{ "Event": { "published": true, "date": "2026-06-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-05", "timestamp": 1780704182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d17df4e4-2cfe-48de-8ccd-47f9f0e7ec49", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d52cf60-60ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780669459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669459, "uuid": "0597341c-222a-4d1f-835e-d0cdcaecfa83", "comment": "Malware payload (Mirai)", "value": "dfce57922126d0eea58cc78fa9a37750", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669459, "uuid": "82e1f378-b44c-43cc-96c3-de92aef9d705", "comment": "Malware payload (Mirai)", "value": "000588d86e49b8fa2d7175661521bb5f9b03d24698003a84e689dd1239d89b07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669459, "uuid": "970d70ea-3e71-4646-857a-6f666708714b", "comment": "Malware payload (Mirai)", "value": "3655ef8d534af97a85fcd51e52c8263da17b5c5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669459, "uuid": "400b579d-495a-46a3-8699-08c745dd2fa8", "comment": "Malware payload (Mirai)", "value": "bfd353e99c682d301fbc4040510831fa37687243cf1b8bded332a0847b5434da6762accb304642c6567177cff96f8c56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669459, "uuid": "5093e14a-8d20-4d55-a7ef-06f740bd0c43", "value": "T11193F705BF650FF7DC6FCC3786B94B0524CC550A22A92B397934D818F65B28F5AE3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669459, "uuid": "75fbc874-566a-4b2a-8fde-9021b0ea27bd", "value": "1536:zdDmXLhIihQ48HY8GklEyFzhLAzLA9EAK8jIFKbOIX8nqMk:zBwLhImQ48nlEd8jYi8nqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780669459, "uuid": "cd166dac-2c82-493d-bdf7-83df2112c7b2", "value": 97004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780669459, "uuid": "143d34f5-7377-4879-8888-d4081cbe5e0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669459, "uuid": "f5ddc532-9257-46f0-881c-21f26d79bf09", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0006e5-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642105, "uuid": "852ab37e-ea96-4b08-8613-6375f89653cf", "comment": "Malware payload (RemusStealer)", "value": "71ff12fbab703fad1b3ee3795161e6ee", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642105, "uuid": "c6a85fdb-a362-450c-89aa-5174c4aeecdf", "comment": "Malware payload (RemusStealer)", "value": "002205bb150a86c419fed04d3cd85dfd67d04ff570555b0ba42d8fc171fb92fa", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642105, "uuid": "b9e2fe25-73c3-4931-8345-066f3ad2f485", "comment": "Malware payload (RemusStealer)", "value": "eff8d3a2e10715ccb64046d0f20c3400767d1917", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642105, "uuid": "c9c1d035-3528-47cb-a4b1-f99cc535c2a3", "comment": "Malware payload (RemusStealer)", "value": "5b57a51c2a88f3220e6b2963a35c55f234c2310a687bf21a654b1b0b85eb5a96a18b64eb09975c24d902372092ebf6a3", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642105, "uuid": "86bf8579-60ec-47fd-b31b-f9ea9e5705f9", "value": "T1C924296BC35330FCD553C078926A6232BB72BA3D47319EE70292D7319D21EC0AE79665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642105, "uuid": "836f01df-4152-4629-b724-b0b6ef0526f8", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642105, "uuid": "162ffdb9-965c-4588-b6e7-066ea901a087", "value": "3072:BtDPL086KvAq6wHgG08mEthZs6siURap67kJ:rz08pYq5tlthZseooJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642105, "uuid": "ae1baac3-985c-4569-b8d2-f271de37b49d", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642105, "uuid": "d2026a67-6336-4422-bb6c-122bff4ad7ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642105, "uuid": "c8c5bcb2-e8b5-4503-9c08-778204b8792a", "value": "002205bb150a86c419fed04d3cd85dfd67d04ff570555b0ba42d8fc171fb92fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832f518a-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642088, "uuid": "2b765e89-34c1-4687-9742-a3edc822e233", "comment": "Malware payload (RemusStealer)", "value": "e2ce8501094e330d929494dbeec1f6c0", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642088, "uuid": "1aadd81a-d540-4b7e-a36d-653897a4a549", "comment": "Malware payload (RemusStealer)", "value": "007417ff5b3a5bb2957302ee24222b00243b955871ff89600717531127c146ca", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642088, "uuid": "3e818c7d-263c-4244-8d26-5d9b9954688f", "comment": "Malware payload (RemusStealer)", "value": "4c4e34ec4df6c6a1126856e6edce016c38f3cf7f", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642088, "uuid": "358d4d3d-bc4a-4414-8005-f8034cead50d", "comment": "Malware payload (RemusStealer)", "value": "9724b84232ca16e471b31d6e02a9ba3fb53393e484966ac5d10a782913595ffbc055d169833ae2d917894d22fe8f8a7b", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642088, "uuid": "67b82a4f-0790-44af-b5f3-c92292074272", "value": "T1EB342A6BC25335FCE553C07852662322B731BA3C47349EF70692C735AE21AC0AE7E965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642088, "uuid": "73eaf509-a573-4dfe-8621-b7b744d83c46", "value": "e8f2ecc61201a03998993e67bd6b131c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642088, "uuid": "e19341c0-85a5-4c72-84fd-6f972d29aa09", "value": "3072:lkohOxNTdJKUSvL3neu7VxY2naxP4gl3/5Ykmze+zzR:rh2JJKUS7eupxJna94mhYxze+zzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642088, "uuid": "3ea3a969-12f6-43c3-84e8-38415979b6f1", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642088, "uuid": "8746d742-94c8-4d36-97c6-638bbf526a24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642088, "uuid": "e212d7b8-a221-4e93-93c8-0899184f8aa7", "value": "007417ff5b3a5bb2957302ee24222b00243b955871ff89600717531127c146ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489fb24b-6079-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780620945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780620945, "uuid": "7809dcc7-ba40-4749-a417-003e58f700a9", "comment": "Malware payload", "value": "6a9e10130020fd477c72e72abb580b5e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780620945, "uuid": "7ed64a29-e3f4-4daa-af51-bd321ed8f049", "comment": "Malware payload", "value": "018f8548c055a31d98201874ebf21591e6d85cb9eee66e8c35716a9289d01f48", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780620945, "uuid": "6673c2c4-16a4-4f9e-9dd7-409edf8cfa7f", "comment": "Malware payload", "value": "674e889be89fcf42db7ba4a9f7af20871539cdd3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780620945, "uuid": "b346aded-6748-463f-a6cd-542e38a9fd01", "comment": "Malware payload", "value": "c6ecc5fe0c8b8c41fe8572d54fc3b90239890e3ca84401590e007f6a672758276fda57c05e651f415c5cc43929bc9db9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780620945, "uuid": "2fa35cd7-0925-4bbb-9392-75dcb59fe49f", "value": "T16886235BE82D5826DD9638BD3D04530E393B2DB94710C11A7136463AFEE3AD3E25F4A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780620945, "uuid": "d77f75b5-535e-41e9-bbae-30739975189d", "value": "196608:y7NMdFk+171ccYiBWlE/482HuweW9+LH5r2rZhQdJdH:yudFk+171PJ0OG+LZroZh0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780620945, "uuid": "f835edbe-ba56-48b0-b3fc-f84d2e44622e", "value": 8143329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780620945, "uuid": "1b7b4768-6e46-4fb2-be63-4758da2a9655", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780620945, "uuid": "a9166645-e1ef-4b25-b06c-fabd824df27b", "value": "018f8548c055a31d98201874ebf21591e6d85cb9eee66e8c35716a9289d01f48.