344752, "uuid": "e3b058d2-0ca6-4326-896c-5440f103b0c6", "value": 7032101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762344752, "uuid": "6bc24c1a-a503-44b2-a326-c1e6a32ff6e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344752, "uuid": "4825ce67-98a9-4154-9bcb-eb4b9a71be9a", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f451d66-b9e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762307135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307135, "uuid": "07c81efd-cb03-43dd-8e35-01739510d0c0", "comment": "Malware payload (Mirai)", "value": "c52bd67a27fe17b6658f8a81b5ba7fb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307135, "uuid": "63e32138-0756-4a1a-8e9d-5a3658f6573d", "comment": "Malware payload (Mirai)", "value": "d185c0a49b7e3eb1bd93b2e252c13a2b343a65a66c7c791e5542b0ee51b92235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307135, "uuid": "c033d44b-71dc-4895-879c-c1fb0809ce62", "comment": "Malware payload (Mirai)", "value": "52de9f03b08ac7041818a180e3136705463300ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307135, "uuid": "c9a1ee5d-122d-4fa0-adce-d6f2036f1805", "comment": "Malware payload (Mirai)", "value": "212ce02e3032b167bbc9df56fe1a3963bcdc3a81b5f8357cd3e39c319a361377c205f4badf2c089f094b147ef0527c88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307135, "uuid": "23ab2cb5-84c9-4cc3-b9f2-9792dab2a584", "value": "T16A82D03052AB74F5DBF10431EAAECEC257260BF8D0FC369312586B78C94650621F92DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307135, "uuid": "19c7dba3-5d99-4de7-8863-b57e2b31a9f4", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaEEhymdGUop5h5lT:2dV0P6+kom0tVAoNvm+to1Xs3UoznlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762307135, "uuid": "e439da66-7e59-4517-b833-53bc26b46b04", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762307135, "uuid": "7007508b-2d75-46a6-82a4-e5820ac413ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307135, "uuid": "f8db9e11-354c-40a0-817c-e249f4179583", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec24ce0-ba4d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Latrodectus)", "timestamp": 1762350110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350110, "uuid": "f2dc8e7d-5b15-4ff3-b655-fd776be31b41", "comment": "Malware payload (Latrodectus)", "value": "387044aa0f276b98b8a116f2b75cddd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350110, "uuid": "84d78a7b-a03d-4198-98ec-cf8f4b75282c", "comment": "Malware payload (Latrodectus)", "value": "d22c96565d2640d993f7280731112287986c24cb1636126da391634ed478ed1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350110, "uuid": "b222b0b1-790d-4b30-ab42-08c97bfcf9c9", "comment": "Malware payload (Latrodectus)", "value": "db325b03e0f9732ad6e8a8fbfe28c3cbb7076396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762350110, "uuid": "f9072d44-f310-4dcf-9388-e2cba106eb10", "comment": "Malware payload (Latrodectus)", "value": "c1bff8e9c9fc691999d53c809e407a8848281fdcff5acbdadba0fc139f21b661821ec14b638f9af120ca1bdc0a250981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350110, "uuid": "db079a8c-c3a7-423e-85fc-ae940e7bd7b7", "value": "T1D0755B26E7E001E8C56A8178CEBFA656D5B5389C13B027EF2A50771D5F37BE84A34312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350110, "uuid": "2d896dd1-712d-409f-8844-872ec2e22dfc", "value": "49152:vqSNjMo8i3DhysDMJU0gJdkCBtv5wihkSI5t6RZA9gi0BXEnwynoG:/I5tei0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762350110, "uuid": "2e2937a6-0bfc-454b-8aaa-deaf49b7612e", "value": 1652784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762350110, "uuid": "f16c49e6-7565-48ee-9454-7cd6229ebafc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762350110, "uuid": "19c5d00c-b37c-4a22-8783-3b5d720c8731", "value": "GameOverlayRenderer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272f484e-b9dc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762301564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301564, "uuid": "de693d34-c6e0-44ad-8bd7-b343046ede4e", "comment": "Malware payload", "value": "d6904f14c87e9d84383d258f134e0549", "object_relation": "md5", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301564, "uuid": "2a12025b-016f-478a-a29d-da5802e71315", "comment": "Malware payload", "value": "d250e2ab3d4e5ac213f563c404f1949d2ec7f173d223f846559079bfaf7471cd", "object_relation": "sha256", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301564, "uuid": "65b385f3-b599-49ac-a044-7912ed8cb33a", "comment": "Malware payload", "value": "ec6e17a2d7dc38b7c436103105791f3a46a79dcd", "object_relation": "sha1", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762301564, "uuid": "88b796c1-82a4-4893-8d91-1336fa9e3477", "comment": "Malware payload", "value": "3e3bec0cb76698a159f6642498b63b90aa4d780a4a2a024608d23aeb2b212039610f7cc4a8fa8a3f97c6e7eb87eda3b0", "object_relation": "sha3-384", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301564, "uuid": "863ab73a-eb3b-4815-bc78-16a6ae515288", "value": "T134C6E0B23BDE7E4A5E183319A49D1A4D0F5EC5240E83BAD8D4D71FC4580F88A26D4ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301564, "uuid": "8ef1e2e1-c94a-4d42-ad9a-e41a0d878bca", "value": "49152:yFh/T6hzTnGfab1bqfJVB03OD99qmFh/T6hzTnGfab1bqfJVB03OD99qpFKGdvrx:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762301564, "uuid": "533387f7-6af0-414c-85bf-e6fa07e092ac", "value": 12206238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762301564, "uuid": "a9a413fd-e03d-4aa1-a3fd-95b5819a1c2f", "value": "image/svg+xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762301564, "uuid": "6ec82d52-cdc3-4449-a078-70ee09671ae6", "value": "DENUNCIA_PENAL_por_VIOLACION_DE_PRIVACIDAD_EMPRESARIAL_A35007.svg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3011c4cd-ba27-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762333792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333792, "uuid": "90f90a01-ddaf-41de-8a70-1ff555c0c7cd", "comment": "Malware payload (RemcosRAT)", "value": "29bf4ab1f479b2e93a15ee35d73da8ac", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333792, "uuid": "fa6c5eeb-5e27-4015-958a-c1f8f423d92b", "comment": "Malware payload (RemcosRAT)", "value": "d3176f06025bb66fda5faa1cf365dc69febf937e1a725e624e7010eb3fed27fd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333792, "uuid": "65a09d8d-4667-43c2-ab8c-f484552eb5d2", "comment": "Malware payload (RemcosRAT)", "value": "9ed8d14e91c22fa729ed2301f3a3941c39fff6bf", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333792, "uuid": "f8b18b90-d31d-4f15-8dec-df3f53a0d560", "comment": "Malware payload (RemcosRAT)", "value": "11e2c6d24c06ce5e5758d2dfadc797dc11adefc5714e6b548b6e3d235277f2b74d18467f8984b2114836409b0df72a34", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333792, "uuid": "6a9b9ae6-97c5-4ad7-9f24-882e2a1acfad", "value": "T118D13945E4D7104E0D37CFE02E9078978E70E4168C7990A9FB569A98233A8FCF57C5C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333792, "uuid": "c058e7f3-c0d1-43eb-b2ad-3ebad34e9ec7", "value": "192:PItmX+wHilMOu0wu2mlMFa404bO074QPy3:P8y+wGQ0wNml6BZbXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762333792, "uuid": "526ee78f-51a7-4c42-8a00-830a596d6cd7", "value": 6435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762333792, "uuid": "8f19459d-e1da-4b9a-a9bf-bea7de864d97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333792, "uuid": "08b9f98b-eb1d-42d4-9c49-7b9c0810e59d", "value": "FP 132573462346204_11_2025_MAGNoncoalescing.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3fe5fd-ba6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1762363343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363343, "uuid": "527918d4-50e9-497a-a1ec-1c98d81bcc6f", "comment": "Malware payload (SalatStealer)", "value": "04c75d698f986bb3320c66f7ec1df12c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363343, "uuid": "8f01619e-05a0-4094-af66-56293293489c", "comment": "Malware payload (SalatStealer)", "value": "d3f09ea5f1f41a2122617a6ded78ce7eb468ccc19afc9c98283f36e7fdd31bd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363343, "uuid": "6f42f3e4-7722-41ae-8c28-7b90e19df968", "comment": "Malware payload (SalatStealer)", "value": "00b3c8e844720193c2217f03c39372b9b821b3c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363343, "uuid": "7f64eee1-5014-4aa4-a365-30492720a57e", "comment": "Malware payload (SalatStealer)", "value": "c2a0e2a6d6128a5c3b2659026aeac61315a2264112b1c979fcde7816e5d22dab488ba0568c7998aef850f3bc6a2d94ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363343, "uuid": "2f337315-b855-4cc2-a4e7-0f15d2661bd9", "value": "T1E8C64911FACB94F2E9435931416BB33F23305D058B28CBABEB587B6AFC776911876205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363343, "uuid": "8426d60b-8b47-4866-8d51-c052dd5783dc", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363343, "uuid": "a409eff2-e9c6-453c-b666-9c40ebaf4820", "value": "98304:63M/ZhQ4S5vmIC7ptLsguNxgnBA5MET7mQbz6GU:BhGCnwgWxgnuzT7mQbz6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762363343, "uuid": "5aa9cab4-233e-49f1-a820-09d85a8fd789", "value": 12470784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762363343, "uuid": "31253d64-e17c-4f98-9b7f-0a575cfc0bb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363343, "uuid": "cc8c8682-3443-406d-b351-44e220ad6ff0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c900854-ba69-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762362320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362320, "uuid": "3e6a0581-97c2-4c79-a302-fe90f97d0a35", "comment": "Malware payload", "value": "61ec0da2534319d562d028ebe91adf12", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362320, "uuid": "d2f7bce0-4abe-4904-b9e2-c38c61bb2815", "comment": "Malware payload", "value": "d414beaf0fc1d0bb89628b38958ecbb9ab40e03fca0da1d8becd49b41e51e919", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362320, "uuid": "0f534b81-40f7-4ee8-bd7e-51d65518dbbb", "comment": "Malware payload", "value": "025ce15c30c1f6a5c770257999cf3019e2be9691", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362320, "uuid": "32730bff-a13a-446c-83b2-530e3d2cfa94", "comment": "Malware payload", "value": "3fc9f3178c2278a6d283ac6741f502739add4574d8287f0701ea1ae677669bcf4b8f30a493ebf432006f97ffa56d3235", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362320, "uuid": "d385b315-cbb1-4c6b-b40c-d509c8532a50", "value": "T12AA53360FEA84958C52F3F36AA83614A4FF0BCDB0586135D74A6F9D20EB0C0A6D5E35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362320, "uuid": "f4f6bb84-f061-423f-ac8f-59ea9b96cb8f", "value": "49152:kVKiio3YbkRFZzMQLd/6aYipxTtLYONNbQR766mWdkE:mio3ZXzTLd/6aKOTw+6mW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762362320, "uuid": "3c4aa77a-42fa-4af0-b40c-4864ec554b34", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762362320, "uuid": "25097b49-ff3f-4583-a7a6-79241366411d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362320, "uuid": "5261a908-190d-48c7-9421-a4b0784f7bb6", "value": "QVZYPCHI.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530cbe61-ba27-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762333850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333850, "uuid": "6e9ee6e2-7231-4950-b60b-0c4407879a4b", "comment": "Malware payload", "value": "1588b01ef68541c1b228b11604af2667", "object_relation": "md5", "Tag": [ { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333850, "uuid": "ce207600-fd17-42a1-bb4b-d847699bd85d", "comment": "Malware payload", "value": "d43777d7f8ba2dadd82ce954b5c393a0238f3b52dd3f2a3a0aacd76739ac5add", "object_relation": "sha256", "Tag": [ { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333850, "uuid": "aa0ace90-aaa8-473c-ab97-8df724d6254f", "comment": "Malware payload", "value": "7a27df55f83f952f7536e46c1d0d45b315af4601", "object_relation": "sha1", "Tag": [ { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333850, "uuid": "df6ca4a5-75dc-48bd-a999-6f8e5d3a5662", "comment": "Malware payload", "value": "d73490dca6d701c11044bd2415e2276a10651592965635e75cb8c1d5007a764bae87890b4bb81bc1486592714fb5bdb6", "object_relation": "sha3-384", "Tag": [ { "name": "eproqwrqwprwqlprqw-fans", "colour": "#8D8188", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333850, "uuid": "edb1100e-9a37-4b45-8357-06a32719fef7", "value": "T10FD62A70D352A161C197C0208FC64FF564A1E57B41356D0E5BC8EC2A2ABFE71AB6D3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333850, "uuid": "dd35bc58-7a15-4b07-90be-858bab9d567e", "value": "a8c957e21192a70886a6e5360f9f18d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333850, "uuid": "a7478f8d-7054-44ed-b028-f7cc3c500176", "value": "98304:30pyPDdOudH3ofcX/92au+Xz8hCqWFSc9q1WFWnqekMx:3xYudYiIoXcWFF9q40qek6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762333850, "uuid": "394e4529-4798-4229-a007-c41c3052638a", "value": 13805056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762333850, "uuid": "155c3dd7-a3c9-4308-b24f-52fde511bba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333850, "uuid": "f054b5e0-075b-4f16-bc3e-958ec5b55ada", "value": "d43777d7f8ba2dadd82ce954b5c393a0238f3b52dd3f2a3a0aacd76739ac5add", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaf153d-ba04-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318891, "uuid": "3aa76bf1-7ad5-40b0-b8a7-05bef62f0898", "comment": "Malware payload (Mirai)", "value": "ce717f48e13e1a7a5fa5f97aa7a97c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318891, "uuid": "0d21d6a1-75dc-46ba-a647-831665137209", "comment": "Malware payload (Mirai)", "value": "d4e3be858398bbf8947478a80b174b94fc2679fddfe16bf8da18afdbccd99cb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318891, "uuid": "2085d61d-76a9-4aca-8ba7-0e3088bd1b58", "comment": "Malware payload (Mirai)", "value": "a464aa5c0efe0ffe74cbb9c6a8b33d2fe8ef101d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318891, "uuid": "9fb0074e-65ab-40d2-8a4c-fc82cd3752f6", "comment": "Malware payload (Mirai)", "value": "985ac43ecd13be8e17704934fe7dae4ad3da30da1c56dbd7e2d9763f4b7e8a8a3a24075fc50dffb18e95f992f1f6c5b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318891, "uuid": "6b512957-9f54-45d6-891e-0e8ed8e9b226", "value": "T1238329227D7A1D2BC5C068BA22F34725F1F6538A25E8CA1E7D620D4EBF2465031877F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318891, "uuid": "410e2285-aa45-443c-b054-88697d737f8c", "value": "1536:62KNytKngIFD0qPXc6Z4r02N+EA8StGbt5ROeHQaYkte5VOQ:9KNytmFDt602N+EAPkb/oow/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318891, "uuid": "d5a28557-724b-4755-ae8b-b975c93107b7", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318891, "uuid": "ea84ace3-a1e5-4fe5-9dce-03f0ef95d50c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318891, "uuid": "8d351865-562c-428c-8ddb-5047f54787b6", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ec055d-b9f9-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762314154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314154, "uuid": "280fce35-c408-4819-9658-387d75c64fce", "comment": "Malware payload (AsyncRAT)", "value": "5922ffeb6ed95c70df6e06260204344b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314154, "uuid": "fdefb620-2968-4ef0-a1fa-4aba54a430d7", "comment": "Malware payload (AsyncRAT)", "value": "d6536dd169868aa8f781d58323d1cd2b34102d31d62375f6befca3c4b2385152", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314154, "uuid": "534879b4-9304-4d24-93b8-cf5db4e07d56", "comment": "Malware payload (AsyncRAT)", "value": "bbd982fac5aacb2f6deb7b4bd6ac97cca4f58d9b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762314154, "uuid": "b50c73c0-42f6-428f-b381-8fc0269cce88", "comment": "Malware payload (AsyncRAT)", "value": "8333913d9ce9b05c6d71d3232b98a2ac8e186a032d972bc5d6158693e53192b162e3499bab5795f9ff249d9c3734b39d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314154, "uuid": "28716c36-5f13-4c56-8268-6a10bfc765b5", "value": "T129537C183BE50611E6FEAFF558F17252C276B753D903965F64C8418A1B23AC9CE803FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314154, "uuid": "78e0bf47-8ab9-49fa-a215-083187848af3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314154, "uuid": "02295681-b8df-4e1e-8d51-3e8f190c17e3", "value": "1536:fwlz0IrU/PRUNJDsDkbZHInH46cAJ28OT96jV:a3oPREDrbZHylJOT965", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762314154, "uuid": "14a93211-9701-451e-9b19-45dc9a3d3a42", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762314154, "uuid": "78e366d9-4af4-4ebb-a0e8-f88d86cb10f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762314154, "uuid": "6a82b602-6849-4933-9876-34aa9f117533", "value": "x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c921fa-ba87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762375160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375160, "uuid": "cc5daaa9-4f45-48a9-86ed-429dd4bb4a4a", "comment": "Malware payload (Mirai)", "value": "c1d539de0fbacf5e02611b5eff280274", "object_relation": "md5", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375160, "uuid": "5bd4a026-dd39-4831-a49f-0517c6280516", "comment": "Malware payload (Mirai)", "value": "d73cb4e855e7120c78cff153f56c2aaf09ca1948cb236095d70c6e62003e8e0f", "object_relation": "sha256", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375160, "uuid": "37a7106a-ff1a-45ce-b5d3-da12226db8c8", "comment": "Malware payload (Mirai)", "value": "183703460301242e2bff5831ad51081af6f356ed", "object_relation": "sha1", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375160, "uuid": "f6b00585-cc35-412e-8201-47d5e5ba3126", "comment": "Malware payload (Mirai)", "value": "ab5865fd5d6bdb4933b4f2014c8767f0ed80ab79d74fa97ea542a29ea8702083a133ea29bc956da68061b0216e6cb5cd", "object_relation": "sha3-384", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375160, "uuid": "fe77c801-98ad-48c9-b9c4-27c28af575e4", "value": "T179D47D59FE4E3C42D3D7E3389B4A83A1722B75E4D32352B27941520CD8D6AE9CFB1A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375160, "uuid": "2c489e8b-31ff-4e72-ba8a-560cdec4189b", "value": "12288:qYlqoyLBMtNSj8uO99D0TlMOb8VoAIdzR70Ps5RfJq3Ni:qEqoyJApD0TlMG8WXB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762375160, "uuid": "801a299a-cfd5-4541-a792-c8b13a86d571", "value": 645376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762375160, "uuid": "3c07af59-e23a-4f7d-982d-b6fdab26cbc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375160, "uuid": "b6c46b07-887d-4b10-b9c4-d7fb0f5b3a33", "value": "Mddos.