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f400585f-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681791, "uuid": "9097fdef-3df8-4c52-82e7-8974fdca7af9", "comment": "Malware payload (Cosmu)", "value": "83592762597163dd745864adb8dbef78", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681791, "uuid": "e26509e7-b228-49ea-b265-73b6818fa021", "comment": "Malware payload (Cosmu)", "value": "02322dca9d7ca6c6d3c710c91923259bb20eb59e07aaae967ec5302186bf4f38", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681791, "uuid": "9c9c0726-f54e-4536-bbf3-f04b116c57da", "comment": "Malware payload (Cosmu)", "value": "40a01452eca5d6cf752b1c2d2f304a1ed39baf00", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681791, "uuid": "a1def872-bf50-494e-bfca-d0b7b16f643e", "comment": "Malware payload (Cosmu)", "value": "669c8a7df87c6266e7939e99ce7eb2e057b3b86d1f7ed0b9ca3ef4379a59f014beccbd4c8ac3e57e7ac6e81eaed00cd9", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681791, "uuid": "faf15ad7-4843-4959-8a30-dbb4a21f108f", "value": "T12024F1553C93C4B3D041897689E58BD18B7F6D03BAE2E15BFF9D0A474EB02884BA7261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681791, "uuid": "ba2accd7-326f-49df-9a55-a615ee6c6f3f", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681791, "uuid": "3499b1a9-83d0-4d0d-af1d-9675e01c1ed9", "value": "3072:BQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBf1:A9lKgzelZNQSBQGH/CSpWqTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681791, "uuid": "84269ba6-0a36-45f3-8433-e4097b102b39", "value": 221185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681791, "uuid": "a02fbe3b-8d20-4b98-b245-c0cb051e5db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681791, "uuid": "346d4e31-e372-4c30-855d-a05f5c31b3fd", "value": "jaccessinspector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0e1ca3-60e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780666128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666128, "uuid": "1b8712b1-f1d3-4dab-ae02-67bc2587c57a", "comment": "Malware payload (Mirai)", "value": "b42c1a31af199ca4476837e8d7ceba51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666128, "uuid": "8884610b-1de4-4069-809a-a6366a2f3c61", "comment": "Malware payload (Mirai)", "value": "02c40d22521d34af2844b7ca15fa213cd27787423573a408a71fb445c91f9a1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666128, "uuid": "d2e9cb39-7e7f-430e-a43e-08e093b84241", "comment": "Malware payload (Mirai)", "value": "46ec2098932545f420209ce6aebc87a55edca6a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666128, "uuid": "6dd7366c-5b04-407b-a3af-696b66340167", "comment": "Malware payload (Mirai)", "value": "7f6ffea5413bd0c96ae778f9e96d25ab0b27507e6d147586741aabee0eb6e3ddd545a5621a2038599162b72123e327e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666128, "uuid": "24258d95-bb73-411b-95b5-0c935c7353d3", "value": "T1A5A30897F801DFB7F40AE67604D34B24B670BBE54F531622722739A6AE722D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666128, "uuid": "265e5ae1-47f1-40f7-89eb-7845181272cd", "value": "3072:BdKLGdUvuXwyKQlU8fzX6mumuxVqDr78fz1e:BdKLGdUfyKl8r6mumuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666128, "uuid": "ee0fd64b-02e8-48bd-8db0-6f4d1fd3df87", "value": 98923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666128, "uuid": "8f64f7c3-4202-473d-82fd-93bf815eaaf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666128, "uuid": "fc4c979d-891a-4ee5-8a83-29afa5720e18", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ccc719-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780648553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648553, "uuid": "fc94ea2b-bf38-4d29-ac7c-e7b4bb5e7909", "comment": "Malware payload (RemcosRAT)", "value": "40b2417a4c92832d631cd23ae01674f1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648553, "uuid": "73442b3f-54c3-432a-aa5c-d375ac961cfb", "comment": "Malware payload (RemcosRAT)", "value": "02fca8837852c3cbb9774f065e44401971f68b48205f7cd788ea8a8de6cfb0d3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648553, "uuid": "cdbf7566-1946-4b22-b205-566d1372a4f1", "comment": "Malware payload (RemcosRAT)", "value": "a1352ef4864eb21e7b9d6b101f64d62835a191f5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648553, "uuid": "2125d45b-fd38-4f34-8ede-8740210360e0", "comment": "Malware payload (RemcosRAT)", "value": "31fa8c60018dfa527c62746a7d4927b4dd04dbc455332413f1703ff5c6e8a1556ae6ba2f31967f50cfbb638f41613ff7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648553, "uuid": "42c95440-48e4-4dc3-9f1e-2e79b0afc858", "value": "T1E054AA606C115134DF9475B2E1331DA43B901AAE347AF24BD82B3283FB57F26D92E786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648553, "uuid": "ae2b17b0-8969-499d-bd6b-2079607bb31f", "value": "1536:K88888888888888888888888888888888888888888888888888888888rOa888s:sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648553, "uuid": "5679e7f8-0af8-437e-a8c3-3cec2eaf59ed", "value": 293085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648553, "uuid": "cda2fc3b-d1c3-4085-9f00-152e69888aee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648553, "uuid": "0a653d2c-b1ff-4dc5-ab6d-25e8959c8264", "value": "goodformulafodme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280c2588-60a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780638929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638929, "uuid": "33f38213-2ab3-4e8e-a9be-52b117c1b4e8", "comment": "Malware payload (Gafgyt)", "value": "2a0366109527b47fd345818801be0a62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638929, "uuid": "50ab7ae7-bf33-4b7b-9e5c-e2dcce926db3", "comment": "Malware payload (Gafgyt)", "value": "033aa4a8879c58c9ddc2f344603eba2be744ee37b5f21424cee1c08a2c97ba2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638929, "uuid": "6147a3ea-bb86-42ed-8f20-664942c98574", "comment": "Malware payload (Gafgyt)", "value": "8fb07a596258504fa6db0c1eb1682418b555864f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638929, "uuid": "8d82c07f-c330-4abf-a25f-561a5ae53024", "comment": "Malware payload (Gafgyt)", "value": "2df9e6bc928f963c79400d447179bd225541fe0bdc4187c12555f9e803efb6d796a6f2bc14b163b8d797688a6283a6f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638929, "uuid": "126a29b9-b7ae-40f2-b269-6600714fe0ca", "value": "T10F343734BC16D217C0E3FFB9EFE86A8AE719E6C70B85A2036570106D1EF5A59241FC94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638929, "uuid": "1ad876da-868a-4584-8c34-179a099a8f3d", "value": "3072:gyjfEPl107edeT1k8GpTY6oK32+qNLMcCKZmYfjfs5omyh/QTpLzYGpV:PmTY6oEIZtZmYL1myh/QTpLzYGpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638929, "uuid": "34783805-7381-43d0-a463-9dc4f7083f1e", "value": 248125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638929, "uuid": "23617b9a-0f5a-4389-8b60-12842c21ff4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638929, "uuid": "70c48496-6ac3-4648-ad62-81918321b8bd", "value": "dissarm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02acddc1-60e4-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780666783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666783, "uuid": "31aff360-de30-420f-959b-7cfa0a346887", "comment": "Malware payload (ConnectWise)", "value": "1504e77a2704d97330af6ad77dbc14cf", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666783, "uuid": "7629c79e-62fd-4e33-9bb4-f9a7ad4ff2cb", "comment": "Malware payload (ConnectWise)", "value": "044141bf12fd3c01e450cafee955bcbc2c2d9f72d2df496f2870002d7cece443", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666783, "uuid": "43c4bfad-cd23-404a-b58e-401f72a6d0c5", "comment": "Malware payload (ConnectWise)", "value": "e13b2fec69a545d40a11a9b4a487f4a31d1a1361", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666783, "uuid": "e009c9a3-3346-497b-ad3c-a0d7e729c244", "comment": "Malware payload (ConnectWise)", "value": "a1f7947aa286b04cd87b615bcff408c045f34dcae091e76932f8ba651827808f6c4b983643a3233f4b6fbc0fd6514520", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666783, "uuid": "5b8d1223-acae-42b3-997c-2ac86d6797e5", "value": "T14546E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666783, "uuid": "6c2daa08-8474-4311-a5f5-1d4e61050b02", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666783, "uuid": "2895f107-9888-470d-a7fd-fff069b60e6c", "value": "49152:OEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqMJ:7Es6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666783, "uuid": "a7244a6d-f7ae-4816-8265-f6aedbf34ca1", "value": 5640976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666783, "uuid": "69990d40-71e0-45a0-a2ce-0b0053b6cdae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666783, "uuid": "5355766e-bc6d-4729-8fd3-98245b58b85d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f675f45-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780642995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642995, "uuid": "91565b13-1ebe-40d7-a922-07ce96ab95d7", "comment": "Malware payload", "value": "78c5761583fa3d74267a85caffcd385a", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642995, "uuid": "2c13caea-ad61-493d-a300-854215288287", "comment": "Malware payload", "value": "04c2c625dcd0ae8ef136f8b93fd23ace0b60d4a21790fe76a6262cbacfd57d2a", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642995, "uuid": "24c65591-81d0-4a04-a21e-09003666d9f1", "comment": "Malware payload", "value": "1df257a408060bf331b4ac669d803e4d797f56cf", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642995, "uuid": "d074f887-c83b-4d07-a6d2-6768d1c0fc6e", "comment": "Malware payload", "value": "618db525990afa83715c7464c08faab7adcc97b447f4b3a10688af6e09f137f6badee022588c8ea4bd941922020e683a", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642995, "uuid": "5e42cb7b-0b81-4408-801e-661152dc8c15", "value": "T109C73315C18248EFC55B32B01948AFB9A4324DB141F107E9235FF8BC3AB67E195ED89E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642995, "uuid": "01627a87-1947-4d14-84f3-235a92309b4b", "value": "705cf0fbfd9c9efdcc623a49e768e8af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642995, "uuid": "ba167a49-0b2d-4450-8da9-0ed88e55915e", "value": "1572864:YyxlZP6MMZR0DrfFGB+mRFRQA/EV34Oj:b6lEdmLFL23p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642995, "uuid": "7392a545-961c-4c29-b75c-58930b7194f4", "value": 54505472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642995, "uuid": "0b0ac5f5-7026-4769-bdef-caa74027889f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642995, "uuid": "6413f018-f612-4228-9027-2bff350ea424", "value": "04c2c625dcd0ae8ef136f8b93fd23ace0b60d4a21790fe76a6262cbacfd57d2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15c0dca-60a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780637871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637871, "uuid": "17dab88c-1e3d-4143-a291-c72ea910634e", "comment": "Malware payload (Gafgyt)", "value": "051bb7460cb4d578529aaf217860ed4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637871, "uuid": "9c918c36-43f8-44cf-87f4-4fa4261002d7", "comment": "Malware payload (Gafgyt)", "value": "04f03d3ce3164af6a2db033748bd17844942f981099d1a1993f8ffd6104459f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637871, "uuid": "b548bfdb-7a2a-4117-964c-911e8673f3e8", "comment": "Malware payload (Gafgyt)", "value": "bdcc07eca966d34cdac52f36f37e40a1bccfbb8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637871, "uuid": "ac27130f-988c-4d80-b71c-06d75aca191f", "comment": "Malware payload (Gafgyt)", "value": "3deff109566d3744d444982ecc817001d9234272f430c9d4047ffcdfb213643c5fbbdd4596c481b538f8e0da884c8565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637871, "uuid": "9584f425-eee2-47af-b853-a22a9bf1ea33", "value": "T191F3E836B589CDBAC45391F017EAEE729C21BCFB0935704B27A0FD915E3ADD15A88E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637871, "uuid": "0ec17961-3ccb-4eff-bba2-531d044d5e84", "value": "3072:stBYKWwBF2mPTupIJitla0VZsxzhb58AsXWcuHYXq6xoBSHV2t:oPT4JqbCmZZ6vHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637871, "uuid": "bc2ac02d-58a4-4e4f-a7e5-715f2231c0b7", "value": 171096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637871, "uuid": "41bb15c8-113a-48ea-9947-3f526ffe42c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637871, "uuid": "2877ff1f-8c91-4fe6-8c49-df50ffc1722b", "value": "04f03d3ce3164af6a2db033748bd17844942f981099d1a1993f8ffd6104459f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211d7c8a-611e-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780691745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691745, "uuid": "61a494e9-ea4c-4e21-b85e-4b15794216ab", "comment": "Malware payload (ACRStealer)", "value": "b8aa3afaa82d3475f95bd5e6408f5ba2", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691745, "uuid": "82793537-e798-4452-9335-3c30bfdfc8ae", "comment": "Malware payload (ACRStealer)", "value": "04fae87ad99118b414439853eb0950d62a0b37bb7ef62c9bfe40fbe70c5dc00e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691745, "uuid": "3992a5ee-3acc-477e-9657-628a2155641f", "comment": "Malware payload (ACRStealer)", "value": "09cb3b39bd1bc0b2e224d18728594cfae3d0c3b0", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691745, "uuid": "dffce008-2a18-41d7-b40f-1898d30ca211", "comment": "Malware payload (ACRStealer)", "value": "bcce3b841588052d2f28d9cce978c571db29b1d58705d76f34c1513eff1e1aa72aa834362a4c31b57a1fa2a1b4cfc533", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691745, "uuid": "66de6ee0-826e-415e-94d8-89ff89684542", "value": "T18EB5020B3AC91662D42FA37170B2033F2333F93816665AAB6197F6D8DE637D33512649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691745, "uuid": "a323bef3-d513-4fd6-be2f-d4b2571cf764", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691745, "uuid": "f05f5e26-4457-422d-b96a-f86a3355aa82", "value": "49152:YjQX6kX6tF+TYcJIyfK5f3uGJp2WX9evPSJlPUOYwUaEd:FqkqiccJXef3ump9XAvPSPUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780691745, "uuid": "36c462c1-99fc-4216-9414-be95fc2b9279", "value": 2334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780691745, "uuid": "7340630e-c7ef-4425-a4a6-2c953a55e57f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691745, "uuid": "c2cf1d9e-0616-4dc7-8e31-6cbf8f764d18", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa812f7-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649464, "uuid": "6f358cc7-6603-48be-9405-e13285fe3b5c", "comment": "Malware payload", "value": "9453fc817b6eeb72de2eae32a6dc4086", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649464, "uuid": "e58eb76e-d22e-4e70-bbe0-356d246bcd95", "comment": "Malware payload", "value": "0508f85794ccdbd60eecbf63a5193a4d4e148f92f07ffdfbbd12e5fc06515d08", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649464, "uuid": "95235fe4-56d6-432b-a019-f531d169bf2e", "comment": "Malware payload", "value": "792da0dc3dd61fedf7965147533ced4cf7a66bd9", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649464, "uuid": "4acf6940-23d8-4c8b-aaa7-c08304293135", "comment": "Malware payload", "value": "45eab7b55e26698a3c71321883c02c30c29ea96e50861acc94a801b1bbc9a45583b9d0915d3ff970f15ec6e4517c9f95", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649464, "uuid": "9cbf72e3-bf99-4f9c-b7c9-9c188735e2a3", "value": "T145D19D270505D95BC4F105F06D8DBEEA0EE228D022EE22B0536D8E85377A125D743BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649464, "uuid": "0f9c9866-4754-438c-8207-59b357843f62", "value": "96:kQ0Sud+e7MVR8XC0Izva2HAM0nPKWv3M5BO0BkRy192/NZsU6lsLY1lRQ0dSf:547MUXC0Y3wTM5wTRVZs46RQ0dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649464, "uuid": "6ef84640-bb7e-456a-86b7-26e0eb0dc688", "value": 6380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649464, "uuid": "2593a635-e35f-4936-a5ed-6f7686febd82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649464, "uuid": "ea36e311-52ea-41a5-a440-a8c2f98d807b", "value": "photo-353222673.