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c684ea4-ba28-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762334376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334376, "uuid": "09541407-fca7-4cd4-b008-b241dd34a9ab", "comment": "Malware payload", "value": "093bf4e2f924b55ab278df9c70a58b64", "object_relation": "md5", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334376, "uuid": "00fd1d18-84a2-45d7-8443-3773c5de3088", "comment": "Malware payload", "value": "d82908a37d1ee20b68087940f113f80afded47353128a5c8ed9e90a103a9b867", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334376, "uuid": "c9608e16-4e15-40ba-a5fc-acdb7ac0f355", "comment": "Malware payload", "value": "37fc457b7c87d07838df2300723d3ba9b02b2541", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762334376, "uuid": "5282af0a-9e0b-4a7b-b699-e0d4ecdf73da", "comment": "Malware payload", "value": "52948bb1020610dc32a280e1b18b5548a3f64dc7931b3c4c776e8499e83d4134033533cf9c15b13f173cd206f9a3de74", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-180", "colour": "#8DC496", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334376, "uuid": "c9de2237-c9c6-48f9-88dd-c153f3a48a22", "value": "T162E723DEFC9CE02023725892A3354269B735B58BDB5DFBFD08218651A69304ECDFC698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334376, "uuid": "1f733a6f-54b8-4880-b801-cbb6cbaab7e6", "value": "1572864:nNBjdpCbRjbRGzelnaEuWZfihkQJa9PLrOnQf52iE:njj3C95GalnvhZQJa9enQf5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762334376, "uuid": "7cba8abc-2bd9-4456-873b-3179c9b89756", "value": 66129423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762334376, "uuid": "e8e930a2-ac88-40f2-92b6-d249b521227e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762334376, "uuid": "b7ccb5e5-5839-4e0f-9730-562857dd9c2b", "value": "a6294a1a2de0e8e5d0aa258cfaf547b0802989f366a84c985a4beb18e4f97f37.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80d388f-ba12-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762325081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325081, "uuid": "8ce24e44-e94d-4d4f-952b-3e0cf54659c7", "comment": "Malware payload (AgentTesla)", "value": "55d912fa38bbb3d9f5928f16b50f2dbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325081, "uuid": "d46f3e1a-2208-4c1c-9f4c-392723540be4", "comment": "Malware payload (AgentTesla)", "value": "d86d40017cdb993291c9e2452a412aa012387ceffaf038e95711cc578f79d77f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325081, "uuid": "6a7a1f47-9316-417a-9023-21df1dfa28d8", "comment": "Malware payload (AgentTesla)", "value": "d0f0314b5a63e3480f91650ebc0859e6a641df9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325081, "uuid": "25b2c990-c9c6-4221-b68e-e9b50b8931ba", "comment": "Malware payload (AgentTesla)", "value": "aa41e8eb04a79987956ddd0a7130864a1293b439ddc2afe2b6e8d129c0ec6f80f8583be6c610fc9600c4a0354d072986", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-memosrl-it", "colour": "#02B6DC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325081, "uuid": "a663a8e1-1f00-44ea-9707-cd6c36191271", "value": "T137E433FF21C31621B585727DAF18ADFAA3B07D4E8D534242AE964A41C6137018DF63FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325081, "uuid": "d7505690-0c1b-4f4f-b5c4-ff2f3f47ebad", "value": "12288:s6h1ZbwuM+7MmlFDE4Dr+brd4Fux7uPTDzcNCbQEB8KunZhDQFfO9BZCwN8CoJk:Ph1N8pmlFEK+bhw872bcnc8KunfxBtNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325081, "uuid": "bdf63c04-c861-4a8d-b831-a14ba17f9f45", "value": 698549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325081, "uuid": "fe3a3d60-8834-4eb6-bd55-b3ffd499655a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325081, "uuid": "46bc0323-cf2d-4e25-95a4-23bdb00dbe14", "value": "d86d40017cdb993291c9e2452a412aa012387ceffaf038e95711cc578f79d77f.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0af35cf-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318626, "uuid": "9936155b-47db-47e6-9b4e-f219e8c235ee", "comment": "Malware payload (Mirai)", "value": "f60165f0ae09b1a9061fc584386ca05f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318626, "uuid": "711d42c2-af7c-4841-acf9-32a79903a05b", "comment": "Malware payload (Mirai)", "value": "d96690e326ad336e10d208ae070f119dda9adaeeaf97fe8adbdd212f1cac4907", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318626, "uuid": "8d5ac664-1d69-4e2c-a202-0eb9b453a32b", "comment": "Malware payload (Mirai)", "value": "1eadfce1bfa09b9e33d7108ead3d94514494352b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318626, "uuid": "7ca5290f-6ac2-47ae-ab39-1e15e1d7ed7f", "comment": "Malware payload (Mirai)", "value": "c7f29ec67fc65d47a03fc840e0613fb430f4bf5031bd7726307a881d86852f701c26e13e3fd2754d8b7c0069a5a0bd49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318626, "uuid": "f7179e54-2040-466d-9a0d-a6a39f9aa2eb", "value": "T15DD33841B9829A27C5E123BBFA6E018D332563E4D2DF72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318626, "uuid": "4ead5d46-1252-455b-bb44-3d2d07a34df6", "value": "3072:snFif7apx6XS+kUgpjWXGs2MobmaY0qhzCQSX:sn8ZS+dQWXGs217YbOQSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318626, "uuid": "a79c4f81-98e5-46f5-9ccd-abee23a7dfa8", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318626, "uuid": "d87f8a3b-9089-4873-adf4-3ac618255158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318626, "uuid": "a625caa7-9bbf-4451-a530-64daf5189520", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0946d15-ba56-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1762354220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354220, "uuid": "354f0e3a-603c-4945-9de3-ea84be2abb6a", "comment": "Malware payload (CoinMiner)", "value": "69e7f5fb38f80bb28fa92940a5049acf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354220, "uuid": "574475fa-e684-48c7-9f35-8c2b021bb674", "comment": "Malware payload (CoinMiner)", "value": "da026a5eeff1dec78606051a1710afae91b24093a3efdbf7e10db6dd600921cd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354220, "uuid": "79d5fd08-42a5-4667-91a7-20187b00032e", "comment": "Malware payload (CoinMiner)", "value": "11656cc4418fb777518d3e871d82a7a17ecb2561", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762354220, "uuid": "28cc8145-2a2b-423d-89f0-db01ad8470c0", "comment": "Malware payload (CoinMiner)", "value": "f8cd3f90b52aab7ce517d38d0aeb25d2cfdab284237cfc43f4ed315491ed4c5ab330bf2032bc5fe33992bae259360347", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354220, "uuid": "14c71a83-db37-4365-b671-9c8f26d559ee", "value": "T10B21F38B2071D2722B0E8438079FF046A907504384080A41FACE7B057F79F6AB67779B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354220, "uuid": "103e3710-a22b-4e8f-ba22-245d516e37b9", "value": "24:g2oLDC+cl0kr7za/55AXMVUQutWMGbWkAuOhdXzsgiO96Milf4J37g:ghNll/zAXMyQutpG9AuOhdXQgB96MiqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762354220, "uuid": "67304ab9-fd52-4075-9686-367abf46aa86", "value": 1163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762354220, "uuid": "be15cc31-d9a1-417d-bf14-6496e567f03f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762354220, "uuid": "f58574c4-22a4-4632-b157-080aebd7af46", "value": "d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b015549-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319556, "uuid": "b66b7a17-8e3e-4b7e-8d86-f2a95e054ecf", "comment": "Malware payload (Mirai)", "value": "54c09f1e08bc7aa9daf540e8906c6131", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319556, "uuid": "391ade1d-3e87-419d-b272-98ecab66b400", "comment": "Malware payload (Mirai)", "value": "da32f8b9d90fd290c41e0a5810512d6a63237af574cfb37a3a3475fede9fdc71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319556, "uuid": "4e496eb2-e7d6-41df-8857-92fbbfc12e2b", "comment": "Malware payload (Mirai)", "value": "5d189cd8ee163c4ad3bcc59fbc92e35a1d8a7f1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319556, "uuid": "283c0812-537f-448f-8135-0ddddd6975f4", "comment": "Malware payload (Mirai)", "value": "746e09654d80dc2183671db9506e075e8e6fb6b22871e86a965c9751f7a45ad29db6e1e751637a653ae1293a8e2a245c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319556, "uuid": "1af03a8c-d5e6-49f6-93d7-4d37c8eaf69e", "value": "T1FF935B22F979193BC8C4A97662F34322F2F6438B20EC9A1E7D710D8DAF5565022677F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319556, "uuid": "658b0f20-e753-4c35-a6a6-142aa937cec9", "value": "1536:W2CLFJbDpMyvR3OZSIx0SHlQWbDtQCcq5LjQxAzyNt/9ob:V09Ox/OCc6Lkcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319556, "uuid": "e715c360-c922-415e-b767-ef084fe98c09", "value": 94952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319556, "uuid": "0752026b-1737-48e9-a973-a7a974a1aa40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319556, "uuid": "dafa44e3-7b81-4109-8dd2-664c7fad11e5", "value": "nwfaiehg4ewijfgriehgirehaughrarg.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a886189d-ba3a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762342154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342154, "uuid": "0d18df02-6490-4bb4-8256-5412fc6c4ebb", "comment": "Malware payload", "value": "d0fe72624fa693bfdde2a1a78232ccb2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342154, "uuid": "8f4481a2-a6e3-4b0d-83a8-99ff04a498d2", "comment": "Malware payload", "value": "da647747526edf2db62cf53652f45ac1f29cb67f5176fcb15c7bf2819450131b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342154, "uuid": "83b41718-d016-4d38-a089-6048f765044c", "comment": "Malware payload", "value": "ef6af69a311b859814fad7e95e6c10a4aeea075e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342154, "uuid": "a3163c37-c1da-4982-9aa0-d92d154cc636", "comment": "Malware payload", "value": "5d54681480d03fe1ab02583adb434fdfef60264945432fae438a3f87743384520481ed5ee7194415d7f79390df03821c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342154, "uuid": "f0fa97c0-2596-40b9-8445-a5f69cc5f9f2", "value": "T1FC761282F744997FC4B68236053646A25267EC268EC3D7835A49B23C5D778CC8F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342154, "uuid": "d39daf55-ace7-457f-a23c-380c43e1867a", "value": "196608:dOzuDcyDnXzKGMvhlFg/dl9DOPgg/yr4syi:dOzu9njq1gn9D0gg/yrlyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342154, "uuid": "88738cdd-7239-4602-9f50-ee3e35816f0a", "value": 7417324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342154, "uuid": "3b8b9f16-0cff-4b43-92ae-9a8ba190f9e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342154, "uuid": "1b7a4074-230f-4431-9bf7-359e5ad01d5e", "value": "SignalAway.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af81c32-ba67-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762361298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361298, "uuid": "ac3c2f08-a113-448f-a3cc-efe77b5500ab", "comment": "Malware payload", "value": "df3dcdb80c26194750633e168b220d2c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361298, "uuid": "12f5d0f6-d8b7-4148-a736-dfebd76033b9", "comment": "Malware payload", "value": "db0f91e8c042495bfc426a500dee6716b912ec3eead2ce5357404f3ba2b41a82", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361298, "uuid": "5deb46d8-72d7-44a8-b344-83b968065ce0", "comment": "Malware payload", "value": "5a26d2ea13c589934b625d0be399e3fb281dc4b8", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762361298, "uuid": "2debee8f-8d36-417b-aa23-27ea6349f2e9", "comment": "Malware payload", "value": "205fb82e94eb764bc47910da6a297e91569a0ddd3b0e263ed9c3b9c19205c787ec27c9a228857a2281f78fe964a562da", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361298, "uuid": "850bf910-7c7a-406e-8338-8c7106bb1e57", "value": "T10517AE05B79C88CBC56E4739CDAB03193731BF803325BE5B1A28733508A66DDEE56726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361298, "uuid": "8e49af79-0b22-454b-a0ca-302fac9548da", "value": "196608:XzhdllDn9Rc4uM1ffMt/vz/EowruTKb7Z2o6h8q6JTE0kvhe:XzhhJ9uM1XMt/jJhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762361298, "uuid": "26f0fec4-45d0-42a5-a9c7-760f65998bae", "value": 19752960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762361298, "uuid": "7dbfde25-162b-4ef2-b2db-501877deb2fb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762361298, "uuid": "ec4978bc-d7c3-4825-9e00-eb2d41320563", "value": "\u8d22\u52a1\u62a5\u8868.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8471ba9e-ba87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762375165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375165, "uuid": "80eb6459-36d6-4f74-81b2-a71fdc047fcc", "comment": "Malware payload (Mirai)", "value": "b901c0f8e5e51c0c0218ea19ba25eb3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375165, "uuid": "304ed4c5-d66b-4e86-b964-42c59da4f640", "comment": "Malware payload (Mirai)", "value": "db83c9b85999badace502afd21e8ad4a39ee0c52f097c6b19cfee060eb142868", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375165, "uuid": "52f40f5d-ccfc-4727-9608-3b901cc3a5c6", "comment": "Malware payload (Mirai)", "value": "406f6559fcf6a21b43f947ff1ab17c19f56b93f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762375165, "uuid": "6d8c72b3-13cf-431b-bc75-a45901c8a8ad", "comment": "Malware payload (Mirai)", "value": "7274d5424bd371efabf0bab5cefc2d3daa560416df846e7412b4f8398693ea621370e9b50a7e23d3ea6b7c0c1b28818f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375165, "uuid": "7ab414c5-d8e8-415f-8280-abb1acd27f22", "value": "T156E47C9377218F94E321D27105F38B655EA421A20AF39085A3BCD3207A51B6D6C6FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375165, "uuid": "193b87d6-1365-4213-88ac-b8179f1e666a", "value": "12288:9Y+BJ4NXwIZ3N7uWVXcvim/U2LG5Ckj3G96tqpsmCf8p3sw0cI:9Yy4NX53Ny02im/UQ+Ce3u4qpshwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762375165, "uuid": "3f412b5f-ec20-4245-8453-26471347d8a9", "value": 718492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762375165, "uuid": "7fe4c209-d273-473d-a177-11e79ffe2ee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762375165, "uuid": "f908967b-9841-4070-b990-d61fbbab6055", "value": "Mddos.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe47a5f-ba16-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762326705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326705, "uuid": "0ef4620f-7eeb-4cc5-b030-90e7643a31a2", "comment": "Malware payload (Mirai)", "value": "7f26156690df6f70feb5d4ea4bfd7a8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326705, "uuid": "c592ceb5-99e2-459e-9ca8-d52e840fc289", "comment": "Malware payload (Mirai)", "value": "dbca1071c24a994ecfe3fc526035f4bef20e2cf8b04bf7e7bc4c25cae49ff0b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326705, "uuid": "b52efb68-c2c3-4f30-89f4-cade438011a8", "comment": "Malware payload (Mirai)", "value": "8ddd37dc8dff067c7e8c9c7d9d62de7d650e2ca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326705, "uuid": "64e73fb7-d0b6-47d9-acfa-2d6f7817a0d8", "comment": "Malware payload (Mirai)", "value": "5451bdcff162569d3675766ce064754edf275d5dab4ba57001faf74c92bc73f50db6aeae58206b0a6b9e5a8983c91af4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326705, "uuid": "52fe4d66-11f2-4344-8099-e614e7020fb1", "value": "T10E334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326705, "uuid": "9378c56b-41b6-4cca-ada4-963ce9175d5b", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Tw/:ivW3jdQGqt7Y+Z+zN9cGgI6b/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762326705, "uuid": "0caca6d6-84d9-4db5-b1a2-08948b7933dc", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762326705, "uuid": "74505f88-6cbd-4963-849d-f3621fdf4b63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326705, "uuid": "0f105b90-0fb1-47b3-ad5f-4e7378d4b048", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb34c4d-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316932, "uuid": "95a515f1-f5d4-409e-b61f-b20bb7863265", "comment": "Malware payload (Mirai)", "value": "70301f60cfa959142e2d21c4538330cd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316932, "uuid": "89bba15d-1537-494c-8bda-e4a138970c3e", "comment": "Malware payload (Mirai)", "value": "dd47b5f7dda2ade9c11ef05158d62d5d5f63bc909cfce42a03008f7e1b1928ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316932, "uuid": "08dea1c9-6429-4ab7-81eb-161f7aa9ed7a", "comment": "Malware payload (Mirai)", "value": "1559bd551946945a3cafcdb5f3761edef8b194d2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316932, "uuid": "95e18ca9-cd06-461f-a800-6a3eef28712f", "comment": "Malware payload (Mirai)", "value": "e688ef813da4ce0297fbc1485e013f3adbf76201d895ee9e1469150d99ff4ce2dc8a75f0daf22c64aeacf92c1eb592fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316932, "uuid": "5cee5dd2-37c6-463c-ac13-aef960f2e7ba", "value": "T146117C906C851587A8DBFE1C712A93F231412C74E5A0123DD2A7EE16C87EE32B90E631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316932, "uuid": "84d1c822-53cc-4cf5-ab02-6e5e302d65b0", "value": "24:XtA/syYzZ3OhXvuS9dLa+Jdz7+y5yswTm6:XtA/J430vu4usdzzoJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316932, "uuid": "13a87e59-8084-478b-9cea-62186d85685d", "value": 