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97707415-6116-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780688508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688508, "uuid": "3d851596-c3f5-4a5f-b110-1faaba6b8e6e", "comment": "Malware payload (RemusStealer)", "value": "87a9cf76dc4fb4b36697b2b03d2b652c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "youngel-biz", "colour": "#7BCA82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688508, "uuid": "126d2538-0654-449d-9c49-5b43364886b1", "comment": "Malware payload (RemusStealer)", "value": "053cf2aa31d3dbe50d784b5998794ee148e1d74911b8c23ceb5c1b264dd948f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "youngel-biz", "colour": "#7BCA82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688508, "uuid": "fa395e2c-3177-4797-8062-481a18bbcbde", "comment": "Malware payload (RemusStealer)", "value": "32f1b13c569ce3d95033c2545ae97c9c502630e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "youngel-biz", "colour": "#7BCA82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688508, "uuid": "b73597a7-f962-4158-8e84-be7e647ae1be", "comment": "Malware payload (RemusStealer)", "value": "fa87249ceb2ffee7052119ec8bfe7b57f3e6faa3b14a000d958df65aa8260044f21dab2d4f2af19ce228a3f6b4d53407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "youngel-biz", "colour": "#7BCA82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688508, "uuid": "443ae8b9-f981-4da4-84a6-7fa5607acf6a", "value": "T149856C43B89065B9C5EAE13189B5A191B7307C585F3127C32F51B7BA2E777E00E3A368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688508, "uuid": "7a8cc407-b58d-4147-9a48-2e69ba516341", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688508, "uuid": "036c946b-6add-46a9-8b05-06d9fde895ad", "value": "49152:WE43Trb/T0vO90dL3BmAFd4A64nsfJHtRxlaCTIYgLDCvtcmD10:+3aXMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780688508, "uuid": "6e7f333f-3e85-41e2-aad1-9effc689fa16", "value": 1874560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780688508, "uuid": "bd669a17-cbcb-4cf7-9a7f-00e01eaf477a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688508, "uuid": "0fe6236c-b5a8-4583-ab48-8078f117b9b2", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32d0250-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642169, "uuid": "9ad718dd-b62b-4193-adbf-26fff75372db", "comment": "Malware payload (RemusStealer)", "value": "da0b742a438de7a90534ffa4d4c97af3", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642169, "uuid": "04a9e24a-4a44-4d0c-88b1-01502b0822f3", "comment": "Malware payload (RemusStealer)", "value": "056f39d9f88782580e978f35ed8b50706ed9372476433b364adee36188fc5925", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642169, "uuid": "2fb06eb6-0974-47fe-bf4a-a06d13d7ec14", "comment": "Malware payload (RemusStealer)", "value": "f0b418032b0f2f960b3a11e2f330c4897f229b82", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642169, "uuid": "f9606d5c-e00d-424d-be2b-8977b43a8d71", "comment": "Malware payload (RemusStealer)", "value": "ec6ee300932b97d0d5e51f2db1b90a4ef5bd4025d90a25167df6956d4d2aa1ad0ad635b1a5e84a3622bcb4f99a8514cf", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642169, "uuid": "b32155a3-5e51-420b-960b-b98b47f83c6a", "value": "T17AD42F34D593E4ACF8227CFA8AA5C3B2E5F06D3EC4160416223176695B72193FEC947E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642169, "uuid": "d755e444-8f03-4895-bba5-0d3927904bf4", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642169, "uuid": "e641b6ae-af11-431a-a997-829eae8e4d0b", "value": "3072:pMkiQ0Ti78ZGAttez2m7sKNqQNmTVm9he0xoyW3k9NnLwBsYC0H9/xiE5pkP:3sG78sATmZbNmhQa38nsC0Hvbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642169, "uuid": "8c430625-bab5-42be-8b1a-cc63fd7be650", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642169, "uuid": "dc776427-e969-4e9c-8c84-eb41d0b48084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642169, "uuid": "b4493b04-07ff-4cc9-8f55-b5713778e12a", "value": "056f39d9f88782580e978f35ed8b50706ed9372476433b364adee36188fc5925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508e6658-6120-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780692684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692684, "uuid": "9cab7bd1-f36b-4963-8f57-8816cd76e403", "comment": "Malware payload (ACRStealer)", "value": "c97c4bbe31f1703b009d9eee7a165d7c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692684, "uuid": "77320ea6-b202-49c5-8c69-8ed3dc731bd0", "comment": "Malware payload (ACRStealer)", "value": "05a5c23d99fc22e671f8b9dbeebb378c9fb241f65a345d177cae0ec09d7f58ad", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692684, "uuid": "167cc3cc-43f5-4e02-a4f1-28e4ddde6c52", "comment": "Malware payload (ACRStealer)", "value": "ee3880216508a16d50cdc8d7a671c27406533c03", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692684, "uuid": "0fff0f5c-b143-46ca-b655-f5db9f81c07b", "comment": "Malware payload (ACRStealer)", "value": "464e6ceb680c7279e45341f4cd83395cad3636ea9912bc7c42fd15561914ad678aaa2e6bd4de602a002d02ebe5067dc0", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692684, "uuid": "4477d4c4-225d-4e67-82a1-5d269994f0dc", "value": "T109668D0B6CE408EAC5AAA33289B35292BB35BC490F3263C72E51B7782F727D55D35714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692684, "uuid": "8d24f9d8-cb13-46fb-b45d-7e7de1d19cc5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692684, "uuid": "e9ee31e4-eba9-4f5a-b14e-8bce7fca4925", "value": "49152:+KQ8RdPqezdeNlSyEVvgCvrHiEDsWkemu0kx4QjGnun:+4jxvgCvrHVDsWkemuBx4Qiun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780692684, "uuid": "e55f985d-1421-4ff8-b4a8-a11117a0e6e8", "value": 6669960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780692684, "uuid": "d0b82e20-e030-4670-8f73-dd5312a52479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692684, "uuid": "c0c7e837-8dff-43fe-8cb0-ef0e353b1039", "value": "hnmh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175f72ce-60ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780670254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670254, "uuid": "ff505f90-dc35-472d-a903-fd2da0b83295", "comment": "Malware payload", "value": "e3f2763297a13f74fc2ed548b7c4a51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670254, "uuid": "bd7e7321-a418-4598-82f3-4390420a70b3", "comment": "Malware payload", "value": "060384a3c52dc9ff09e5d8aeef52b310a41c4d97e6133e7eba6a59e138736935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670254, "uuid": "db11d187-0ae2-4e54-aaa7-38ec774fdd09", "comment": "Malware payload", "value": "875e87fb13546da11016aa67727770605e7d0f57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670254, "uuid": "c7c5b967-f4da-4df5-9f06-875176627d40", "comment": "Malware