910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316932, "uuid": "f88fe5cd-db83-4521-83a4-ec8cbaa339c7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316932, "uuid": "114a401e-cdb8-4bcc-a1df-4bbf261c1391", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a92b8f-ba16-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762326531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326531, "uuid": "85812ed9-34cb-4fcb-b5fc-5d395bd0e06c", "comment": "Malware payload (Mirai)", "value": "3b5514868c0ebbeb5666434eaeaa61f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326531, "uuid": "039437ed-dfcb-47fb-b4f2-1d21475b26a8", "comment": "Malware payload (Mirai)", "value": "de2d765b5519d50c9507d2cc1a6ac8124b06d0646fcc092aca6a926a9ff3acac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326531, "uuid": "3777408d-b0e2-4a84-a2eb-bfabb3c70869", "comment": "Malware payload (Mirai)", "value": "1221e4e163f3ef9bd79decc2dba303f9b66712e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326531, "uuid": "b1c11a03-664b-4954-888e-cfffd4b90b46", "comment": "Malware payload (Mirai)", "value": "2e9aa32e47db2967a34e82a1ae1a0efc0219904143c248d9312465ea97731313a3c85d71c17a5841a0add5084554d6a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326531, "uuid": "a61eedf8-d36c-444c-ad3b-36b9b33391bb", "value": "T1B1932A56A8819B11C5C4237AFA2E028D3313277CE3DFB2129E219F2477C695B0DBB956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326531, "uuid": "7335c3e1-528a-4e02-9551-6e1461bf95a5", "value": "1536:QFnRFvNc1otpeJOwtM8GIHus61Co5deJam4gMW37a+iOAZFSpLE7EDQYKyp:eTC0pYo3eJatbZFSpLEgDQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762326531, "uuid": "5c72d08c-c755-4f52-aa16-374bc0ccf1a5", "value": 91868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762326531, "uuid": "ac655d05-944b-4763-a378-af544628e014", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326531, "uuid": "8d1e0992-8c76-4af6-b331-2be128eb73c3", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6441be24-ba27-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762333879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333879, "uuid": "420b4580-6294-4b9d-bf4a-3944533c9c13", "comment": "Malware payload (XWorm)", "value": "afc7bff876415c38454aef9a336f3da1", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333879, "uuid": "b2d8a494-bebd-4e9a-b99e-741b9a10a3e0", "comment": "Malware payload (XWorm)", "value": "def0ea35156c716358dd17857c630e55eb9d9d9745854b65bd79bcc3cb41fb47", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333879, "uuid": "ad56bc78-ec74-4a40-a8e3-d0be7cc23fd7", "comment": "Malware payload (XWorm)", "value": "ae485d5769ba504714190178f2d0cb60b34ab8ae", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762333879, "uuid": "cd5adb66-21e5-4d09-84fa-a3652471a0a1", "comment": "Malware payload (XWorm)", "value": "b890ca0e2c83254906c7b107bf40ab2ffbd3f4c10edd78bbbf9f5c9378329a5cb5553004750824c538093b723ff665ad", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333879, "uuid": "2a95f378-d590-4a8d-afb5-a1604ee3d05e", "value": "T14675BF12BD404E76F13F3534E80AA7695519FEE02924F84636BC3D884FFB6832929D97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333879, "uuid": "688fdb9a-f73d-4b04-bbb6-1831dfc8e863", "value": "24576:GIU2gywAtLMlSaeo5CQKtdRPtCXjNVBztG6XdXtLPNNFbtu6ndfmLdEp:G+wLBiCxJhNXt595dfmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762333879, "uuid": "8e13e5ce-6f24-4239-a031-a7cc090318d1", "value": 1663011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762333879, "uuid": "31af2865-c183-4efc-8678-c4b85fbbb541", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762333879, "uuid": "01f7542e-2868-4b60-8f93-a70d1a658a1e", "value": "678876789765.CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca78c97-ba22-11f0-91c6-42010a9c0006", "comment": "Malware payload (SharkStealer)", "timestamp": 1762331746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331746, "uuid": "e730adaa-a2a2-4024-aa27-51f2d50cdcb6", "comment": "Malware payload (SharkStealer)", "value": "8d102ab0e723a245c2ec291fc6364688", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331746, "uuid": "daa23e08-5a84-4e22-8664-1e0726ec0d0d", "comment": "Malware payload (SharkStealer)", "value": "df5fd9f50e791ab83b6bd8d8e272c23fb80cb211eafe782a2044b3b2f2f0ac19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331746, "uuid": "95cb073a-24d0-4525-a323-2c220d6b13d1", "comment": "Malware payload (SharkStealer)", "value": "75bebe78df7ed67d351eabbdf4b9416d7498d063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762331746, "uuid": "b512d213-7753-4066-9050-59051d140f7c", "comment": "Malware payload (SharkStealer)", "value": "b84b46d4048cf750cddf40d8562ee83211a9140e7495ffd7fb1505b1a609aaf37fe63b96cf210920736620d47642b992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331746, "uuid": "3fda8078-a396-489d-9b2a-70c75265fd53", "value": "T1FCC61294529800A5D0F5CB7DC6EA5807F63A7C144B3AEFFF02A196152E36AE1DF39720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331746, "uuid": "f3935bde-f69a-4e49-a971-e4a67468f475", "value": "da7c7889a9af299fe69cc0665690e327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331746, "uuid": "7af83067-cf1a-4cdf-85f7-925e7907489c", "value": "196608:OzV1pkyyOiMJhwc9FmUjV6tM5GZzDjP0s6XZIqDyMVaUHHQ5QVlyr/2NMRj:mpLyeQcvV6mGBDjPCp1DrQ5QVly0MRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762331746, "uuid": "1173ef4b-1cfe-4b6a-86fb-c7a060d8a06f", "value": 11926960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762331746, "uuid": "87bae1e8-52ef-4c6e-a84c-87171b151050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762331746, "uuid": "d37148b4-0399-46c5-b81c-9639a7af6b45", "value": "df5fd9f50e791ab83b6bd8d8e272c23fb80cb211eafe782a2044b3b2f2f0ac19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a9d12f-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376715, "uuid": "5248f505-817b-46d1-b31a-e28d30c36540", "comment": "Malware payload (Mirai)", "value": "320dee2b10376a10503cecbdbcb87647", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376715, "uuid": "301abf3c-0db3-45ea-95cd-1c42904a08ba", "comment": "Malware payload (Mirai)", "value": "df6fc0342337fd3c1d0b08a8e8fd537003c9d139a08b72cc7f701cbc37ee9383", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376715, "uuid": "087998fc-949f-487e-ae23-7daddfd4f16d", "comment": "Malware payload (Mirai)", "value": "58d4c0a1d99d530b8e194546739d4e4162da52bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376715, "uuid": "b675360e-6e45-4272-a066-88ae3ba9ad7a", "comment": "Malware payload (Mirai)", "value": "d4717734f2cf3714b747bf5554c93780dce39236146030f10d53c28fe5a5ed94700789b3e5dc11f098dada498fceaf25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376715, "uuid": "246b269c-c638-4454-a9c7-ae52b3dfbcbd", "value": "T14BB2D03C6B111B98DE1EC0BD839D1B603CB41B2591429D4B7207EDD7AF568B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376715, "uuid": "b122bf59-2afd-43e6-9b16-3de1c2b7e186", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtui2nmdtJgGlzDpH7uNj1JAf:YeD8ZSWvZHZbs1row697qohQvg92nitL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376715, "uuid": "1492b542-629f-48f2-b30f-04a03e83ec05", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376715, "uuid": "0dd50de9-5b47-4c86-8c85-b57a43f2a627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376715, "uuid": "9eaa70d6-c117-4be5-9d4c-357b52b7c288", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e3a7fa-b9f4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1762312030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762312030, "uuid": "c9c7d9ec-8d77-4cd3-9883-f196db101ba3", "comment": "Malware payload (Vidar)", "value": "651c7ec61652ecfc6a2b883b315fb269", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762312030, "uuid": "7d65618a-42c7-4c87-a74e-d9a9b9716163", "comment": "Malware payload (Vidar)", "value": "df7c74df96c5590ee3b82ee0af43b364b6dd2acf6c270e6414519247bdee48fc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762312030, "uuid": "908e1fdc-0d2b-48b0-a525-a78178aeb566", "comment": "Malware payload (Vidar)", "value": "b9770af7a57c36205ba96c88ad1f7b6552aa5852", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762312030, "uuid": "29e7e979-f50f-4d49-a072-cae196b322b5", "comment": "Malware payload (Vidar)", "value": "87cb41bf7bb3130251f8503c5dcac6c77263e21d749bf5645172d70f0b46a89367ab1957da65d084406c5b82fdcc9781", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762312030, "uuid": "6a577d88-cb31-4f59-afb4-fa3f85a0d542", "value": "T1EBD48E7AA490D297FA1880B504F2572DE9217435C6762AFF05A0D1A2D91BBF08FD07FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762312030, "uuid": "3f273942-5d01-4f61-8adb-695e5739ac04", "value": "93136d667479015878a35144e3d585a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762312030, "uuid": "252164c9-8ee0-456c-9e36-355ff304449e", "value": "12288:d5iIot+cETT1qeGSAFcApgLRouFg8OV8cgzVPjdQl4UQEakwmrwgPi8:DiIA+LscApgLfIgJjdQGUQHZmrwgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762312030, "uuid": "cab5cd79-8677-479d-a55d-227a65c2355c", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762312030, "uuid": "91145def-8f27-4cfa-9856-5fa140e43f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762312030, "uuid": "ec53374b-6039-432b-b8c7-68b9f1fd0374", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4733afd0-ba14-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762325670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325670, "uuid": "829e2b81-45b0-434a-a852-b73d36fd084c", "comment": "Malware payload (Mirai)", "value": "7401cc0686b93098eb8bc2b866b6ef2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325670, "uuid": "7dc4b37b-4a8d-49af-a413-101dda22d156", "comment": "Malware payload (Mirai)", "value": "e01a0241b6376ea13fc4ff1be054ed320308e630bb88034409b1fd9bc905970c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325670, "uuid": "c46f2d73-1169-4001-9681-1868f0b220e2", "comment": "Malware payload (Mirai)", "value": "8614e28cfab549d146e8f9a24923fa16643ebe39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762325670, "uuid": "db7dd4d1-3bab-4534-9d66-c90310fae315", "comment": "Malware payload (Mirai)", "value": "c0a93634872ea20dba721066df4da7cf452b92c9ad328858e5524b56a898b0c17c84687e766ae70d761aad5418ec7411", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325670, "uuid": "c7ac2522-fe94-4fec-b863-74cdfaf77218", "value": "T169637EC1E653D8F9E85606745136FB338B32FA39102DEAA3D754AF33A853A40D5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325670, "uuid": "0d8523f7-2fa2-4781-aac0-fea90b8daa81", "value": "1536:jYGb9DUMcYH8fY9V3I0rlS+hr4nFR2FQbpIUpF8NW3WLrySk8ACa3qmGFWNU876C:jYGb9DUMcYH8fY9V3IyM+hr4F8FQbpIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762325670, "uuid": "6d5dafb6-e56c-4b65-a7f1-6c372897760c", "value": 71600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762325670, "uuid": "29b3beeb-a62b-4f04-93dc-ff0c54cd9a7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762325670, "uuid": "97323797-f8f9-4913-83f7-ee85d767a423", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54300003-ba01-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762317531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317531, "uuid": "359cc7be-6d23-41c5-a386-1755ef445aef", "comment": "Malware payload (Mirai)", "value": "f056fb5de54476383c5120c0108c435e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317531, "uuid": "e0333ca0-df29-4cc6-bf73-7a119ef3c4d5", "comment": "Malware payload (Mirai)", "value": "e306d454652cc88cbba7905450ad2d00607c372f03be75a54f973f66313f6a21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317531, "uuid": "3db5eaee-5598-4811-bf60-4d8db9638eed", "comment": "Malware payload (Mirai)", "value": "05d76d7f3f5f04b57cffbefadae79e16c3ff2e79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317531, "uuid": "7faa95cf-cd11-492c-aa0e-dc9473ffbcaa", "comment": "Malware payload (Mirai)", "value": "0951a4cb2d63a52534467958debfa692fca830760120600ca5a84fac659fe268bd183c11fd9272bee06f04cfff349c03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317531, "uuid": "3a8d9407-ee8a-470f-89cc-45d1b53c2fef", "value": "T1E9E45A06EF440FEBC4AFCD30852E835B15DD9DD702C1A67861BC8D98BA9D26A4FD3948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317531, "uuid": "fff5f73e-1c16-4322-aad0-2e223ea98d89", "value": "12288:be/iLXiWfK1+jBHdH3Kf596AAwO8cBTPAiya+DjemThpDWl8MYP3K54B+M7L0LtP:43rOr/Ou8fRIchABueq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762317531, "uuid": "3a44b54d-1fe2-4bf5-9e90-48300cf65312", "value": 710260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762317531, "uuid": "ff73e1d7-34f3-4c40-9d06-8bb43edd570d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317531, "uuid": "33ec02fb-fc9d-4cad-b023-a02480951f2e", "value": "Mddos.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7bef6b-ba03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318619, "uuid": "8c3e8866-1ef9-4f48-a6a9-71ed06cc3aa4", "comment": "Malware payload (Mirai)", "value": "60e76eca0ace86b47b20b112066aaec2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318619, "uuid": "d9de8e5f-a51a-43c2-98f3-7ac0dddf1766", "comment": "Malware payload (Mirai)", "value": "e3b5fde171e209591b765be4a73e369cb163176436719f1e313b6784c9ef945f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318619, "uuid": "58a9123d-4e3c-439c-a3de-2bb667eb035d", "comment": "Malware payload (Mirai)", "value": "d91ed4f36005091ca3b0166dbe6bfb5ce5ccb34e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318619, "uuid": "3b569bae-19a3-4c11-8189-bce24cf311a7", "comment": "Malware payload (Mirai)", "value": "a61f0bddad17d17fd8753688bce1ae935f8ef9327f1df095ce6d4d06a83e3a9df78e2f7cc9b679e37e2cbf430d90093c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318619, "uuid": "8658b7c1-7d43-44af-b816-b2875d8ffeef", "value": "T18DD35C0673180E17D5A349B02A3F1BE083FED5D021F4BA89691F9B6A8676D3B1485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318619, "uuid": "5eb8a888-873f-485d-8d07-b4c454b5a5af", "value": "3072:CV0zui1ZhMHJ8A+qrpfbOUm3+Q2Mc9Fktn:LP1YM81bOUmuQ2Mc3ktn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318619, "uuid": "3068963b-79fb-445f-8abf-a89054e282ec", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318619, "uuid": "868e18aa-4e49-4785-b872-7be6443410a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318619, "uuid": "5d29ba74-4f7d-4037-a616-8306be2b01c0", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a455fa-ba40-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762344642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344642, "uuid": "f1b22b25-bf95-4bc2-bcae-88866b752501", "comment": "Malware payload (Rhadamanthys)", "value": "cbb390c2aff89e3746a43ba8fbe65135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344642, "uuid": "a2c869d5-87ce-4f77-8c09-ed2e3bb980b2", "comment": "Malware payload (Rhadamanthys)", "value": "e41af0504efcff1a6f88fc0175d68cc58a32c3ad0e8f8e834a91eb5eb3cca029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344642, "uuid": "bfc9bae9-3ad9-48c5-aa92-b5384785e558", "comment": "Malware payload (Rhadamanthys)", "value": "9576964fb8493732195df265cbef281569ff5a59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762344642, "uuid": "d74f9f48-ef79-4441-9590-f2024dda9032", "comment": "Malware payload (Rhadamanthys)", "value": "d41f688c64f8a8d924f1a0eb4db565a69906d80a51002ea4582beccafd0052a62c3d6c04b0ed9bf3e9870b554862b2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344642, "uuid": "9c110f55-1149-465e-8d0e-992ff0650a0d", "value": "T1C3E423600F8EDBB9F02438B1D64A2E38229C3CC59D9251F37987D84A6517C4764FE96F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344642, "uuid": "ce55f318-27d9-4f44-9eff-a18b19d3eda5", "value": "af83b26e354bd634b6a8028b65c0a61f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344642, "uuid": "d1d18f2b-c34a-491b-81db-1c8d14e5d6ca", "value": "12288:+bSTRFYsP4IREtR/kFI3xZggS5bO+TgoFtyslHbWEvJK9PLepIuwyBk:BFYleE78FIgr3koFzHtvN60k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762344642, "uuid": "a89efebe-70ff-4b58-a38d-a3742949a5b5", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762344642, "uuid": "cc0f0419-a840-4745-b720-6783535302e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762344642, "uuid": "021622e3-a895-43b8-8847-8d095cbef4f3", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382ba707-ba2d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762336382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336382, "uuid": "7e1163b3-ebc7-4b51-9f22-57cbf12eeee5", "comment": "Malware payload", "value": "230888af63fe269a3ff7a79ca6b5cf2f", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336382, "uuid": "b8a880e7-eb60-451d-8387-da7a6e70336b", "comment": "Malware payload", "value": "e466e80fd69cf939b7dd29524b5b6001be7ae4709619c8eef69bb49329b1152d", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336382, "uuid": "584104a8-3a26-45af-acf3-c74b406b2c52", "comment": "Malware payload", "value": "2d10c9666c6e73c7fcd69b673c47d3d4e759113e", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336382, "uuid": "c58d25e6-c1a6-41f9-ad5e-fe09bc56bc50", "comment": "Malware