payload", "value": "085eefa75c3d057b04b9c8384f4fa84d9de7ce1e8eca180b35c84574f9f6e276169468f7a88dad3539fc7972789a4bfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780670254, "uuid": "3f49d0ce-d29e-4646-ae8d-4a7813c0c054", "value": "T15AC5AF03B95064B9C1E9E2314971B295B63078584F3527D73FA1ABBE2E37BD01E3A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780670254, "uuid": "f81955c0-71f9-4a7f-8a34-980d60af03e4", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780670254, "uuid": "6f4daa8d-f78d-4529-aa57-4ef44f96b605", "value": "49152:z8q3rrb/TYvO90dL3BmAFd4A64nsfJmof+wpDD/18eOKpSes2eOuTzgLDl5L0zpi:J35pN8CUyeql5oyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780670254, "uuid": "5e908f84-08eb-441d-95f5-1173bc35f4c8", "value": 2708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780670254, "uuid": "e6aa8307-1433-4b1c-929a-a84040ddb36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780670254, "uuid": "ee39c2f5-9930-459d-9e3b-e50cb6245491", "value": "a1yt5r03.wjy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375ebf14-6121-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780693071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780693071, "uuid": "0ca0acf0-4e4f-4932-ac9f-e8ec857d3893", "comment": "Malware payload (RemusStealer)", "value": "bd55c429e7907fd2d0948090117c048e", "object_relation": "md5", "Tag": [ { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780693071, "uuid": "9ed21a40-b7f2-4ec9-80d6-150d5e2b8828", "comment": "Malware payload (RemusStealer)", "value": "06687794b570170c4c5cf838d2d9b5c83bc946a7aded5a10762957c329204bb9", "object_relation": "sha256", "Tag": [ { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780693071, "uuid": "b4fd2a3e-3d91-443e-b933-6abbd6a2dd6c", "comment": "Malware payload (RemusStealer)", "value": "6b52289e1ed4d8c2735f6161fba0f3a46c49f7b7", "object_relation": "sha1", "Tag": [ { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780693071, "uuid": "55f6f2f8-305c-4c3f-ab80-4057e5aad968", "comment": "Malware payload (RemusStealer)", "value": "d92f09bbdcb100855da70606f0d176814995117a11e6c7b5f6062fd5c7b0ef9f30d3a744ba049846fa9e8731412b101f", "object_relation": "sha3-384", "Tag": [ { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780693071, "uuid": "32e25633-5979-4cef-b083-63bf7f743b5c", "value": "T1F32639427CE009EDC099B33189B27196BB65B8480B3923D72FA2AE783E767D05C77745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780693071, "uuid": "9458179b-60ba-4575-b632-aaf2ae557898", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780693071, "uuid": "70ecd0cd-3fec-4c11-b1d5-54bab5efbcde", "value": "24576:pNxjqeWcpc9mknImv8G+aQ/8bBILz6WPwWe+mW/t9/nBele7tKDyiQSt6K:pNZqehW9m0AGFQ/8OLzPwWeGnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780693071, "uuid": "a6c7eccb-f8a3-4899-8840-ed369c16b7c9", "value": 4534408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780693071, "uuid": "817ad2c8-de86-49fb-8cb9-33678b6d2bd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780693071, "uuid": "db19adf2-f1c4-48bc-add8-44a3d0ddf5e1", "value": "xxx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fae7888-608e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780629949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780629949, "uuid": "62b36660-8b87-484b-a144-129ed44546d0", "comment": "Malware payload (Mirai)", "value": "6be00985fd3f479b3b0ff45d88ae11bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780629949, "uuid": "9c869cfa-f302-43b5-ba00-0604e1d6c16c", "comment": "Malware payload (Mirai)", "value": "06ea229478b674e007f573cadf3769a98d7a141bc8ccd951bd78b22fb991426e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780629949, "uuid": "04fd3b04-21db-40b5-aa58-7ce3262f10b1", "comment": "Malware payload (Mirai)", "value": "01c78367ab59878de3c26bbde04cf49cf1c1051b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780629949, "uuid": "6db67db9-fb64-417c-aa04-33845832c48b", "comment": "Malware payload (Mirai)", "value": "7ddd1b81c3b0c784c50a62e6ae3277a7bf7194fd9c72de88d24b2e752a121b08d75178526196b2c89c881b443773c5bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780629949, "uuid": "32722b88-cd19-4a66-ace9-50f39fa89c89", "value": "T1C963A50AEB654EF7EC6FCD3706B9070135CC951A11A93B393974C82CB65E54B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780629949, "uuid": "c53d6228-2128-4be8-a2f6-ddf545f989b9", "value": "1536:78a07+JccgprTOldudVU5Zqwmo2dCUsMfY1:7O7+X4rlM5N1MfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780629949, "uuid": "38a55295-f717-493f-8c0d-e45137272e47", "value": 68928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780629949, "uuid": "87853f0b-5244-4495-bdc6-98ef3889414c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780629949, "uuid": "cac9e80d-3ddd-42a7-8f08-6327596094fb", "value": "3.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6dbb8e-60ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780657514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657514, "uuid": "ff4e0478-94dd-4c42-aa59-a7ea2b2e923c", "comment": "Malware payload (Mirai)", "value": "c6b87416c5687dee8495427b4a9624e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657514, "uuid": "2862a1aa-61cc-44cf-92b4-3f7263e55fb9", "comment": "Malware payload (Mirai)", "value": "072b3da4e43991f610e7386a3116ced6f2f05c18e290ef10b80b4a9a26dcfba8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657514, "uuid": "d703abb5-d8d5-405c-96a0-e5945f1e92f5", "comment": "Malware payload (Mirai)", "value": "ea51dbd7b72f61e59c5277a3500cce6b8b8d0db2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657514, "uuid": "d58d2b72-3b5a-4229-befc-83d1a3ed1200", "comment": "Malware payload (Mirai)", "value": "19da3e6515e735a5e702021050dd10211e201c99e60ac3ca35e000b6f4ea1b4dceb727d6d01c0c5872f7b7cbe458d1a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657514, "uuid": "b191ea50-f5e3-4813-90cc-402ed1454614", "value": "T132635AC5F643D4F5E96705304137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657514, "uuid": "241aed56-36a2-42f0-914e-1635e4f4b2f9", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcfz3WyL35IUfA5PGFjfnPu:zGYxpTGASC4XTfyyLpIoYPsPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657514, "uuid": "a5ee3b15-9ff5-4e72-9693-1d0bdcfd16de", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657514, "uuid": "8610b9e9-fb30-4841-af4f-94ebebee50d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657514, "uuid": "79b15629-e546-4b72-af29-9567aec01c32", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc86d6d-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780641514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641514, "uuid": "c90fb4b6-f4c8-4c54-8b21-7f4509746c50", "comment": "Malware payload (Mirai)", "value": "4daf25196ecb92c6a13e936fc07bc6bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641514, "uuid": "1f3134f5-c68d-4b57-bed5-786accac6a69", "comment": "Malware payload (Mirai)", "value": "078a49b6cea7477f4e4784658304a36310277f6ad7bb24c4f3c2afb7b71a97de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641514, "uuid": "334a4873-e845-4d42-a866-bcad567d7c27", "comment": "Malware payload (Mirai)", "value": "fd1c822189c0829905fa33711b76698657f0a16c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641514, "uuid": "039b0515-acab-48cb-93b2-22dd083e83d7", "comment": "Malware payload (Mirai)", "value": "1e3f7151f89c48440216e89ddf6b138e32b661c175da83d218ec2f3833814e1fa7a114506255a48ba58314e1aa59ebba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641514, "uuid": "22480ed5-d51d-4cdb-9466-6b0f49ea5227", "value": "T18963951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641514, "uuid": "85b8b2bc-45fa-4d3a-89b0-dbdd7ab84aa0", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatA1:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzuL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641514, "uuid": "3399404e-f837-4332-be80-6390d834a3b9", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641514, "uuid": "f08b679b-4cc7-4f72-96f1-ae21d0d81f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641514, "uuid": "305b85bb-85b1-4851-afc3-3cb433c6d998", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d1fbed-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1780642636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642636, "uuid": "972e5ac1-3802-464c-bc3f-e0889f55e2ed", "comment": "Malware payload (LummaStealer)", "value": "4a8515b700d162e2d5a2093c4944b851", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642636, "uuid": "e39efa10-0a7f-46f4-80db-b0d38fe8437f", "comment": "Malware payload (LummaStealer)", "value": "093f9c4e16bc75536bdbf22f9899028febfb42765a7f92d6699bb212bf5e7ff9", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642636, "uuid": "e26e9a58-036e-462c-9f04-b6ae25a40926", "comment": "Malware payload (LummaStealer)", "value": "b3fb7bc8956d1731e25be470e8298dc88d0a4aa2", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642636, "uuid": "8fd52453-c41a-4a60-a8a5-9cbd969f1d23", "comment": "Malware payload (LummaStealer)", "value": "3e69edbdb56d3bc7eb918f7296fc6517e6789632cce7f892615ae6c4cbb624efeed48a0fb2a7540410141c3afbda676a", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642636, "uuid": "e6c4f9a3-943b-480d-a899-bf21a4aba358", "value": "T1E627338C0B604B2847AA69242FA581DA6FD285D02EE7F3053265E4BCC7FD065527EFF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642636, "uuid": "8fd2c7b0-40ab-492f-ad96-069967fc3c3c", "value": "393216:AGy+fGmFYym1Phba4gsmnbiRKeIJj9AqwWRSY44x+34D:6WTZmLb4bEKJge3fxND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642636, "uuid": "82c3217e-7026-4265-8bc9-08c650ad16fe", "value": 21537173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642636, "uuid": "c523df24-d4c1-496d-9839-b9a59ef8f743", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642636, "uuid": "7843b9f0-a01a-4725-b659-44daedc88af0", "value": "093f9c4e16bc75536bdbf22f9899028febfb42765a7f92d6699bb212bf5e7ff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b90fa0e-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780641887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641887, "uuid": "95f8161c-8041-4549-be3f-a72a9c913241", "comment": "Malware payload (AgentTesla)", "value": "fd04ace73c67f31b678dc8e9abc28a65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641887, "uuid": "391e6af3-5372-43e8-9d9c-35958da3a73a", "comment": "Malware payload (AgentTesla)", "value": "099d47f83c3c000dfc905ab28670cdafe0f96cd1f1e1c46034c92e0ec7571142", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641887, "uuid": "0b31ada2-a11f-4e8c-b52a-8e50a685ea91", "comment": "Malware payload (AgentTesla)", "value": "1e7cfb0c531340d9119018a06ed829afff8a28fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641887, "uuid": "19522937-d370-4715-bf1d-66384c4b9a67", "comment": "Malware payload (AgentTesla)", "value": "e9c56b550ef5dd2ad5bf0b60b32a0fc9d53d9ec81d89e1ec41dd6a619d7346aef54e0bd9d004c7b0d6220a0878fad637", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641887, "uuid": "c49f405c-5039-449f-8032-5024cacd808e", "value": "T1BD43308173C0B89043976B3B771FF1E8F46B49DA3D641847E214FC90E9A6729EAD0A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641887, "uuid": "9b29293a-97df-490e-bb5b-0307c4e09ff5", "value": "1536:tP5vvLDZOQ8TtXDHikxNoQ16HhqiusuOjwAvSvBp1m0m:tP5vvByRXDCkxys6BksuOjwAvSvBp1Bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641887, "uuid": "eda74c36-4d12-42ce-b57e-00a2e420e429", "value": 58766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641887, "uuid": "c017c6c3-ea8f-4745-a066-9c5703f227d8", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641887, "uuid": "c37320ad-acd0-42a3-bd5d-5a7f0fa0a7d4", "value": "Documentos -- 020260604.xml.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3692369a-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Floxif)", "timestamp": 1780641960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641960, "uuid": "4c1481cf-1aa5-4fc8-8858-dbd43330f303", "comment": "Malware payload (Floxif)", "value": "783024644efa4a081efeea8d0d16cc79", "object_relation": "md5", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641960, "uuid": "e9c511ba-6b9b-4388-b2fe-025e14b7b883", "comment": "Malware payload (Floxif)", "value": "09f8f95da609c06e6a503c2b26c479877dde550a3b5545346cbaf24c8fd083d9", "object_relation": "sha256", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641960, "uuid": "ba233ab5-30ec-4a95-a696-7c88b9148127", "comment": "Malware payload (Floxif)", "value": "960d984785b56713756a261bc16103741b2a4cc8", "object_relation": "sha1", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641960, "uuid": "d3ae6591-b3e0-4ccc-bc30-d41b526a12ac", "comment": "Malware payload (Floxif)", "value": "fcb086f78885b37b8ccfab339cd74e6deeeaffb426e56a633f6c45dd7194f6631e8f8709b6e00dd7e62c59064dd3660c", "object_relation": "sha3-384", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641960, "uuid": "5d39ea1f-6095-401c-a66e-338034308781", "value": "T1E827DFC4F224F548E7550570982936A849662A303794D8BABF8B76C2597C2E6FDF0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641960, "uuid": "1bf145b4-278e-4379-ab26-2bfc820cf6e8", "value": "b06b004562ff14c148c6fdb85e9eb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641960, "uuid": "a385d740-52ea-4211-8118-0972c21e8765", "value": "393216:yJFXmRjx1n2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlkZ:yJF2RjzK2OGfEhP0JqHOG8qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641960, "uuid": "ae97a312-79bc-4770-a5bc-7f105cc31d57", "value": 20943375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641960, "uuid": "6ba2edd0-4680-4b6a-b3a4-b1a0b3548bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641960, "uuid": "8c46ecc8-9bc7-44be-a345-43236e3d9c80", "value": "09f8f95da609c06e6a503c2b26c479877dde550a3b5545346cbaf24c8fd083d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53003c4-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1780642709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642709, "uuid": "3eaf3f04-9eb3-4ca7-a704-e03abf9c2d18", "comment": "Malware payload (AmateraStealer)", "value": "23891c9421f215a61952cd03408081cc", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642709, "uuid": "f79390c3-4762-4d0c-9e63-e5c63085bc84", "comment": "Malware payload (AmateraStealer)", "value": "0a2a3c30a01b8bdd2f43ed3787cc46ebd40d11d7ea8672694dfe86e02c4efbf0", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642709, "uuid": "19afa448-1805-4ed6-b7ff-0fa97862e793", "comment": "Malware payload (AmateraStealer)", "value": "d8bb9ebc3229638b5b498d733ee347d2b94bfa9c", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642709, "uuid": "15182a1f-c51a-4b13-9da6-75279f3a8460", "comment": "Malware payload (AmateraStealer)", "value": "4d28653fbfbddd0ffdcfe69c61592360652c0cc0eef3ae08f79ed0e2c81d8f2731bee023a15cd72ad3c4932d30436b68", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642709, "uuid": "6f947c88-1e87-4e27-8922-661e40d837e2", "value": "T1235533C70189C4E4A371A3FEC9B0E4875EAE5B8BA5E910552D71EEA935C3DA45F33032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642709, "uuid": "46694d8b-cdd7-4c16-b5c1-5a23a53e66ac", "value": "24576:5Cj8IL7axwYYzTxxs9BbTDzQkzH3qnJ3oIiaAoM6WR3/GgkSCm0B4:5pC99ztO99HheJ51AV6yySCxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642709, "uuid": "cb9fa4bd-8ca6-4de3-9d85-7acc020a2358", "value": 