payload", "value": "894584290ce411d2cec5675e184867a7af93d697fb5ec9f9504687d515d4f666da015529fa6638e3d357a02479bfd6f8", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336382, "uuid": "82e7a541-cba9-4721-8cbf-825ac844d024", "value": "T113D3B87076F56B14F0B65ABCAE76268999367A18DB33C74C0114A24E2A30F14DD15B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336382, "uuid": "b9db67fd-807d-43a9-b58e-d5170fa2631f", "value": "48:mTPbpf8RDKEPS8pdNZZpEbpf8v28fKEPS8i7dNZ8tTog4:mTDpfV8ypfy2X8iiTN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762336382, "uuid": "51b3d0af-351f-47a0-8002-c305222d3dc7", "value": 135161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762336382, "uuid": "cb76c1b6-6ae9-4c5a-a8cc-9d45bcb123eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336382, "uuid": "e9cce6dc-c9d1-42d2-a150-d7b76cc9e55f", "value": "230888af63fe269a3ff7a79ca6b5cf2f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b553a247-ba3b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762342605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342605, "uuid": "495c2b6d-281d-4355-8084-b85d736ca4a1", "comment": "Malware payload (Rhadamanthys)", "value": "99fb97813728ce0de997b9ac40df3854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342605, "uuid": "442a41ee-bb34-4fed-88ba-f4b22699c8fe", "comment": "Malware payload (Rhadamanthys)", "value": "e4ec6476ae58676f110b4e9868e43655d86db80931deb7bee6c54be116e369e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342605, "uuid": "b2e6a813-a590-463d-9e38-45b23cad5c0e", "comment": "Malware payload (Rhadamanthys)", "value": "2302698b67d5b0ce4e440706eaf224d8c92f4913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342605, "uuid": "9fda0449-8337-4115-952e-16c5a7edbf2e", "comment": "Malware payload (Rhadamanthys)", "value": "2cbb4e47462510d69530bf6e16ecf154c1f7801e8e8613906065cc824e499675f0292524aabdb9b7e6723c871a921079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342605, "uuid": "1f8c9da4-827a-450a-80da-be4804472df3", "value": "T1EEC52872A8B051E0C599F231A56255A5B631FF840F3127C72B4DFEBA1B362F42AF5318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342605, "uuid": "fcf3dfb6-8bf9-4580-abfb-5589e86519fc", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342605, "uuid": "672a63a4-7d0d-4057-8e0c-c6e1a09b83dd", "value": "49152:hcpkmJT+wK04P62MfcfpvdSAvgLBKZCvoVD1u:MX2HfZQAweCvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342605, "uuid": "c9b13fa5-3b91-4295-890b-ba256da6f6f5", "value": 2713416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342605, "uuid": "9669a8c0-a5ef-4cbb-9b6f-0c9e28bde03e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342605, "uuid": "a6e0ee8e-966b-40b0-830c-c8d123920194", "value": "BootstrapperApp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb300a43-ba6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1762363311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363311, "uuid": "31e25e8d-0694-4945-841f-110b25ed2bf2", "comment": "Malware payload (SalatStealer)", "value": "a9b777ca7a5cf31ac1464a52df2dacb6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363311, "uuid": "0e21b5b2-eab2-481b-a76b-4331926deca0", "comment": "Malware payload (SalatStealer)", "value": "e53f6e7de61c84ccc6ae5351ba4b07d3f1cf8f13c22b787fbbdab36ef58219b2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363311, "uuid": "19de161f-969c-400d-8b05-462ad900dd14", "comment": "Malware payload (SalatStealer)", "value": "215a51f2555b2b1c681889e80f92a71b6b9b5c19", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762363311, "uuid": "1bbed70a-a0cc-4d23-8135-c476b5d37864", "comment": "Malware payload (SalatStealer)", "value": "00aab18dc12253c09c1fa4428bba6fb348ce56e3c4f1065b25a98a349d09fbbaf8efbccdfbe9f134607e98c18485ab28", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363311, "uuid": "767135eb-50ab-4ed6-9dc5-9869a7dbfa55", "value": "T1E7F5333F137F8410FF53F573CBBA1A48B9A0E9AC7615169AFE84925777BA0C48448D28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363311, "uuid": "83733c12-48cc-473d-8a1e-cb24c16682fa", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363311, "uuid": "b52dc74a-bf48-4266-afd6-4c8d93ddcaa1", "value": "98304:ZacG3ZxTXu/ZYIyHRry7wI5vpDjxey6sBJ6:snT4YDxrMh5pjhBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762363311, "uuid": "3425bab5-b1b8-43db-b799-8c33ba79692e", "value": 3558912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762363311, "uuid": "e6dfceee-08e5-4b79-a1eb-029efe320496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762363311, "uuid": "499f393d-110d-4206-a034-fbf2c01a6e93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1150a226-ba99-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762382703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382703, "uuid": "558b5f6c-1ac8-4fe6-90f4-ccc43a8d48a0", "comment": "Malware payload", "value": "357bc49f2c497773b48ba3ff35315ad6", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382703, "uuid": "da85cf65-5930-4fde-8002-c9e691baf00c", "comment": "Malware payload", "value": "e5a7f675717eefdf645513bfb67c313ec8c6e6c3691b84c662bbe66787382bbf", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382703, "uuid": "a7fe9236-ab14-44bf-b2be-6f568a6f91ed", "comment": "Malware payload", "value": "e9ba1fa6842f4aa873a295540eb66c16a828fcbd", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762382703, "uuid": "5be910d1-4826-4926-b21a-94eab9adbe4d", "comment": "Malware payload", "value": "89bbc9caad60636e69484c2cc56802f2e5d384c6c898ce6c47d375f3e35d11a6b520ed61f98b12d59c9cfc99e33e73a4", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382703, "uuid": "2dbe5efc-9510-4acf-93c9-5af4d5e72e57", "value": "T19A5412D6BE48F124CD3A03DA612F1AA362C6C3DD143D9931F8265A45F11D38EDBAAD0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382703, "uuid": "ec2f7593-80dd-4193-8298-caa8eb5a4cee", "value": "6144:/6ZgapXXaOJuvS6ZgapXXaOJuvS6ZgapXXaOJuvG:/+gyIa+gyIa+gyIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762382703, "uuid": "cabb5355-8042-49ce-8ad1-dcd8a436b948", "value": 295134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762382703, "uuid": "842725f0-4929-470d-be5e-0e45867df2b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762382703, "uuid": "6e468cfa-fa8a-46cc-9489-cc0f3114b475", "value": "Ultimate_Guide_to_Contract_Deeds.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8987e7-ba2f-11f0-91c6-42010a9c0006", "comment": "Malware payload (WarmCookie)", "timestamp": 1762337197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337197, "uuid": "9191196f-c0da-46ed-aa37-231f07f9ea70", "comment": "Malware payload (WarmCookie)", "value": "3de8f6cc47a47b4603292135e7adea59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "warmcookie", "colour": "#AF34AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337197, "uuid": "b22d2502-1132-4f00-a7e9-fccd9db057d4", "comment": "Malware payload (WarmCookie)", "value": "e62684a48067d8bf5f219f007bb5908301ca3303b9c57a2f0c3212cf0eb8d7b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "warmcookie", "colour": "#AF34AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337197, "uuid": "19f83032-5dc6-4978-9ac1-bcc98bd26571", "comment": "Malware payload (WarmCookie)", "value": "a5e1e484c828ee41c409fbcb893d6e4bc66d9821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "warmcookie", "colour": "#AF34AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337197, "uuid": "841612ee-c390-4e57-9774-7208a67cf202", "comment": "Malware payload (WarmCookie)", "value": "ca47c2bd03199bbdaf60a5d469f5919fec0c672e04c8bb52bd2417ac11b19df3978991e8c006fbd5cb3fe22bcc868d56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "warmcookie", "colour": "#AF34AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337197, "uuid": "69d93125-1589-4386-af73-a6a1b51fa6af", "value": "T114D31826F7A620BCC197C279AA9757B3E9B6BC24233475AF039486B13F25C546B3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337197, "uuid": "c21d40f6-d72e-48cf-b1cf-8669e6330730", "value": "d324ce8126cad20aba87cecc641af89c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337197, "uuid": "f48163e8-2d57-4818-9b2f-f3da8a155551", "value": "3072:FDWPo40RxnPn3+XJ9kg8666r8gcl3dNG1ZF8:FDWPo40/G5b8J6rJcAx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337197, "uuid": "b11fe12d-d13c-403b-9104-a4d11e81f126", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337197, "uuid": "326c108b-1fc6-4a5f-8f9a-20446f33d292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337197, "uuid": "219f74db-2624-4a25-ace6-bb97afbcb60e", "value": "e62684a48067d8bf5f219f007bb5908301ca3303b9c57a2f0c3212cf0eb8d7b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b9088b-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316807, "uuid": "9d5885d6-bd25-4cb1-b9df-9fc438174430", "comment": "Malware payload (Mirai)", "value": "5765ec5b75582f635dac7317ee895158", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316807, "uuid": "b544289b-f7e1-4ec2-83a1-28ae67c2c2aa", "comment": "Malware payload (Mirai)", "value": "e632c1dee6c9f187f36e633ac3db7a0f3db30a936129c04ebaa7e5b074631b51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316807, "uuid": "471e1991-ae9d-4961-8801-c595b469f8f0", "comment": "Malware payload (Mirai)", "value": "376a24db08e59f54c9bd2c04a5cf83360346b325", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316807, "uuid": "d6849d05-aaf8-4ba5-b255-3de9a35f6590", "comment": "Malware payload (Mirai)", "value": "1d89957036aa3a58c5996b5181b2213165680bb39a344e848f4c1486acde700d3bca190c25cec5f4a563ab3f88562717", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316807, "uuid": "8028e50e-3d58-48e2-b168-5c4bd2e79da8", "value": "T127338D73C42E7D94F14A8278B9244B385B23D40696833EF4968ACA974047EDCF6593F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316807, "uuid": "66fae9b8-1527-4be4-a4e8-f219c0d2cecf", "value": "1536:DoaN/rpY6ODwtAVCo0s1P9qIGDS6owCc:Do4jnkLCsF6ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316807, "uuid": "b561bd04-471f-4607-a781-bfadb3808310", "value": 54684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316807, "uuid": "e9c60db4-8f42-48a6-beac-23fdf0d2f4a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316807, "uuid": "156dcb5b-1a3f-4a28-8531-de9f4a0bf159", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03fa136-ba3a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Jalapeno)", "timestamp": 1762342194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342194, "uuid": "9e6eecfd-1726-4878-ad7b-35eee98e33b9", "comment": "Malware payload (Jalapeno)", "value": "5bdd577a5b24bc38d63bb27544e8048c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342194, "uuid": "6e45ae2b-966f-4d49-ba75-e0eb661c5094", "comment": "Malware payload (Jalapeno)", "value": "e66c5bc542cec45fa3ec018dade16dcae032a8d1ccba8a4ce5322abd844ad00c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342194, "uuid": "8881b35c-c763-44d6-bed4-4d2cc3e4480c", "comment": "Malware payload (Jalapeno)", "value": "96eb7076522cc05b782ba0c4dc6c61fc3a381f72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342194, "uuid": "b1093c3b-332a-4864-b532-9160533d69d5", "comment": "Malware payload (Jalapeno)", "value": "ce2e864a34284bf4a77e36ddc7fff6ce2a2472f1de5f2f292863e27089f25159a7a5ad5a63ff72c6d292d946f93d2b2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342194, "uuid": "361ddffa-a9d0-454d-9e40-d08cf5921f44", "value": "T14C57335C5B2EC984CC8D25FFE29BC1735E701CF6A05606CA57F67ECF30112A2968299E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342194, "uuid": "c8a98247-209b-4c43-a049-db05732722c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342194, "uuid": "6efcfb87-695a-4f3d-ac6d-ea284f4adda5", "value": "786432:Z7mtvJBmLG5RMJdkX2R2egC1BegK52oyIaMmusVhzmPt2UA:Z7mtuLxI23gC1BZM2oZuusTct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342194, "uuid": "03ac3d87-d079-4824-b3d7-f0f0aaab6a9a", "value": 28838912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342194, "uuid": "9de15b95-4684-4dd0-81b1-a4e4fd42dc78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342194, "uuid": "713e9f35-4cd6-4ab0-8197-9cb395a00e3a", "value": "AnyLoaderV4.11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16c0463-ba02-11f0-91c6-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1762318225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318225, "uuid": "f7bfb03e-8323-4816-bcf9-5e15f2ee87b9", "comment": "Malware payload (Glupteba)", "value": "b1fa06970caa61c25a665d49c2678c45", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318225, "uuid": "dfe9efd1-4d79-45a4-a848-0e8095eb5ee3", "comment": "Malware payload (Glupteba)", "value": "e67f71173bcd108881ea10ecb942ff72ec96811acaa586a5e5fdf696a9ff33ea", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318225, "uuid": "68eae602-2bd5-4d87-94e3-2ca9fe76658f", "comment": "Malware payload (Glupteba)", "value": "fef54b378639dbd46f110ac0c5775fc1964983c6", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318225, "uuid": "6fda4e64-9dca-4515-9e82-f337374fd2a6", "comment": "Malware payload (Glupteba)", "value": "fc9695c369f0d2eb825b356334c92a9e81564ed02a629e14b2289f8553e4770c140b15cb01719d51ca586b3f25b964a9", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318225, "uuid": "29557b59-8481-403f-b5e2-602be84a8404", "value": "T1640633C8686FD8E141DD3AF1E7D2A18312AE281FBDC8D39582B59098DC0E7FC9F69415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318225, "uuid": "499715b1-43b2-4c6b-83b8-d90bb7003ca5", "value": "98304:jAB6m1vRli2pB9QOzFbGKj6C+mE6hbzi4/c2Rqd:j+xJRliS0wr67mE6hZvRqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318225, "uuid": "09f9220f-cb68-456d-953e-864e1c3f8e6d", "value": 3670912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318225, "uuid": "a93917e0-3187-4a23-a688-5212c1bfdb39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318225, "uuid": "9acefb58-102e-4cf4-b0cf-b703d75e1cd6", "value": "2024\u5e74\u5ea6\u6df1\u5733\u5e02\u79df\u623f\u8865\u8d34\u7533\u8bf7\u6a21\u677f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ab1070-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762336160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336160, "uuid": "a2081b88-25a9-409b-a463-76105155c7a4", "comment": "Malware payload (CastleLoader)", "value": "5b8a5f2e30c507a532e13aa1955714ef", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336160, "uuid": "0f1ddfc8-7259-452a-af4f-479615d31bc0", "comment": "Malware payload (CastleLoader)", "value": "e6aab1b6a150ee3cbc721ac2575c57309f307f69cd1b478d494c25cde0baaf85", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336160, "uuid": "9a704e16-4275-45cb-bf69-3a83f9bd9906", "comment": "Malware payload (CastleLoader)", "value": "1f88e8ac20f26775ab639cacaed3bb5344cd9a2b", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762336160, "uuid": "adae145b-b442-43e9-8aed-09c1870882e4", "comment": "Malware payload (CastleLoader)", "value": "50eea0253a8b05f08c42d04c9bb33b09a86f53a681b4874b185c1ed6daa17e676ac999f328144a792bd40384e63957d3", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336160, "uuid": "7a923035-89c7-47c9-aabd-f6b546e05d03", "value": "T112283327F264D03DC06A173245B6E6A08A3B7E20DD064D4F17EC798DEF729A10E3BA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336160, "uuid": "e96e5b6b-4b7b-41e7-bdbb-d3af1b131399", "value": "81073f2b397217228357dd031a037bb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336160, "uuid": "e53bf684-94ca-491d-869e-465dfba3b693", "value": "393216:Slg0RgcdW48wApekwgTeD26OLp0iS69bKISga5ddIORieiFuNSG7vg6:SlKW8HpFLXBdanBRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762336160, "uuid": "a24e30cd-f5fa-4593-8c65-33d120088295", "value": 95132820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762336160, "uuid": "a7b58e5a-224f-4dbb-8e20-dcbc0c5faa67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762336160, "uuid": "f130f2bd-24c5-4cfb-8a9b-bc4537bb3c8a", "value": "e6aab1b6a150ee3cbc721ac2575c57309f307f69cd1b478d494c25cde0baaf85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2aec7e6-b9ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762316804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316804, "uuid": "e9d9cf1d-1956-4ce2-9137-6cef8e2f9ed9", "comment": "Malware payload (Mirai)", "value": "a62e3ad74f00ececfa8e26d074468deb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316804, "uuid": "ff66f103-afe9-430c-b4cf-15c297477b55", "comment": "Malware payload (Mirai)", "value": "e7627dede5e5ffaed4eebdcced9705d9eb5b7260228d3a905a158b5de1566607", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316804, "uuid": "6e247fb0-e88e-4ad0-a0c2-086c7b9b850c", "comment": "Malware payload (Mirai)", "value": "90cb7c6cbd8a45ff263f691f5a5f7875ecda9de8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762316804, "uuid": "7f830e23-b0fa-4478-bc30-a60bcb7fffde", "comment": "Malware payload (Mirai)", "value": "5c01019aac08dffb5893e30bb63846cbd511347fd1a4abc80437486412615779445c3507cc62cd310b769c78a212f5e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316804, "uuid": "06422386-2572-4503-ad17-cd5dca0108b5", "value": "T15C331891BC819902CAD82376FA2E01CD332663A9D1DF7217DD226F1137DA92F0D7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316804, "uuid": "73b29da8-4b00-4dcd-8a24-6ac4f80e10ae", "value": "768:B8GLInGoXP3624ILThNGzGUiTkVpCDL0IIesBJNoiFS9PBNwoxBA1sH9AXE:qMInGoX/r5xUiYVpu0IIeyJd2Nxey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762316804, "uuid": "50fba547-c848-4551-a1ff-cf662c952123", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762316804, "uuid": "ffe0f67e-3f38-444f-8056-9336167927a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762316804, "uuid": "c272186e-ec25-4b98-8e73-b53841759e90", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e33376-ba10-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1762323869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323869, "uuid": "22e2adf0-4a59-4d8a-8fff-5538f159a270", "comment": "Malware payload (GuLoader)", "value": "1c1f6e1823fb879619265398fa427e80", "object_relation": "md5", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323869, "uuid": "f6f67ef4-f51c-4fb4-a0ad-9862e4d575ea", "comment": "Malware payload (GuLoader)", "value": "e7b37673e8cc1913dbe2f2301cbb146658597b6d1a623a419a5ab2e3efd4c596", "object_relation": "sha256", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323869, "uuid": "8973a97a-64a4-4460-8921-73fc0ad0433d", "comment": "Malware payload (GuLoader)", "value": "472617197521cc19f5cc13b9321eaee9532e7202", "object_relation": "sha1", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762323869, "uuid": "4c0b0050-f31c-4737-a3d9-57d71785e4df", "comment": "Malware payload (GuLoader)", "value": "262d8a7110f2932193aa433d5cfae097f81cd2e5d4fa3fdc601c56592d2e1a921f4c7046821178d5d18bfd5a853e5dbe", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762323869, "uuid": "64c11b10-85e4-4809-83f5-ade1672b536f", "value": "T18D65234D25EAC943F0E45835CF5302F4AE78AE04E9A12617339CBF1EBB78B94D74A245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762323869, "uuid": "d4fb2e28-d2a7-49f1-9336-365e4a2086d1", "value": "12288:SkJk75pc/hoQQE18pKFuzwLvWcgNb8ukJEgr1nugBOHYKdWp4d5sVooWjo8RvSDl:X6pnu+z8YqVpBOHYKdWmwozjo8Rq4NU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762323869, "uuid": "93d42d9b-f8f5-4d47-9856-4de939ea4b5e", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762323869, "uuid": "30e025c9-9471-4e3e-a887-f4e3e8d093b2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762323869, "uuid": "77b3f08c-d1c7-4be4-a702-673194d37c92", "value": "ORDINI_14393-143480000000000000000045.