1354868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642709, "uuid": "037ffd62-93ad-4cb6-a454-bc3d4845bf69", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642709, "uuid": "a1f304b4-0c21-4f0a-9218-c186c2927edd", "value": "0a2a3c30a01b8bdd2f43ed3787cc46ebd40d11d7ea8672694dfe86e02c4efbf0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfb49c2-60a7-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780640950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640950, "uuid": "0994e457-f9cc-4b5f-85be-6dea96c651ae", "comment": "Malware payload (MassLogger)", "value": "2a45b21bb07456351db2b3bdcafa83d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640950, "uuid": "d873e314-7325-4b1e-b3c3-ec4edb15c6d4", "comment": "Malware payload (MassLogger)", "value": "0b3bca24417a215c0c33a2bf4fd3ffb61bdd5f25c79ada55cce359a5c5c3acaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640950, "uuid": "88add2f2-cfa5-4d4b-93ca-25cde44940c4", "comment": "Malware payload (MassLogger)", "value": "b0d4db9a2f34b1e679444f6e89890d35c7213f76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640950, "uuid": "016bf2b9-c8a1-4237-80cc-06affd2ec042", "comment": "Malware payload (MassLogger)", "value": "7051043c51354776a727ca156af91663f8474c81f7e2daf6d4d90bb18233a134ff7dbfffc6a954800bab6b9b3cf9196a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640950, "uuid": "75bb9c5d-55b1-4cfa-907e-7dbc2c4dc559", "value": "T18C34289477FC1214F2BF8F79A87454504AB7F427A926D70E1CDA61DC2A32B90EA14B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640950, "uuid": "e450609b-d88e-4606-8314-605e6fda8b5a", "value": "3072:D8DTxU7ZsUFLX1OSBsZXYPcNJGdSutY2Oz50ARISFirKoXsP+fKpK:D1fcKGXYPUZmm+rKohyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780640950, "uuid": "e2cb189e-0e46-4185-9d5b-798254c0fdac", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780640950, "uuid": "4f668745-4b56-4404-8231-cbefad97458a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640950, "uuid": "21cddad0-79cb-4fc4-ab95-2e160032cca8", "value": "SecuriteInfo.com.BackDoor.Himsi.3535.1452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b2ec13-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681636, "uuid": "6e907cfd-6693-4116-910a-29324def9b9b", "comment": "Malware payload (Cosmu)", "value": "93d77a33b2b2094d93dd5113f45807a3", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681636, "uuid": "9a69774a-3a0a-4f70-a2b0-35fba55bd0a9", "comment": "Malware payload (Cosmu)", "value": "0c42dc8d037c46539b35515820f233465e3f8e39563b24bf6c2926450cddd213", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681636, "uuid": "3e5787f2-bc15-4ca5-bb4f-a2080728f0d0", "comment": "Malware payload (Cosmu)", "value": "e79b82b77d59bac30e46806453eb45d9477e6660", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681636, "uuid": "47af2ae3-fd11-4de0-b017-1774cf64914b", "comment": "Malware payload (Cosmu)", "value": "27a4f31ae733f34a6462a5093311b5bf507b8ec2681324e66dbe74152c44a53e9c7f5e0243dbd874a87bd5fea98b1f16", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681636, "uuid": "8ceda6c2-c2f5-4a8d-8986-93bb2117a476", "value": "T10474E0403A9ECBB2D3C249318C6EFAA157767C2F9B65D133F7983B0F1E712845A66201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681636, "uuid": "aa7eab8a-d4db-40af-bf17-0d7cb90493bc", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681636, "uuid": "c814e17c-f907-4220-95c1-4f0857a7701b", "value": "6144:BFlKgzelZNQSBQGH/CSpWqT9w7oAXjiU4bz:WfBQGH6Sf27oAX+U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681636, "uuid": "ede30497-fd56-4b9b-ad31-15b47cec407d", "value": 343532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681636, "uuid": "230759fb-e733-4dba-b3f7-fc8cf5f12b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681636, "uuid": "ce95da0c-2415-44d4-8453-6bc52bae954f", "value": "7zFM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b2eb23-60b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780644634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644634, "uuid": "6dbd69ac-e5d6-42d0-bba7-37c129b80d5e", "comment": "Malware payload (Mirai)", "value": "833321c02a9bfc6e1a5457e16eb1d540", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644634, "uuid": "bbc60b9f-d0a1-4b91-b4c8-1e31937a384b", "comment": "Malware payload (Mirai)", "value": "0c6a1313bde24e485f4c684275d34da0de7c66670a18e15bfd4cf251613ecc4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644634, "uuid": "843ca731-3a59-4a90-a71e-b6652049a478", "comment": "Malware payload (Mirai)", "value": "e47505cab1f27ef39451badf325535e1a53d610a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644634, "uuid": "8e759adc-1416-4710-ad2b-410a42373858", "comment": "Malware payload (Mirai)", "value": "7063596a606145db95817714526aeec09709dfbaf1c5e83b1f01079a62c672eb720bb76991a9c8b155de11dd41612904", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644634, "uuid": "f4045437-ebac-4ab1-922e-024895719a54", "value": "T1FCC31A16B992DB12D1C311BAFB9E514D33136FB8E3EE32129D106F60678B8DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644634, "uuid": "693725cf-3ac6-47f7-b818-41a7cabde244", "value": "3072:6kIVQqwFoDFO0hb1YjGJ9HJ2RkazEmyrcLOUJVEmF6:kV3wiZnZuA9p2+aA8LOJmF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780644634, "uuid": "44858301-afe8-4208-a2c8-c849779e0d43", "value": 122168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780644634, "uuid": "55b1097f-ed5a-4db2-9831-555db9707103", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644634, "uuid": "e734a8a6-2c31-4664-bc76-a69fb085a3c1", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50110f31-6115-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780687959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687959, "uuid": "436b3b0e-0e5a-4a81-a8a3-03015e9bd0a4", "comment": "Malware payload (Mirai)", "value": "fced04c160abb7c757077d38bea214c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687959, "uuid": "43d34b1b-1bbc-4a8c-a011-21d48cbe4e47", "comment": "Malware payload (Mirai)", "value": "0ca55b1d6fba8c84f2678cb7793613a228e479fc58d6c6fda157d4972b8ec10f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687959, "uuid": "78897a8b-6b40-47ca-a194-4502a7500aa0", "comment": "Malware payload (Mirai)", "value": "229ce06b49c2988ba2e713a6ceb5573ec1756403", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687959, "uuid": "c1ca3268-8e54-499f-984c-a8cdf556b1f5", "comment": "Malware payload (Mirai)", "value": "8514c782e7248b6af4e741ed430ff122dd953b926484d8634f1cc5ae9ee4eae1862854ffb38f10f93ece36b008ac5d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687959, "uuid": "6c372979-78c5-453f-ab4b-afe1bbeca597", "value": "T1CCE2E106CA12E859E9203ABBE969C64537CE7CBD54AC323B3637051C37C661653BE4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687959, "uuid": "fcd1a971-c5b7-4b51-a8a2-6460fd92d7c9", "value": "768:HDxG2Id87hUL5BySL5kkS/0LRSFS9bcL9q3UELr:HDxHQ8NUVBbNf0AbcqLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780687959, "uuid": "0f431965-de83-4eec-82b8-174abc3cdda7", "value": 31680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780687959, "uuid": "9ebfc1d1-dff9-4275-9791-e9047c919de0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687959, "uuid": "04cbc956-8028-4255-b6be-81ba5593db1a", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9e3a79-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667310, "uuid": "956e821a-37d3-4dd9-99e7-623940a3e063", "comment": "Malware payload (Mirai)", "value": "cd044d785909608fb6eda32425e872e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667310, "uuid": "48855d73-edf3-4be7-8c33-af147f755f09", "comment": "Malware payload (Mirai)", "value": "0d459ee455dc1e91c5c06b78924774b482a82b40b29d42552a86dde2f24d6631", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667310, "uuid": "a4922b6c-02cc-44ef-9bcc-ac4d847d847c", "comment": "Malware payload (Mirai)", "value": "49022d02adf591bdff6f9b9a2f0a5d2bed7f118b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667310, "uuid": "ab1be44f-4942-4c3a-b4b2-5325ac4c5540", "comment": "Malware payload (Mirai)", "value": "cbea4e71544f0770383fd6300a3f268a1e133f46ab0ae050e22dff50699873503342e125722b96ac09b1778c817d64e3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667310, "uuid": "efe335ee-96e7-4f88-ae57-2ae57caa102c", "value": "T15CF36CD6F400CE7DFC4AE77B84670A25B531A36120531B33A2A7BD63BD761A5092EF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667310, "uuid": "b004ed06-b990-4f2b-b0f6-f779a9c69590", "value": "3072:BCH2a1LsuoVg4fFxRsfMN8sKOQDr2Qyujffftx1EcpzXclJW:UHsuoO4fpiMjGvyuLffL1HXclU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667310, "uuid": "da6ec1b7-7f23-4efc-827c-11de4502f107", "value": 158308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667310, "uuid": "3e46782b-e75b-43b7-8abc-bc41e18be49e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667310, "uuid": "08697b3b-420f-455f-8316-91b91930c3ca", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cd50f8-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780636890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636890, "uuid": "253fe6ab-c6fd-43c6-af43-5389a76a0c10", "comment": "Malware payload (Mirai)", "value": "70b2c58bec2658c3a2e8a50beb43c8b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636890, "uuid": "a62f0504-394a-4315-b3e0-a64e166c7230", "comment": "Malware payload (Mirai)", "value": "0e5416385b4d4ae5a00d3bdfd7d38bf44d8582a71a23be5c2e0b160afce2edee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636890, "uuid": "517b721a-0ea4-42f8-b270-e1f27a44ea4c", "comment": "Malware payload (Mirai)", "value": "e7562fe7eeb0b9177436c4a7af997af9ff749c64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636890, "uuid": "0c4fc57d-22fb-459a-b454-3f26e01d1e28", "comment": "Malware payload (Mirai)", "value": "43fac526aaa24ca2b3133bf1edd39632deeb4f7825821e8a24e6c43019950c4b4b257cc2f55008f3b2457a5dcafb8e05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636890, "uuid": "eea58f27-815c-4850-8f92-b7b634868276", "value": "T18F156C5BB2B374BCC057C43443ABCAB2A935B42502226EBB65C8D7303E17E741B59B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636890, "uuid": "66f52dda-b5c5-4a6c-9f83-2034ade58f7b", "value": "24576:5oXLE4szk1BtKkQMjtynRV47rCjTtFyK2:+Xg4szkDLFantFyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636890, "uuid": "1b709ae1-3b96-4d48-8c62-93c01f820bae", "value": 894152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636890, "uuid": "a9f654b8-a727-4bf3-8fd6-945e27482eca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636890, "uuid": "21065038-6f35-4506-837c-555a36000a8c", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e717aa04-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642256, "uuid": "2c05ec41-8cfa-4cd1-82e1-a49ace93e01b", "comment": "Malware payload (RemusStealer)", "value": "81d1b36e2c9c892f9e311d7cd7d48e3c", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642256, "uuid": "f2caa321-03b9-42cd-baaa-f99bc9074b2b", "comment": "Malware payload (RemusStealer)", "value": "0ed5a879c0db5336ddff6047bcacf92392a79513aa913c3123381f597ccdbeb5", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642256, "uuid": "cea6116d-54be-42ac-b4b2-6eab36fef762", "comment": "Malware payload (RemusStealer)", "value": "2a7b48fe5284af5c3c277e5973a621e20f2cd503", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642256, "uuid": "d296af93-fd2c-4db4-9566-341e116c2d12", "comment": "Malware payload (RemusStealer)", "value": "4bcbb4fd7448b159973610e08cd9d647b271969399774c26f366a3989f7c4bf25fc210cbd75018ceff9ef51687066b86", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642256, "uuid": "f4bd0d8f-a974-4f66-8078-e78a96f6cf6e", "value": "T149A54A0F6D9508E6C46D9236C8B7D1823B33B9580B3E23D31E5166792E726E49D7FB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642256, "uuid": "73a1618b-7461-4808-b3f8-c798a2ce8a98", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642256, "uuid": "2b1bdeb6-b32d-42e7-8f22-39d7ff381f87", "value": "24576:uMILJSUPHn/w71JHpHbfVAg7avp11rtP9hcS+/EKsW:uMIQUPHn/w71Lfpan1eDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642256, "uuid": "52558662-8773-49db-98e2-ca37fe90a414", "value": 2089472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642256, "uuid": "50083fcd-f902-46bf-837c-728ad6cdfedc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642256, "uuid": "0c20a516-77e5-45a5-af63-6fc0e47b9d96", "value": "0ed5a879c0db5336ddff6047bcacf92392a79513aa913c3123381f597ccdbeb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e22726-60f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780675436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780675436, "uuid": "032126be-e8bd-4509-80e1-8d7636b40bf1", "comment": "Malware payload", "value": "f0ac68fe6b2ba9ff6c016ba5415587b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780675436, "uuid": "59e7b49f-df01-432b-896c-35d05429424e", "comment": "Malware payload", "value": "0f3dfd44c6bfa56485d6ac972acc0465e47e71afe0889ab83049ac0ee5bbf942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780675436, "uuid": "8edd4215-8692-4faa-9fcb-8eb7e4d14109", "comment": "Malware payload", "value": "949654edb63d6ee37ed465781dc23e030b9c5c4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780675436, "uuid": "bef4a740-1b19-438c-9378-4dced0d69fbd", "comment": "Malware payload", "value": "50f04a2eba2c1574e048beb52f7ff2ca88c631855651fbdbdf6062396314d5135f86584e6d1e6dbe21facf9b2d4fcf29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780675436, "uuid": "9b310382-82e1-458b-b9ec-91ad085e757f", "value": "T1FF05E53DCD14412FF8B2D918C999855FF4816597222CE94790CB2F5FAE72882B7C329E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780675436, "uuid": "a617df64-9b5b-4a1a-bf33-7a22973bf162", "value": "3072:wbaakNT4kfXOIzPuni8lZsNeiZ3Mdlzbitas4pBRcnz3yGdfAm7JrlNgqnFeYLT4:xaUckFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780675436, "uuid": "a42b02af-eef9-434a-b124-4b466e5397e5", "value": 828974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780675436, "uuid": "bbf70429-7958-4b3d-a1e0-7fc1fa411cb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780675436, "uuid": "4deb2c42-a530-42b8-9a51-447ef8bea80f", "value": "Recibos de pago_05_06_2026_18972_18973_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1d28b2-6087-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780626989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780626989, "uuid": "45dc2c5f-e07e-4aa7-b57c-367929cdd177", "comment": "Malware payload", "value": "5382417f631a9aa8642751219b451351", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780626989, "uuid": "d93168d0-16f2-47fa-8124-8f690d964554", "comment": "Malware payload", "value": "1003203312e41803b4db093a637f8832195d841d76066a4887ad988ea3b6343c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780626989, "uuid": "3dbe18dc-b11d-4e1d-9ea8-26b538361d4d", "comment": "Malware payload", "value": "1eb0ad46f4d0b8763062e04fc26194b7e71b0211", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780626989, "uuid": "654d3be2-6454-43c3-9c77-90f8d9e7f57c", "comment": "Malware payload", "value": "b37e7639219c0dd25818e454446950cf5d0689676ab8d795e30fe54f75d10c66e7e53af96ca0950388fea4e9ebae855f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780626989, "uuid": "508