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085d0049-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319552, "uuid": "6b46bb32-b9ec-408b-a5e2-957db016c6a3", "comment": "Malware payload (Mirai)", "value": "633efca4fe558ef989bf0c11bc0d69cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319552, "uuid": "2d713507-cecb-49e1-a33f-9fcec8a590d7", "comment": "Malware payload (Mirai)", "value": "e7d10efe665c48875742fbb2e801d45c9bd8f5ff801bfd1b9d7737b7901eb3b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319552, "uuid": "cb6190a5-ae30-429a-8fa1-3fb56e177602", "comment": "Malware payload (Mirai)", "value": "43c212854875d514c917c60a442e820f2a5ee062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319552, "uuid": "6e7afdc6-2a73-432e-b4c3-0ced631d6a75", "comment": "Malware payload (Mirai)", "value": "80e79c0e2da891e86fca6ea58e3595481bfb039964c75c16e64fa4bfc58cf0835ac50579d1607d3513303ef312635d3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319552, "uuid": "68f0b772-13de-4241-97db-8ac406dd0004", "value": "T12F13F2BF9AD4A8C9C45C0DBB358A077508CEF9A2323A57AC57639481139F89DF8684B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319552, "uuid": "25248653-7852-40e5-a391-3104405a52df", "value": "768:LQG+TUIlpoE02wCvZHPoBBwxLEEGSemQ1I1LPknkvbKw9nBNu/0GjIGWO:kZlpoE02w4ZHPCwxbGS+skgVtBDGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319552, "uuid": "eb9bab0c-555b-4b07-bc2f-15d94d74b83a", "value": 44092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319552, "uuid": "dd8de0b0-6656-4c4a-89cc-c842b30a1ed9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319552, "uuid": "224cda30-8bca-456b-8a75-73ba7ad1037c", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1578a13f-ba52-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762352215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352215, "uuid": "45f73ba9-62eb-4058-b2ea-474565ab2be4", "comment": "Malware payload", "value": "416766580a20d0fa8f7210804af57215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352215, "uuid": "f3ba1b2c-b568-4bf9-8de5-355593daca98", "comment": "Malware payload", "value": "e7f4df13935dd74c2248e44e69605dc53b9bfd33fe5a59847a8b6cb8c65a8667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352215, "uuid": "ca73ea47-5830-4025-9fb9-55bcb0f948fc", "comment": "Malware payload", "value": "24f74b25e3864bdde61dc575bcbe680d859ea499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762352215, "uuid": "d15d36a5-2eee-4564-b7bb-877b8d87b0b7", "comment": "Malware payload", "value": "d79cd0c7c7d673c80652bab26a4fe2fe04bbd8c11a83f7c2d2da522da4a8cebb8d81734f9ec57c338191fb6b671042d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352215, "uuid": "8c741b8c-882d-458e-a1ad-b45517691f02", "value": "T1FFA4AE24E10E1333C5C252340DE7916ABD39AE0C456A95CFA7EAFF249A331E91417FB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352215, "uuid": "a5936814-ed77-4474-ae31-8a5fbbba286d", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352215, "uuid": "e402acc0-5dc7-4979-ad1d-65a0993031e6", "value": "12288:0ANwRo+mv8QD4+0V165+wySIqflFKMshjd:0AT8QE+kodyStls1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762352215, "uuid": "c0de18b7-8fa5-44cd-a02e-421f07017778", "value": 477459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762352215, "uuid": "1dfc1366-902f-4ae3-8ad6-79e67d7b13be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762352215, "uuid": "7fedfe75-d950-4a14-8672-8017255a5f98", "value": "e7f4df13935dd74c2248e44e69605dc53b9bfd33fe5a59847a8b6cb8c65a8667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fa29f4-ba16-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762326814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326814, "uuid": "b8180556-3864-4c08-aeaa-73159922be9d", "comment": "Malware payload (Mirai)", "value": "78c2189cf830db1c59e311ecada46e84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326814, "uuid": "e3572e29-13f7-4762-87eb-298c017c8ec7", "comment": "Malware payload (Mirai)", "value": "e8d5b59a5a869a5219b155878123fe14d673a94091e41226197538034b992fdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326814, "uuid": "84b60776-a566-4433-966e-ab322c8900cb", "comment": "Malware payload (Mirai)", "value": "47bd2482959f508862718505260b995af131e8af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326814, "uuid": "0acf05d3-27f5-45e0-8824-32dc6f38afad", "comment": "Malware payload (Mirai)", "value": "ae11b60e434326cff20b842176d0709c3e5dc5ce6ad97948a5de94d0cddde74e77bd9fa9f52f079ad1cae7fc9c411ede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326814, "uuid": "e031712e-79f9-4de5-b27d-92ae3a0367cf", "value": "T188B2DF3C1B151B98EE1EC0BD439C1B203DB41B3591829E4B620BAD97AF968787453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326814, "uuid": "c46f084f-a02c-4f1e-b7ff-44315043cb16", "value": "384:deD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiCkmd7JgGlzDpH7uNj1JAp:deD8ZSWvZHZbs1row697qohQvg9Cki79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762326814, "uuid": "cbe01181-29f7-4b8a-91a3-a1325f97d12a", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762326814, "uuid": "5ed81d21-7aa8-4491-9373-5ff5a38d0731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326814, "uuid": "10383dae-2390-46c6-b0ef-7d438ed212d1", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f75924-ba63-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762359888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359888, "uuid": "8944e205-70c6-40ec-bd99-c3fb2623569e", "comment": "Malware payload", "value": "bdff32f1fefb7915e60287afedc13f93", "object_relation": "md5", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "KoiStealer", "colour": "#1D3760", "exportable": true, "hide_tag": false }, { "name": "TA4561", "colour": "#6114C3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359888, "uuid": "7ba99889-112d-4a64-847b-b100808ffcde", "comment": "Malware payload", "value": "e907b4c0fc4a8bf2c3273332dedcc1d04c2dfc6d24d76af72f264492eb7e9a00", "object_relation": "sha256", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "KoiStealer", "colour": "#1D3760", "exportable": true, "hide_tag": false }, { "name": "TA4561", "colour": "#6114C3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359888, "uuid": "cc91f752-2a4a-469c-8cc7-4d291c5cc816", "comment": "Malware payload", "value": "888afa39f289189b7e45c841ab526590bafce1f4", "object_relation": "sha1", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "KoiStealer", "colour": "#1D3760", "exportable": true, "hide_tag": false }, { "name": "TA4561", "colour": "#6114C3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762359888, "uuid": "65b2d902-100e-42c9-a617-e39f7ccd0719", "comment": "Malware payload", "value": "391e0c2f87813747d60df83a54912754fa53d53f3be503267f0bd618355607405d94c264e9e7ee02a6487ae3e39436a4", "object_relation": "sha3-384", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "KoiStealer", "colour": "#1D3760", "exportable": true, "hide_tag": false }, { "name": "TA4561", "colour": "#6114C3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762359888, "uuid": "28301bd9-d13d-4f08-b8e9-7638d7f35702", "value": "T1D32195760469C6C6FD45137678129B598A2CEE453BB7367B29A853CEEA242B0C883468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762359888, "uuid": "ed8dbbaa-6a6a-4f0e-a83a-2835ae9573ff", "value": "24:9yfXpsD4g8J+8UeYSusKU7UT2IDmB23S9hkue8E/4KHh77N8Pu6mufVNgcZ4yxmF:9AXxg8J+8U5S6TlSUueF/lh7Z8G6mutG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762359888, "uuid": "9038d88b-04af-4ff1-8c00-787a7dd24954", "value": 1263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762359888, "uuid": "b34073ce-636c-4638-a122-76ab90215ff2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762359888, "uuid": "e857db25-8887-4420-93a6-b5a62a2e4662", "value": "screen_0511_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464703f6-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319656, "uuid": "947472a4-084e-41c1-81e1-3b32a0c17442", "comment": "Malware payload (Mirai)", "value": "6763be9484d129d2b96c34abc46b043a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319656, "uuid": "c828b898-7465-47a4-a2c6-ec7c1524ab38", "comment": "Malware payload (Mirai)", "value": "e9fe814f39493e6ce3bc783bfc9ff900a8caea2cf80c62fe5075e0fdaffbeb03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319656, "uuid": "d8ea2bea-3185-40a2-9ae2-1f0bbb55757c", "comment": "Malware payload (Mirai)", "value": "22fbbd1af0cc15c4ed1695694a02343c4894d033", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319656, "uuid": "a960868e-ae6e-4893-a8c9-77d17e62b60f", "comment": "Malware payload (Mirai)", "value": "f15fa1d9330e9118733df0c090d0e803f5485c1ed4e70089a9ebab6f39dd6d58690019d54b82c766dbef2654c859d0e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319656, "uuid": "e386ffe9-0c65-4cde-9430-55d87a15cf52", "value": "T10C736BC2AB47D4F4EC2605712077E7728773E13E102AEE83D769AC36ED52941962A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319656, "uuid": "058117fe-04b5-430c-ab55-425417c71a22", "value": "1536:yUQvN+2Lhc1K0VIpmQ3Pk798U755e1j+4:+lVcK0VgmQ387O0P6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319656, "uuid": "5c3fe87d-1336-4eb2-944d-c67dbecbf96a", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319656, "uuid": "7795762c-d851-4d09-bcca-066d19a0abf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319656, "uuid": "1f8e2f50-cb34-4510-bfdb-6c62d47d5bbc", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d0d6e8-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319628, "uuid": "1804d98a-c299-41a8-87c6-db9a2089645e", "comment": "Malware payload (Mirai)", "value": "e1dd1ca868c476184f88d3881ef01977", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319628, "uuid": "afc9717c-d8e2-486d-b921-0b8e07743a2b", "comment": "Malware payload (Mirai)", "value": "ea9882ebad6a8c73bf107e7e20c4616cb57649028053f95a5bf9f58823d289f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319628, "uuid": "746b00f0-9710-46c2-ab79-523bb7d6922c", "comment": "Malware payload (Mirai)", "value": "c2cf74ad43f8bab464353eb027665713d3baa802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319628, "uuid": "13ddf215-7a52-4479-b1ee-efaca282c949", "comment": "Malware payload (Mirai)", "value": "4989110ad972af1ec12ee8cb2e2cbf950282d38d7fe0fa16cc08e001020abcd6d2111606eefa0af9275696408f147210", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319628, "uuid": "27552a63-8e6f-4864-9ac6-07293018e1a9", "value": "T1D4933B56F9818B21D6C116BAFA1E118D3313177CE2EE7312AD246F2077CB96B0E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319628, "uuid": "5137ef81-659c-4815-9de5-d3de44cff6f9", "value": "1536:6MnWuEFK6KQA1k+vGQrMxFGZhtsamZ5UHCpD1iFX5Gaw17hB5jY1gx9:6FveWYGQkChtsamcX5Gaw11BlR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319628, "uuid": "205f28ae-1034-4083-b923-a863ad043ef4", "value": 97472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319628, "uuid": "fb134ff5-fcab-40ca-95a4-f41c44b693e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319628, "uuid": "ca4d2086-db9e-4f6e-9428-eeb9b78920e4", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0304b5f3-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319543, "uuid": "d2ffd41a-5053-4d50-a7e9-467844a04ec9", "comment": "Malware payload (Mirai)", "value": "6640d488d7c88872e9c6b69588c31c5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319543, "uuid": "a85b5300-4a27-4235-92dc-e6431d12c77e", "comment": "Malware payload (Mirai)", "value": "eaded8049ec850d0f92456846375d3677547adef18e7aa399064b92413be3e1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319543, "uuid": "a16a2da2-efce-4215-9e4c-aed3f7d51e3a", "comment": "Malware payload (Mirai)", "value": "24df29a7a5f0e691ff5930cc8c1b37d1d0bcac25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319543, "uuid": "4f0e0d78-6191-446f-8c22-5ad038d8269a", "comment": "Malware payload (Mirai)", "value": "76c417f17b7609e73d8145b510ca4f4d8111b24b2e222e5ddcaddea89acb9247171b362940949dee9699eb06600b77d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319543, "uuid": "3a91dd8c-5c46-48a6-8685-10b7e9ec404c", "value": "T17483AD63C8271D24D44848F0B0A48F3A9B63E115C99B2EF7949AC67AD087EDCF6467F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319543, "uuid": "e7e2e56a-e46d-47e1-bfd1-53667550df2d", "value": "1536:vM+LxdPVN3HYpVnnbKTb66+bCKyCHA9703uVOG:vJLxZHYpVneTibCKyZ4e7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319543, "uuid": "a45500ca-9be7-4fad-bdba-ab9bd2623769", "value": 81036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319543, "uuid": "952b87cb-a14e-4239-acd8-3d93a9d65b17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319543, "uuid": "b3f021fd-2852-4cfa-8a47-a6a91296cd7d", "value": "nwfaiehg4ewijfgriehgirehaughrarg.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e082413-ba04-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762318890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318890, "uuid": "c29b1652-c078-4a0e-bc81-7b67001b9cb1", "comment": "Malware payload (Mirai)", "value": "31015e8fa45804021814fc38aadec544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318890, "uuid": "b96e84c1-192c-4033-9f4a-dfc5fd75a043", "comment": "Malware payload (Mirai)", "value": "eb3f05089f64997f429812fc66ed958268cd38b9f436bd232e0c86e42f94b13c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318890, "uuid": "66d90c54-e2dc-4e9d-a589-77e5ef02f4a1", "comment": "Malware payload (Mirai)", "value": "e5107ecd1d6e9af4d7c0d9076d545e8a752557cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762318890, "uuid": "81792589-2864-4d7e-af31-f0b7702045c8", "comment": "Malware payload (Mirai)", "value": "f0e29c33e0db850aa853816e9fa5c71ba02b67337b7ceae297eea00d99063ea5a6a7c306afff44ff6755d8984102b183", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318890, "uuid": "c6ec4d58-d5d0-4777-a2cc-a84427ba8944", "value": "T114B2D0CC61843088C98D7C7C5B8D4A664F6CA1D0BAED8F16E354CD98B3BAA8F345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318890, "uuid": "486e8c35-92b1-40f2-9ea8-a628549e82a1", "value": "768:chrQlS07dEv0UXqUhvQE+CXQKMQKCXBp2ZqaWvZ:KQlS07FUXqIYSXQKquaqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762318890, "uuid": "14bee827-0e4f-4856-a245-a710d8af56fa", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762318890, "uuid": "f835ddd0-cfaf-4041-8c36-018494425ad2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762318890, "uuid": "94399aa7-06d2-475e-b229-236ca4db35fa", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c0a498-ba70-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762365232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762365232, "uuid": "6217180c-daf6-435b-a74c-e7e2504cad94", "comment": "Malware payload (Mirai)", "value": "b7b42b5ec627bddabca2812ef84c7d73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762365232, "uuid": "ff256106-3195-4576-99bd-da2538959123", "comment": "Malware payload (Mirai)", "value": "eb879f1135496481ebacb260be96fafc0622d85a3ffabfcebcc2c94ac541022a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762365232, "uuid": "46004a26-2a96-451b-bb0a-d5d36314722a", "comment": "Malware payload (Mirai)", "value": "714f8dc66402afc39c0c3fc5b8b40156f4fde265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762365232, "uuid": "e4abbf44-f2a4-4c27-95da-7e4524e37235", "comment": "Malware payload (Mirai)", "value": "68c85ce83d9bf8db3a35d5a0107f2ad26a0f35491ada90afb0b3ece4f3b6af3f232c4638b2ad3ce8f4d8bfab7b56bb1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762365232, "uuid": "a39e21be-967d-472c-82c7-d37d652a0c06", "value": "T1F1D43845F8809F61C6D535B6F74D42A873074BB9D3EBB2069A245B3437EB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762365232, "uuid": "52624e53-96af-47d8-8027-2cce9b7c68a1", "value": "12288:bk8cZgffdhPgryivr+J9aIGx23QXt2cXK4od2ye6K8pVkC+:bk8dhPgrIJ/62gd2SKFQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762365232, "uuid": "cfa2d698-832a-4517-bd63-2c16452def83", "value": 604372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762365232, "uuid": "8cf25d62-7cf1-4b33-ad6d-9786c62755f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762365232, "uuid": "a3cfdd56-b633-4f2c-a620-f426c8e2b6c4", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ab5efb-ba49-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762348382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348382, "uuid": "ba1c4687-810c-4aed-b270-4395778fbdc9", "comment": "Malware payload (PureLogsStealer)", "value": "94579ecff67b88fef9014fab1aafc4e1", "object_relation": "md5", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348382, "uuid": "5f19cee4-e973-40b2-8545-56192dd130cc", "comment": "Malware payload (PureLogsStealer)", "value": "ecb52ac571074c4c501344241912a964ab30356a3883ca2c1db3b3b6914399a6", "object_relation": "sha256", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348382, "uuid": "0fa6fa32-1c4f-4b58-95c7-d0fe5aa5fd6d", "comment": "Malware payload (PureLogsStealer)", "value": "e4d4bf25acb9ab825db87aaafc2b2c060aedc50f", "object_relation": "sha1", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348382, "uuid": "3da20733-7d46-4105-a929-37fad87b5a5f", "comment": "Malware payload (PureLogsStealer)", "value": "f51dcb576995d8f679c90d16f0ebfdf68e170e48887e0112842532141b0408e1c4d51b3ae0b16eeff481b685a92ae3d9", "object_relation": "sha3-384", "Tag": [ { "name": "185-149-24-201", "colour": "#B067C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348382, "uuid": "df4cfaeb-cc66-4fba-be26-6aef038f931c", "value": "T1793523171A1DCB1AE5E64BF02EB2D27043B48E4CE961EB575DE8AFC774627207908327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348382, "uuid": "bbb5c735-b7c3-4348-a5d2-d6d57a6016e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348382, "uuid": "d49b2db4-90fc-4d80-89e1-145c75d72745", "value": "24576:Bc1o+vZTk3YCuLHOx02971OY+d7Po5w9jnhCH9FdYTi9B:OlQgDHM71Obf9jg7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348382, "uuid": "237c51a8-af80-451f-92d2-4d29630bfb82", "value": 1162240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348382, "uuid": "c1444cd7-14e6-4db3-bbd1-7c45db905c4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348382, "uuid": "100ddb31-768e-4b09-8c54-b69a7fbdc69a", "value": "emcs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7847110-b9f8-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1762313833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313833, "uuid": "e8e59571-199a-47f5-9c14-6630e8c85585", "comment": "Malware payload (QuasarRAT)", "value": "8bef9a2dd87e19ad863726fe3b33bf0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313833, "uuid": "7ccb187f-5cc4-42cc-ad55-9bb92c165050", "comment": "Malware payload (QuasarRAT)", "value": "eeb612949e0c08f8aed99e6ac2dd4351336904bcb1961fdd9295e924bc3fbb6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313833, "uuid": "8a146be2-dc51-4cb0-82ef-174d038ddcd0", "comment": "Malware payload (QuasarRAT)", "value": "b9b339531c617fc70227edb970aa918f47f6015a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762313833, "uuid": "799542b2-4437-4682-9f1a-2e8e6087fefb", "comment": "Malware payload (QuasarRAT)", "value": "6ea640ec66a2677d87569040cea063bc2a9d105992e5ff1ef6c7b984f60e4f575013e0d8570f6bb85291761ae5290118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762313833, "uuid": "7e679431-3c7e-4e74-914c-2ee0e0cf9687", "value": "T1E0747C1333A4EA3FD1FD173AE4324A164BB0D4477626E39B5A5865F92C133968D823B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762313833, "uuid": "27663d26-d3ad-4e86-8905-c24a1bfff82c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762313833, "uuid": "4463d0cd-5870-47b9-adc0-03a466d420bd", "value": "6144:lB6bPXhLApfpOimzVv6JSbycvob6H47de+TEXSe:3mhApfmViGo+Yxe0EXSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762313833, "uuid": "385c388e-b0d5-4328-aa5d-dab92ece5845", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762313833, "uuid": "6bb06081-a7c1-40b9-ab38-f2749c0beae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762313833, "uuid": "eaa3be7b-6080-4fab-9a1f-3f49613fb7df", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c8a844-ba10-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762324171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324171, "uuid": "44a1bfee-3151-4061-8553-51800ebd9d36", "comment": "Malware payload (AgentTesla)", "value": "86973dd14397c79a1f1ffbb79d948a30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324171, "uuid": "55cae09b-e2c3-44ca-bd18-ee1cc0dbdb2b", "comment": "Malware payload (AgentTesla)", "value": "ef49dc056a938178adb76b87f8ec84ee3c6dbf37d9058a609c5c399c592dfbf2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324171, "uuid": "d1ef5967-8449-4f4a-9d3f-24700e5ce896", "comment": "Malware payload (AgentTesla)", "value": "ed2e7b71e3a46945976e41bacaef085d1973cc43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762324171, "uuid": "94227924-6cdf-4bec-bd0b-28f972c2b14e", "comment": "Malware payload (AgentTesla)", "value": "312929224ad05a0b1ac37c872fea6d4babd07352e96f0f9af593bfe4f3dd0670b2b77950576934d2ea5ca9221c064ffa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-carbognin-it", "colour": "#24F700", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324171, "uuid": "dea5f88a-3335-4623-af09-d796ddbd5cad", "value": "T1EF65022A5AC64817C66C8677C06151285370D8ABA143D3EE79CC67F4BFF3B6ACE53092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324171, "uuid": "4b5c61ba-ba15-4dc6-b410-957c4e49bf1a", "value": "12288:LnUAK2q5b9XjilseLYBhXrMeT7e7yIw9LNg9ZunLPKstytYyn37lrzdlqLPHTVH8:TU/2ges9re7lw9Wr8SB7lXvqzRHKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762324171, "uuid": "9e20c1c6-562a-4a12-ad4d-fb6b5ba146b7", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762324171, "uuid": "cac3afcc-3541-4d19-980f-3316530112b6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762324171, "uuid": "5bc9e1ea-bf38-4eab-afe2-d1488a00fe19", "value": "ef49dc056a938178adb76b87f8ec84ee3c6dbf37d9058a609c5c399c592dfbf2.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc8acd5-b9e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762307213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307213, "uuid": "53fa2cd3-23e2-44c5-bd3c-63550b61c189", "comment": "Malware payload (Mirai)", "value": "607b42ac1af415d8d4cd0f511588c75e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307213, "uuid": "646e8063-f79f-4ef6-8beb-5179449a6337", "comment": "Malware payload (Mirai)", "value": "f0619749061d761f3cf4bec104187604e1b8bfa0342709f4924c498099411f8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307213, "uuid": "9b04434d-9226-49ae-aaa0-93062af10416", "comment": "Malware payload (Mirai)", "value": "a749dee5175ce0ab75856669353ee071ccc0fb6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762307213, "uuid": "99a5d41e-46f1-4db6-9a59-1b76f6254cc3", "comment": "Malware payload (Mirai)", "value": "62b860c7361a27b11ffb1a9d1fdddf8b532ec58906fe51ec83ff98699d38e5af46598b9401a82c70f4a4fc6b1b7c29f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307213, "uuid": "53564424-4035-4e42-a036-8842076bef4e", "value": "T1F7630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307213, "uuid": "7ec0d1c8-cd3f-4853-a4b8-ea11f0e219b1", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762307213, "uuid": "ee23e8d1-79aa-49a9-b86f-bff5a5e3e842", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762307213, "uuid": "be781f2c-c10f-48c1-b3c8-2d8422376aff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762307213, "uuid": "15b33d7b-ddbb-494b-83b9-0e10cfc4fa67", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f97ef4-ba54-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1762353179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353179, "uuid": "688081e0-3893-4d26-9743-5272fb1125e7", "comment": "Malware payload (VIPKeylogger)", "value": "ac9435f640abf502ef8e79dea99b72cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353179, "uuid": "d49a1c42-cc34-47ad-a476-8feeecfb6a7a", "comment": "Malware payload (VIPKeylogger)", "value": "f09a6e9af82bae02f6e21ea087b51fe70e15e3fe850ca99a843d20d866067249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353179, "uuid": "b8edd159-88d9-4a31-b21c-f57bbb66c30c", "comment": "Malware payload (VIPKeylogger)", "value": "601e9efac80d0c6f0aae24ecc45647135194e26f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762353179, "uuid": "88403680-c1f6-4b72-a7f4-8fb7e7132af9", "comment": "Malware payload (VIPKeylogger)", "value": "60740ed94d1bba31833fa04f3491781aa00d7a47faf0d302a9b3ac00e1356b123dd7b981fd15d9fe847482d874ef2472", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353179, "uuid": "50594cac-a5c6-441b-a81e-04102d831558", "value": "T1771523A1A3A5EF23C1825575D53BDBFE950EAF10DC70160F2644FE88B83634B952A393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353179, "uuid": "62194ec6-247e-46ff-b31e-96fc5c98f711", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353179, "uuid": "aa117c97-7fcf-40c0-a00b-a9ed203f068a", "value": "24576:jN+OFj4C1mTLgku964/NOjzuHG91mRKvZUQ:joOFj0gku9RwpXSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762353179, "uuid": "53001c16-08db-448b-a879-8b5234934a33", "value": 891792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762353179, "uuid": "f50ef2e2-8975-4091-b1f9-b83850340718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762353179, "uuid": "a9974f5a-b86f-4b09-a8e3-f6e7724fd9fd", "value": "Fejlbehfter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2ffee2-ba48-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762348150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348150, "uuid": "0320ce94-1f40-43f2-abbf-4a11ab85a4ac", "comment": "Malware payload (DonutLoader)", "value": "3c19842b65bcc596fb3635bde34fabd4", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348150, "uuid": "a11c5f57-43a5-46f2-8e8b-d427b8693bb7", "comment": "Malware payload (DonutLoader)", "value": "f0c9477f23fa9eb5e36f106c634554b30df83db7310be7e61b3ce57979a73853", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348150, "uuid": "72d3aa73-93ac-4d05-b12c-b9ed219c729b", "comment": "Malware payload (DonutLoader)", "value": "cbbfe7c20f2f98c85172b5025d58bc925b63b41b", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348150, "uuid": "9adcb67e-86fd-445c-a3a7-1ad2e8a49a8b", "comment": "Malware payload (DonutLoader)", "value": "234ff4897d7c7b439420d50739bf720e52fe748c1b345af1b31ae0fc681e0e2395b07b7ac140359592383a3cfc63b543", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348150, "uuid": "8756ffea-6a58-4b55-aede-e0268b53eda1", "value": "T19886E7002BE0249E52E7AE72EB2F61D0EC0E2D1B39864C4BB126FD96757D51EF660D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348150, "uuid": "d4877aa7-e39a-42ff-b519-82f133914a14", "value": "196608:kgJzCcQIjb+93oCaGO+/g/gZhgM4XVp0g:PJzVjSejG3/gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348150, "uuid": "e4ea96fe-dbdd-4f41-81fc-e29fe3522ea6", "value": 8136298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348150, "uuid": "6693ecb7-d876-4f91-8a20-ed7b34a20140", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348150, "uuid": "30dafe9a-cde2-40f2-82cb-3bcf355d2aa6", "value": "f0c9477f23fa9eb5e36f106c634554b30df83db7310be7e61b3ce57979a73853.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db3fc5b-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1762335935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335935, "uuid": "26113bfd-9b94-4f04-8a3d-164ab288e677", "comment": "Malware payload (RustyStealer)", "value": "c4b3b1ba2eebc4eca05a200f799dd38c", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335935, "uuid": "a9c91daa-eeaf-4534-a48f-f4eb990b6326", "comment": "Malware payload (RustyStealer)", "value": "f0e1963efa5bfa96ae1a1e370fa2c70a044a03279f2fdbf07391c7e08e295e93", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335935, "uuid": "e4bdc2b7-0ba5-490b-b7c8-8745ca2b345b", "comment": "Malware payload (RustyStealer)", "value": "cd5d3c98a7e188da1418ed715a0c6cb30885e545", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335935, "uuid": "8f2af0c3-b8a5-49b3-91f9-caf27a29e041", "comment": "Malware payload (RustyStealer)", "value": "21528991c9b7662b9934546afba521e2443c3a6c075ae0bbd668c366b4c9957f6d7c9ef395d445419ba24b3fea4d637d", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335935, "uuid": "d19b4c65-1bde-4728-ab23-474f39c6d2bf", "value": "T1DCD64B217B8A99ADC05AC470828647725A3174CB1B35BAFF44C496793FBAAF41F3C358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335935, "uuid": "5f57de89-03a2-49e1-acbc-be0e3d32f2c0", "value": "e95120bb7ffd0fe3a3b4d992f1b99e30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335935, "uuid": "62b25872-d1e9-4162-bf3f-7c311295a492", "value": "196608:jVYK5t76XGY70X+1jKg/aaNiLvO9qvrGCCgI2e2/:jVd5t76Xb0u1jKg/TiLW4T9Cf2eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335935, "uuid": "d34d8f46-ae17-48fb-82ea-2c05c069a56f", "value": 12857344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335935, "uuid": "762e271d-e179-4fb0-b427-31921972a9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335935, "uuid": "1c70e79e-73cb-4a19-aace-e424cfd7a3fa", "value": "f0e1963efa5bfa96ae1a1e370fa2c70a044a03279f2fdbf07391c7e08e295e93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fab0e8-ba20-11f0-91c6-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1762330829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762330829, "uuid": "41a9b5a5-453c-4dc9-859d-bb1a43ac83d2", "comment": "Malware payload (CobaltStrike)", "value": "2d98445783055f16fa6c4a8975fa859a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762330829, "uuid": "fc09d288-14d3-430e-adec-01656a495b1b", "comment": "Malware payload (CobaltStrike)", "value": "f211c45c2dd508734dbd84d088e08848f116a978c2c3982260b4122c5785e47b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762330829, "uuid": "eea31830-cff8-4d1d-b1c8-1c5ccd447b92", "comment": "Malware payload (CobaltStrike)", "value": "0297f81ad921d5291ca6ae200491b4f0a4b10b27", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762330829, "uuid": "27379de4-fecf-414a-8480-eabdbc5484ee", "comment": "Malware payload (CobaltStrike)", "value": "2cf44af69583da5f15de583d38ca0e6fec1d0ca6b84e7f82f8e2d404e999eba10bc580f8b213d3002895a65f9b0f752f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762330829, "uuid": "5f56abc0-65e8-4965-9db4-0aa74dcfda6a", "value": "T119361942EFD48212E3F35B3194BB87619B31FC41B921CF1F2258EA1DAD31B90AD91766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762330829, "uuid": "58b8b0d2-3505-47ae-bfc0-4e517d5866cf", "value": "49152:1S6Xv29C6EqOK6BePTbHvaxZP4IFkHo9irX2KPR8YzqU5x:1Sav8O9cKBAvP6G75x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762330829, "uuid": "e801a7f5-ef3d-4608-9d9a-48e28ac10e14", "value": 5243360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762330829, "uuid": "0b397614-b25f-42c4-aae6-e45bbb4a9854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762330829, "uuid": "3a1a8f95-0b35-44b2-9c44-6013156da47b", "value": "f211c45c2dd508734dbd84d088e08848f116a978c2c3982260b4122c5785e47b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a3e685-ba2f-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleRAT)", "timestamp": 1762337455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337455, "uuid": "c4540e11-8e82-45b1-91ea-78e0c28147c5", "comment": "Malware payload (CastleRAT)", "value": "8e57620fc89bac21cdee0b40219b8341", "object_relation": "md5", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337455, "uuid": "cd372bb2-b5d9-4399-88f8-38d05b62c1ae", "comment": "Malware payload (CastleRAT)", "value": "f2e36ccfeb225009ae229a2be905deff587c471b8d47690dc7f5111e1bc611af", "object_relation": "sha256", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337455, "uuid": "1cefa243-c64e-4170-b398-cdcc04659c5c", "comment": "Malware payload (CastleRAT)", "value": "c8c27eb034e01bc4b3d85571556dd178bc30ffa6", "object_relation": "sha1", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762337455, "uuid": "82b4c4ed-75d2-4c92-b469-b092620c6369", "comment": "Malware payload (CastleRAT)", "value": "4d03c5859bcd9b8ded53e484038ef2fab6119784fd0d3fa514083c14e2793453aabc7f2440a3c7a953e233d7de30db0e", "object_relation": "sha3-384", "Tag": [ { "name": "castlerat", "colour": "#8F01B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337455, "uuid": "d50e3412-abf2-43d8-ae90-8c097e64f53b", "value": "T187D66C6F7661A668C35DC23FC1A38F05E43371B91733C6E783A402686E5A9F45E3E624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337455, "uuid": "c38f3ab8-bbc1-4389-bdef-19e3def27803", "value": "de6273c02bd4519d211a58c54c890cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337455, "uuid": "887ac489-2404-4932-a620-dbbceebf1c99", "value": "98304:MRkyhrOHMsfh0V2Qcni6u4+PfyPz4ep/LEdQI:Mnhr/spCXciPf4zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762337455, "uuid": "6080364d-dff9-455e-8cce-5957b0fe5cff", "value": 13041664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762337455, "uuid": "4de3bd8c-04d4-4470-bf38-465cfc234972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762337455, "uuid": "f19f469f-2d77-4bf5-8957-260ead2af02a", "value": "f2e36ccfeb225009ae229a2be905deff587c471b8d47690dc7f5111e1bc611af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f56cf0-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376721, "uuid": "682d4767-6bb3-4397-b96e-b57a50b0748e", "comment": "Malware payload (Mirai)", "value": "90908ed0e8a2b70fe5f878cf69aa3e1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376721, "uuid": "ad768a88-8176-4325-933c-cd9d19d26afc", "comment": "Malware payload (Mirai)", "value": "f3d5fadf7c8d9d943ae32a88d76821f96e69c771db8e6300620a4accaef9cb7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376721, "uuid": "a1b11be0-8db8-413e-9851-fab75eb8b85f", "comment": "Malware payload (Mirai)", "value": "3b8be1b04b96f6fc96b143c87a1306c918a9e2d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376721, "uuid": "85261ac0-cc51-4451-912d-ef4ae463f2a4", "comment": "Malware payload (Mirai)", "value": "c13a4afc0abe27f54c01a98e7211196c6316d56e94b00465950fe1d6cdbe9772b9c394dc486708be3da25347435598a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376721, "uuid": "939c73bf-8b30-4b47-b274-34e99c3d87d7", "value": "T1C1A2D029D345AEF4DFEFAC9456C2C2C27AE547C7268AC8E340EEAF017506046B789D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376721, "uuid": "d02d1964-3cbe-4ce9-8714-368687cd162e", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5xMM4uVcqgw05VxJ7:9RxsSVsMD6xiJJE5zRWNzz4uVcqgw09h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376721, "uuid": "976df11e-9a56-4267-acd8-48ac9dfdbcff", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376721, "uuid": "838c88a9-5eb7-46b9-9f91-cea3f5815ca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376721, "uuid": "a25e0062-0cad-45b2-96c2-9a2e0aaf5e86", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a5157b-b9fc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1762315440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315440, "uuid": "ad493b2a-d8a8-4f31-b2b8-48cdc7398e79", "comment": "Malware payload (Cobalt Strike)", "value": "ac4d8939aa4760ea141b47258d218c96", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315440, "uuid": "21a37106-0dcc-4d9d-a8a8-3bc1e0388a18", "comment": "Malware payload (Cobalt Strike)", "value": "f437051030243bd86e3528930a1e987cbc084d31e8150316246132c463e7dfeb", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315440, "uuid": "25147bcc-5bfb-4165-b93b-36d8c9b540bb", "comment": "Malware payload (Cobalt Strike)", "value": "4235458f79ce2544ad6f296f074fad04054ce8d2", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762315440, "uuid": "3bd00238-b187-47d7-99d8-207673440c7e", "comment": "Malware payload (Cobalt Strike)", "value": "a375308c0d8614c5bf8c0ad0fb292d690d64569c041dac85ed604bb7325fae65ec6af86058d6c00cc2e00b50adee8db4", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315440, "uuid": "2096dce7-f7d5-4ac6-bc3f-a2d2c43f1aa4", "value": "T191947C463F59A9ADD612F126EA2EB0C235E0B52F91A58AC0B7F5D4F119F802134F43E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315440, "uuid": "57d3dfd5-0c99-4f05-b501-41af2154b865", "value": "12288:2gC4sdGvWAqXqcVIonHFJqEs8Kf7rbkJI:DvWp6ToHKEdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762315440, "uuid": "a0130f14-422e-440e-86d0-c97b647e84de", "value": 416813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762315440, "uuid": "3d7784ec-b0a8-4eb7-a225-9586242fac3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762315440, "uuid": "f0826ed3-a263-43ea-a50a-2a200f331db2", "value": "powershell.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e31621-ba50-11f0-91c6-42010a9c0006", "comment": "Malware payload (GootLoader)", "timestamp": 1762351376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351376, "uuid": "29f38671-5f94-4847-9607-bd64f9eb1efa", "comment": "Malware payload (GootLoader)", "value": "c686603c1d542604e5a1bd0b9b6922c0", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351376, "uuid": "7fd0c390-c185-4cad-9fb0-4f70a4f3d6e1", "comment": "Malware payload (GootLoader)", "value": "f43e62b58f2fffe52fcfe3e844a599696c861e3123922d2849109ce3151cefc5", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351376, "uuid": "e609e766-dd11-406d-836f-4860613aac67", "comment": "Malware payload (GootLoader)", "value": "df9c5ef0d377f2cb72e6503d5230ba4cfdfa9871", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762351376, "uuid": "a0634deb-6036-4369-95d9-f03f457d0224", "comment": "Malware payload (GootLoader)", "value": "b1d75f9cfa69b3239af4a6151ae04ef1bc650147fc7e4e8a0ad57d4df80678df2e289a0c8298f80ad688294bd5e83324", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762351376, "uuid": "a87a1807-f85d-4d53-a4dc-05bf418e92f5", "value": "T17254026B6E6ED7B88796F7D1684437C35F8D6F0E3D136210CA1DA4A5E389CB9CE10A10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762351376, "uuid": "3c8f8100-4828-411e-b96f-b2a222a354e7", "value": "6144:SvszuuS5u348vMa+PnkQfZavszuuS5u348vMa+PnkQfZavszuuS5u348vMa+PnkK:ysvau34cQkQf8svau34cQkQf8svau34h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762351376, "uuid": "7f3fe873-3c59-4f30-9e52-5ba02fa3f3ef", "value": 294636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762351376, "uuid": "c9b29898-51f9-427f-861d-6d6407ef10d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762351376, "uuid": "395d3fc6-73de-4d1c-9196-4cec0fe34911", "value": "Ultimate_Guide_to_Contract_Deeds.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08312fa7-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319981, "uuid": "c0d9b591-a6f2-4a38-93d3-f6dc53e2baa3", "comment": "Malware payload (Mirai)", "value": "642814fa2c9f58675af8c023ca8c460f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319981, "uuid": "02839e91-b984-45ad-b092-513276c2a456", "comment": "Malware payload (Mirai)", "value": "f45f1244d8f4221c895509af1921cebd8700de25031e6374dfca53dd95779066", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319981, "uuid": "ce23e10b-24f3-4207-86b7-ac6582c043fc", "comment": "Malware payload (Mirai)", "value": "1f8cc8f263220ed31cb5bfe5193886668422b57d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319981, "uuid": "5beba1fa-2403-40ac-bb4a-9f73d45927b5", "comment": "Malware payload (Mirai)", "value": "f66100f1887849d53bf5ca92c9a36985b2385ae262af2fd70d73a06fe33e8b4f5a0f20b57a53247e7a2870fd3827bd10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319981, "uuid": "cac05057-9a10-4d0e-98ac-99fdf90721e5", "value": "T1B403F184195CC370EA774A347C95A7A1E9E04F78A42A582773032F93CE787B285D1AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319981, "uuid": "4b7031f5-241e-4731-a265-300cd56ebfed", "value": "768:WQurVtHjVvw8ncP0C/N1uePFYFwxk9tQOUfE9TswAF7rBZQqcnpKpF5o9KyK:ije4cPbF1nPmPyfPF/kJ9KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319981, "uuid": "47e996e9-3087-4325-96df-8ba9f14a5fba", "value": 38868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319981, "uuid": "b7b9f360-dcbe-4a79-a2c2-353a0e8107d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319981, "uuid": "32bccf93-0954-46a8-a490-dd7bece94b40", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445ff71e-ba2c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CastleLoader)", "timestamp": 1762335973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335973, "uuid": "d9124a61-3b8c-4c04-a38e-c4737358a1f5", "comment": "Malware payload (CastleLoader)", "value": "14610b22a749a0cd464d1985abbff45f", "object_relation": "md5", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335973, "uuid": "2134e126-5e13-4604-a301-743fbaa713cf", "comment": "Malware payload (CastleLoader)", "value": "f4bdea09e45471612689bd7d76aa5492fb9de69582d3cf5082d585c16e340d4c", "object_relation": "sha256", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335973, "uuid": "c43ef1b4-62da-4a0b-8397-3d92aa4b665d", "comment": "Malware payload (CastleLoader)", "value": "d893820c78e40b6f69c488c6441a180601886dc7", "object_relation": "sha1", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762335973, "uuid": "9e0b7cda-194c-40de-aa11-76e84161a56b", "comment": "Malware payload (CastleLoader)", "value": "5997c2e101b0669b0be188199219e7bbf00a1fcb7d3339efabdd9b3833d52b3628c00901e7423fb868375ba2e49b023e", "object_relation": "sha3-384", "Tag": [ { "name": "CastleLoader", "colour": "#3A5FB2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335973, "uuid": "ba3f7d74-0288-4be9-84d7-7e65f877c6ca", "value": "T122159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335973, "uuid": "2dde6f2e-728b-4e66-b1ca-4c579e664a2a", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335973, "uuid": "05f63feb-6504-4c32-9d9e-bd7cfef67c64", "value": "12288:1qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaI7Z:1qDEvCTbMWu7rQYlBQcBiT6rprG8aIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762335973, "uuid": "c073dfb8-03e0-48dc-905d-3522c237bcee", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762335973, "uuid": "6c991df6-9f5d-4e93-822e-e3a697e400d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762335973, "uuid": "a2c81383-f6e0-4ac3-83da-9cbccc0bad33", "value": "f4bdea09e45471612689bd7d76aa5492fb9de69582d3cf5082d585c16e340d4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9ec5b2-ba48-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762348174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348174, "uuid": "1966e9f7-42cc-4853-a2c7-81c9a9e5ed0c", "comment": "Malware payload (RemcosRAT)", "value": "8ffc9ced79eb1867fcb3827ae1988889", "object_relation": "md5", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348174, "uuid": "20dcda7c-aaec-44c9-a6f3-07ae1ed8ba7e", "comment": "Malware payload (RemcosRAT)", "value": "f4f56f077c2579c9b5ef44b37f3a11cdbebb9b6527839b8f69cf5709d86f4890", "object_relation": "sha256", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348174, "uuid": "5e3a77be-a23e-4473-8bc4-44206ad01fd4", "comment": "Malware payload (RemcosRAT)", "value": "2e77a8e89c3e11e76ca0940c5b2263701c25b25e", "object_relation": "sha1", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348174, "uuid": "19911978-b7be-4d9f-90a7-b8b902adb0f7", "comment": "Malware payload (RemcosRAT)", "value": "b0d7d5b80b4cbe4427d9e937aedebdae044d616a19c8f9d8e060904e5a69635919bfebe8d079e2cbacb44e1ad35bd898", "object_relation": "sha3-384", "Tag": [ { "name": "arusicucloud-es", "colour": "#B47B41", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348174, "uuid": "b82bff34-406c-4e96-9974-5f7d0cb7c18d", "value": "T12AB4AE01B6C2C0B2E17354310839EB75CFBDBD242835997B93DA1D57FE305919A3ABA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348174, "uuid": "d15dae3e-4a64-4f6e-b307-95006e0cb086", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348174, "uuid": "508a98e1-4b79-4e2a-9a54-81ecc72fdfc7", "value": "6144:ulNyrBOlAl4eajA0VGnjeBobKvrsHaerUnYNxi9lw7RuqdwqsAORZq/XQ+cqs1Mw:ul8oq4eheG0YKvA6erU5XwNFsPZqmSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348174, "uuid": "17335a1c-7d88-4ce3-93a8-2664dbb28c7e", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348174, "uuid": "81a5e791-420f-4a6a-b903-15135e007551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348174, "uuid": "72a02965-dce9-4c96-8b5e-0526598f1bce", "value": "f4f56f077c2579c9b5ef44b37f3a11cdbebb9b6527839b8f69cf5709d86f4890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be8f19c-ba8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762376869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376869, "uuid": "5c3af7e6-17ec-4e9b-bd76-e9a36cb1af93", "comment": "Malware payload (Mirai)", "value": "27d9643432a8a178671a99857e7564a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376869, "uuid": "427a2e5d-826b-4f1b-be46-3afaba84147c", "comment": "Malware payload (Mirai)", "value": "f5e9111ae3d2e395c990e2859ef6f1de67510fca71472efed63326f6865d23be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376869, "uuid": "80dc275e-041b-41a9-a770-243add8837b7", "comment": "Malware payload (Mirai)", "value": "b63094414a9522ecb6b3b364fea6aa5d01dc31c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762376869, "uuid": "1d40724d-9106-4c0d-b4b3-9c2d176ca840", "comment": "Malware payload (Mirai)", "value": "7c2d69e419c2a419d760b371a863d62568971a755c2e00e5693b7acf4eec04b25f783c05ebcd6e7385a4cd792181fe92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376869, "uuid": "cb8b2ef6-e5c5-4347-b14c-d4549bcc7559", "value": "T19D330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376869, "uuid": "6f3415b1-b0d4-4970-b9ce-7d3e7cced3bc", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGN:r/hqaJMDg9eqK806MHdkfQX6HuCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762376869, "uuid": "53b85576-fcd2-489a-86e2-ac297ed3571c", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762376869, "uuid": "dcfd7984-ddbb-41d5-a3cd-be97db998e8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762376869, "uuid": "a77bc720-b0c3-4b27-b44d-8e5dc4eaf933", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3554ead-ba3b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762342629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342629, "uuid": "0d031157-e3be-47ef-aa06-46b0ce0f00df", "comment": "Malware payload", "value": "416275bb02a22efbf68717c00046dee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342629, "uuid": "91332db1-82db-4f9d-a5de-fb97849ae970", "comment": "Malware payload", "value": "f63ee52cf8bc3a075eddddeaa198ddb3bff5adf3da41dcc68f28a4e1ca2cd506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342629, "uuid": "dbafa896-e333-4599-907e-e30c10702c07", "comment": "Malware payload", "value": "c6042110b028c99644f5c2c849cbc98484e91708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762342629, "uuid": "7980e475-6bd2-4c85-b7bc-c7fa13531fbf", "comment": "Malware payload", "value": "715224f08d7c2895c4997a6e908ebb3f2a2731c97b1bf9bb5eecc92914cf34932a4738d82a2c41b7d3ffc3b296453145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342629, "uuid": "9abe9063-4cd7-4b93-b6c8-e230b9d32efd", "value": "T1E8832A35CAAEB07ED3299A78DD020D95CF63BC8A0794BF9753E10DE60F96A501F2C584", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342629, "uuid": "625d1ee2-98eb-41ee-b9a4-d078dd5ceb2a", "value": "13202ae6e20dc0e6f8ae3713ee808076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342629, "uuid": "4c0e655a-c4ee-4d3a-a7bc-3181795a3728", "value": "1536:+KJry/hjDGlrjeNHK3xnmF/MbA9mFYVM0:BW/hDGl/eZblyAM+VM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762342629, "uuid": "d62c15d4-abd2-4b20-8bc8-2a61ac85ac1e", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762342629, "uuid": "bbe1088e-66ba-4521-8832-471fb3b13454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762342629, "uuid": "fbfb790b-b6fc-49c4-b733-3dac8b3ca4cc", "value": "Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67828aa9-ba5b-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1762356218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356218, "uuid": "6de192d8-e0ae-4015-9eaf-bed105dcca83", "comment": "Malware payload (LummaStealer)", "value": "509ce52255bcf20a27348d728caf588a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356218, "uuid": "e9299242-3f5c-43bc-b056-ba13dc930e18", "comment": "Malware payload (LummaStealer)", "value": "f71dc004617664a87554d7675827acd889a6e3e40f7a7b69fa777b9f46e6b734", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356218, "uuid": "9746a100-541f-4788-be91-b2440a8c3d0e", "comment": "Malware payload (LummaStealer)", "value": "90240b28418d07adf3cb5bc5ca308443974e7882", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762356218, "uuid": "777250ff-03d5-496f-a284-97c101861eac", "comment": "Malware payload (LummaStealer)", "value": "a64e8342c79b12e651bbc6088ab9db5284b038f4b4fb4f25031c11cfeb044129dad2bde43987c34750a8af4e598af08b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356218, "uuid": "f1e89ad1-6e45-4e66-b00a-402fecb4eac1", "value": "T16DA59E47BCD098A4D4A5D23248719091FB35F869073E63D32E1676BA2E777CC0D3A7A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356218, "uuid": "9871a1f8-a617-43b6-8387-8e48d793b57e", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356218, "uuid": "d0a3b2ef-b46d-4d7b-a414-01c04d9e87ee", "value": "24576:YMhWjJqkYurM6Lkc2+R8YErDg8WC2lFCyeva5CE8g9A0pNFi:YMhWjskFMVd+R8YEo8W9evg9AQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762356218, "uuid": "b6f98188-6d33-46d9-af70-3a1bcf6293df", "value": 2082792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762356218, "uuid": "9d7dacf2-bf9a-460a-8849-5a21251e3f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762356218, "uuid": "87a0f5f1-0e74-4245-904f-17e4db54c2b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2c3c47-ba6a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1762362806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362806, "uuid": "5eecc948-155b-4718-8304-74fda96870ca", "comment": "Malware payload (Adware.Generic)", "value": "4f01d026a0a6b46a26869a99997af5df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362806, "uuid": "ec04c894-7aea-4f85-96a8-29de34cd10eb", "comment": "Malware payload (Adware.Generic)", "value": "f76439295941334a6b1a65c2c49c9f233594c35083fdf67db015832cb0976192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362806, "uuid": "9d295eb3-78ec-4b56-8ed6-8d81c013012e", "comment": "Malware payload (Adware.Generic)", "value": "f5b2162296f67280675d6febc50eef07396118fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762362806, "uuid": "0018aa12-e5a4-4d10-8a42-e6879bc06170", "comment": "Malware payload (Adware.Generic)", "value": "35d487f07f7167c5af3a2a1ca43af873bd6d58aac15b4a827dd3fbee4e691138c62bbe66854b5dcbc2fef74e09131f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362806, "uuid": "3a77b037-0929-4ea1-a997-c311a7a6cc28", "value": "T16307333FB2A8A13EC5AE5772057383105C7B7BA1B81B8C2E47F0495CDF624612E7B619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362806, "uuid": "c643154a-c690-4866-b883-81e001256f2f", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362806, "uuid": "bed39a3f-8540-44c8-9ede-2aecc6151d52", "value": "393216:M6/Rf0ItkrCXASg/jtukTbUtyXwpIbvO5M07i:MDIer0ASg/jt7TuyXQIbmSSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762362806, "uuid": "94d0bda4-f2af-4f4e-a9e5-d874fa29c794", "value": 17754603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762362806, "uuid": "b8e3db7e-6ba2-42a3-aa7c-308c314fe0f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762362806, "uuid": "ea9c246c-1e21-4980-8e45-1f85e6c7856b", "value": "\u6570\u636e\u8d44\u6599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037effb8-ba07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762319973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319973, "uuid": "af975bae-c3f0-4ec6-baf6-487822d85fb0", "comment": "Malware payload (Gafgyt)", "value": "cb47cdc91dcdb15b2c01ff1b8cf03d57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319973, "uuid": "e0d6ef88-3771-40f8-a542-0e9b8a5ff7ae", "comment": "Malware payload (Gafgyt)", "value": "f7cd8a0e788fa413dfb0e9c4e0dbb6529d604f45606f49dc8fabc1bf363b634b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319973, "uuid": "6775c36e-5569-46f3-be80-0feddc246168", "comment": "Malware payload (Gafgyt)", "value": "4248ecc7dbb3571a473147210387d01b02621a48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319973, "uuid": "5aa71cc3-0ab4-4e09-a7ca-10a85fa78fd9", "comment": "Malware payload (Gafgyt)", "value": "de229424f29a9aaa52ec15e67207e00fd97a118b862990530df39e5337020c0d3d557bf5668a75e49ce6b873d8a7f013", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319973, "uuid": "59aa0c29-4081-49fb-ab7c-580bb58cecb7", "value": "T12FC32A36E5114F76C083A5F12868AC311F1895D72B6F29CA267457E08A9F4CBB44FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319973, "uuid": "cba155d9-908f-4ef6-b3d9-f6716df92165", "value": "1536:QxDDJuyx7xr3FV+oEIOFEFRb0NTKdDGSnFhP5sVQ3Cv5hBCA:6Dxx7xr3TjaFi0NWd/Fhl3G5hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319973, "uuid": "01c2ccbf-cdf8-4205-98b2-a58a3a79bdff", "value": 120344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319973, "uuid": "b7d9a571-ca60-4d9b-8560-b912a6898568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319973, "uuid": "83ec5818-1450-4e5d-af1a-f05446181e54", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5653ee55-ba01-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762317535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317535, "uuid": "80e91c9e-f411-4108-b741-68ad75d7c35c", "comment": "Malware payload (Mirai)", "value": "0329c23737f1a81b19ea37158f15c61e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317535, "uuid": "9ab8bd82-53ca-4ec5-9639-2a430946cf9f", "comment": "Malware payload (Mirai)", "value": "f838c2ec86c444d09956934948a28ff6459da7afe820682ead81e4a95deb703a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317535, "uuid": "15847a55-8aad-4940-af12-160be65439a0", "comment": "Malware payload (Mirai)", "value": "892adf81c84b6a3111e73ce0ff99805eeaecbc71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762317535, "uuid": "189e62d3-f77e-4fd9-83aa-227a583b9cbf", "comment": "Malware payload (Mirai)", "value": "ac29c967dc23b3e5501b5bdfbace5579fd32679815b4e2c6c079b0c514c9fef52daf526be4b0c3b21d97de1b110f8a3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317535, "uuid": "680bc75d-2927-46da-930a-a7d5ab8596e6", "value": "T1EFC43845F8809F61C6C529B6F74D42AC73074BB9D3EB720A9A145B3437EB96B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317535, "uuid": "28ee341a-f283-4bb4-a2aa-b089e53256fe", "value": "12288:VfPIjJJeUy/OJBmHFq8Vwy172MHAp9v/G7uPe2h8pXkCDt:VYDeUy3FTP1yyAXvnVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762317535, "uuid": "9883e85d-97d9-4199-b614-f6f58a794276", "value": 592080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762317535, "uuid": "787b92b2-d9d6-4221-9625-f6519eca17bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762317535, "uuid": "e0224c1b-675b-4248-89d2-5fe0eb5e7e17", "value": "Mddos.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920fe40f-b9e8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762306898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762306898, "uuid": "7ff99aa8-cd42-4ddf-83bb-9a17f6a10c14", "comment": "Malware payload (Gafgyt)", "value": "1a93eae4524c5e7a716d31bf5e1e00c6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762306898, "uuid": "c5c73693-467a-4f2d-9e5e-cd61d93e6ceb", "comment": "Malware payload (Gafgyt)", "value": "f85486cdac9e79c89bdf0bf5c49590a1a041843a2830956d8a7a199498d3ad31", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762306898, "uuid": "bc325631-5b61-4df9-99f1-803b1cee221e", "comment": "Malware payload (Gafgyt)", "value": "24033f1b631fd5dcac8d16308495ca0820ec9274", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762306898, "uuid": "b053c8e7-4d10-411f-8a23-a3a8f58d363d", "comment": "Malware payload (Gafgyt)", "value": "aa0b720a15369f25b3018e3f8d48026248958b966cfc80a3064348d40628de5e9eb8ed922746dcdd4b3de868b21054a9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762306898, "uuid": "651bd450-5ff7-4f35-abfd-7f0639c87ea5", "value": "T131318F9E117220383D29E9EFB1BD090C31C29398C0A69F842CDB3BE9718CD557464E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762306898, "uuid": "c2901a6e-afa9-4165-947a-f0fe4da15b74", "value": "12:GHWRvGpz8/SuVNbanacaJvulmrPMLsS/QoAaMapaSZRNITnf64Klq:zJ/LVNb49WWlmUsSoojRNIrf3Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762306898, "uuid": "c2a5724c-30c5-4548-ab3d-5d0321f64d6d", "value": 1765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762306898, "uuid": "21a6e09d-87fb-4d39-a5e9-f37e75130191", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762306898, "uuid": "02398057-9485-4549-9fb5-ba00c8652948", "value": "hidakibest.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b2cbff-ba17-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762326875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326875, "uuid": "dbe53b8c-db28-4cfa-ad9c-24ffbfae84e9", "comment": "Malware payload (Mirai)", "value": "fff8c0a8213fba7c4b285b8600728dc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326875, "uuid": "6b5c287e-0bb0-4ea0-be43-6d7b33d442a1", "comment": "Malware payload (Mirai)", "value": "fa12d9443e043665a9f22fffcf258574554b883109c997ce8abe0485fb73cc24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326875, "uuid": "6b08f056-3a29-4f09-a544-bea945ce3bab", "comment": "Malware payload (Mirai)", "value": "199caf569c90e994488011e7fb25d8608d678d91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762326875, "uuid": "7e94c9c1-f426-4de6-9fe9-b3d1f6996866", "comment": "Malware payload (Mirai)", "value": "2b67d9dd5fca66050ab81b8f71a93620e528e152df0a7a1568c7ebeba21fc8cc10b8fcc7f3adaddb41726306238426da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326875, "uuid": "e53d99e3-4660-445f-a14f-af8379457019", "value": "T18663951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326875, "uuid": "923fd26b-be26-4e40-9296-8b9bc6313446", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatA8:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzXL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762326875, "uuid": "b22f5c00-0fe9-4077-89f3-cf6f2f89d51e", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762326875, "uuid": "f9868aba-52b8-470a-9d8e-dc369fa51e5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762326875, "uuid": "29da4d8a-b80e-4452-8086-f48c588352bf", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a619c8e-ba4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1762348814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348814, "uuid": "442f8e30-b647-49e1-852f-29565a2e90d5", "comment": "Malware payload (Vidar)", "value": "247048abd55317eea4125fd005603ec5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348814, "uuid": "5a481e81-c630-4ec1-b7c3-a5c9c673ece6", "comment": "Malware payload (Vidar)", "value": "fa245a155a129614e23b9dc92334fb78e2ff7896dd649cf490304dee0d2565a5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348814, "uuid": "d9ddae39-6d76-4790-859c-cafffb9450b1", "comment": "Malware payload (Vidar)", "value": "265481319d7cb5fd47fcd98161fba6340838d389", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762348814, "uuid": "aaf6c8c2-e207-4c9c-bd3a-56d2b1854d02", "comment": "Malware payload (Vidar)", "value": "54a603ac89c8201f2fee0f88952589a867832198e27225948465ebf99f73e9650ac77a002932f214cd08238f2d31538f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348814, "uuid": "c2f5dbb5-57cd-4420-bc41-93d02bba17c2", "value": "T1FED48E7AA490D297FA1880B504F2572DE9217435C6762AFF05A0D1A2D91BBF08FD07FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348814, "uuid": "84999a18-19ca-4a84-b8be-f65e49c5f57a", "value": "93136d667479015878a35144e3d585a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348814, "uuid": "cde69294-2993-407e-a2ed-8c4c4d4f21c5", "value": "12288:G5iIot+cETT1qeGSAFcApgLRouFg8OV8cgzVPjdQl4UQEakwmrwgPi8:CiIA+LscApgLfIgJjdQGUQHZmrwgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762348814, "uuid": "705b59aa-df37-4f65-a4e5-a6cc82536cde", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762348814, "uuid": "b30c3c95-1c14-4484-9896-b2c5509b5442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762348814, "uuid": "c15f36a6-8341-4182-bfef-6e80123951d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e85fe8-ba66-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762360856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360856, "uuid": "fbfba602-9c19-40ce-9e7c-24e58eedde33", "comment": "Malware payload", "value": "aa6db27b938a2fb7fcb5c4b678844750", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360856, "uuid": "6638af02-f3db-4ae8-94c3-712133986aee", "comment": "Malware payload", "value": "fb509b860e076fc8fb7649584d98911deae88440a48e4f91ebd12643dfea448c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360856, "uuid": "64dea35c-af9e-4a91-b653-0703ffdf230b", "comment": "Malware payload", "value": "b6be7f8d7d13341ae2345f15a4270caada28cf03", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360856, "uuid": "47c60935-9319-4e50-a45d-c3280844a325", "comment": "Malware payload", "value": "b767e5e464b93b61dd9dc596a9475f0e56439b69ae71a69c1ec451faa6d9400843e677b92b7969a9fb8e6ebbf5a980d1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360856, "uuid": "733ce19f-e0d6-47c1-a521-6999d7483308", "value": "T1C5957D751B98BCB43BFDC226CBC2DCF816677105B9437CCB449523AA0193792FE2664A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360856, "uuid": "5cc9689c-68c5-404c-9794-73cfa92bf423", "value": "24576:xbmxYRrjmJgJg1lnsjNVbhGCe6dZm2hr/3+6XziGYHnbbNxMcONJSbtexsnzpodk:9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360856, "uuid": "83c62475-7df4-4b2e-bc1e-f8f2e8fe88b5", "value": 2028966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360856, "uuid": "994588d3-c428-4bc1-a65e-2ceb5e3e08fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360856, "uuid": "e54be8ef-d3eb-4293-b8c2-a601301c9715", "value": "Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc604de-ba91-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762379261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379261, "uuid": "33fea6ef-1250-434a-98f4-d3d5316149c7", "comment": "Malware payload (Mirai)", "value": "08702ac9e81acb2bb2e542b5d2c8a632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379261, "uuid": "5b3b42ad-6a03-4a33-8ae6-0327b4193f66", "comment": "Malware payload (Mirai)", "value": "fb7c6ced47c3dbfe2e7c4b19fcf63f30f41fda713d5af343f83f0d90c85ae298", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379261, "uuid": "73ec451e-921a-48a1-80b0-a45ffd34fe1f", "comment": "Malware payload (Mirai)", "value": "fa7d7d0f4308607d314b66dbb918f83dc4d1103f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762379261, "uuid": "d904d4a5-0f73-41cc-b3f3-07bf925deff6", "comment": "Malware payload (Mirai)", "value": "90a615840c59f13a1e5c033bb9beea53e4d2596f769ee5a2ca4064958cd58d2905cdaa8a3a2bc556e804e09511450c54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379261, "uuid": "012260d4-b5f9-4447-993d-a9547f0c3e5a", "value": "T1AA03F1FBC31F2FBCD86666B3096CC790BC9AE82604812BAB07BD51F7AC759E13411610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379261, "uuid": "2c86b216-aaa8-4e2c-aa93-2dc88f287e6c", "value": "768:sWTuXkAnRZqJHOiLH/uRo2x6z9EmiSjOdLvVgU0XwePaVIcAx056:7tAImm1SvS3XMVIlA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762379261, "uuid": "d0092b99-1437-4ffc-a291-3ec13d52ff41", "value": 39932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762379261, "uuid": "05b6c4ed-7ae9-4e5c-afa8-659b354fdabd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762379261, "uuid": "67e681e0-92a2-4285-bca5-8a2e0cfe8198", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079cde90-ba06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762319550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319550, "uuid": "00100531-c14d-4cc7-8253-2dfc5e58716d", "comment": "Malware payload (Mirai)", "value": "8a4e1ac243fde55a004a04e372f84b55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319550, "uuid": "3b412d3e-0fa2-4fb7-9a8c-b989ec26b8a9", "comment": "Malware payload (Mirai)", "value": "fc508da563689afd81fe2e869a23c466eecf24b5030cf6ef3ea8dd22358d0492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319550, "uuid": "fabedf48-4ca3-402a-afa9-5bf35b0a7f08", "comment": "Malware payload (Mirai)", "value": "ed0c97ba68b76d0c0ede1c4c4da46807a5b4b532", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762319550, "uuid": "34699263-c809-4b8b-8bdd-3dca13d7b276", "comment": "Malware payload (Mirai)", "value": "b5625aa503b5647f811c2d2eac4d663a41176ddd683ce9023ec81c01da37bfb73982aac5e2e9aa081b7ed7ab17ebc03d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319550, "uuid": "38f0de06-80f6-424b-9c6b-3872cbca2705", "value": "T1CC03F16A0292CEB4577484B06BCF01C423664A26F36D729139E1502D7E97FCAE7F5722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319550, "uuid": "1ecf4336-0e62-42fe-ada1-6a34764ee27f", "value": "768:QFM2q+9FCvlQJG6eK9wqlO40E7uYoAoe5BIgf0s3Uoz6:gdHjGYG6eK/XBuYoolz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762319550, "uuid": "cddbbea0-42b5-4a01-aea2-1936e327f5a1", "value": 40916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762319550, "uuid": "1b3886c3-0d90-42d2-9fba-46b52fc0d5e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762319550, "uuid": "d1519a07-559e-4b53-ab58-1b708825d883", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d24fa23-ba66-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762360952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360952, "uuid": "dbe170e1-baca-4878-8917-a07e47c8a84c", "comment": "Malware payload", "value": "b5ceeb11106449b9246ec02d26c6444e", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360952, "uuid": "88d0293f-eb38-4c9d-8798-c0ba624be66b", "comment": "Malware payload", "value": "fecf4673d0a0e5a9a1d7b0ef9af44c5cb91b43a33f5e28f3bfa960a7a879d93d", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360952, "uuid": "d1e50637-3842-4632-b512-6892bda9b532", "comment": "Malware payload", "value": "5c026053912e223b0cb15aefbcae1dc54cc7dc50", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762360952, "uuid": "e7a35e25-2c6d-425f-9948-c3a86b102fc5", "comment": "Malware payload", "value": "b3c34772e3596fee0e42c35f8f84b3be0a59c8801edcc62268bf47df9e664ec368105c6846f0ba969475e89c22b7e524", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360952, "uuid": "e71d1c56-aa2c-4994-9ac8-1424b49916d3", "value": "T1BC95F182EEFF5D72C22AC63906E612184321DD188A719A433ACA763879F6F45372375D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360952, "uuid": "88666041-09a9-45e4-8299-63dbd7ee163c", "value": "49152:hXy613UhyImJh4iRZchz57cOlieD27DdPn:0A3UsImJh4iRWL7cORD2fJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762360952, "uuid": "181d6d69-2362-4807-8beb-6261a3ed724c", "value": 1951232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762360952, "uuid": "97f4031b-4f0e-406d-a76a-4c135a00dcf2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762360952, "uuid": "d09ee934-b6b8-40d4-8992-2feb6c3e1319", "value": "purchase order And Richmilbon Holhing Information.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14810b8f-ba95-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762380990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762380990, "uuid": "1b47e174-b72b-4ba3-89f5-81f9d381a98b", "comment": "Malware payload", "value": "0ebeacc2c45e5c848ae274193000bfc5", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762380990, "uuid": "13c0df75-a5d7-438c-b606-9a59d0ab42f0", "comment": "Malware payload", "value": "fed027dcc027fa6862e9e24a66e76ce6812f4cae51eaabadb7e7340220b62fb9", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762380990, "uuid": "48d57aac-ffe1-4be4-a8c9-b2ff0be7f3d9", "comment": "Malware payload", "value": "356ab6648dbef6a84c7830aaf5ea853418f9508a", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762380990, "uuid": "ce6e5c6b-d7c6-418d-a510-45d966cffc36", "comment": "Malware payload", "value": "63b98af1a84e1db281782a91e484907fedc7bf1155a8d1be1f9cfb704bc63670d9207f3b30c989b3a2ddd8800325c669", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762380990, "uuid": "0c811b8c-6453-4c14-aa6b-dc57aee584b2", "value": "T1F85412C85E43343F44BF1D9AA7CE190C29E3E02AE2862145A09EDC4E1D29F5BDB684D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762380990, "uuid": "688932c1-a020-4612-86c8-f6f4332f287e", "value": "3072:TSxz8OMfLIOFvnDgRrPcQsVxq0PcQWPqSxz8OMfLIOFvnDgRrPcQsVxq0PcQWPqZ:TSOOM3FIfshSOOM3FIfshSOOM3FIfst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762380990, "uuid": "97f1215c-55b8-44d3-9cb6-60ef76a14344", "value": 294591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762380990, "uuid": "d7e106b6-9189-4fc6-96fd-a3023271f78d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762380990, "uuid": "a38c7168-dea8-4849-9674-b85f4b1c0dea", "value": "Ultimate_Guide_to_Contract_Deeds.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }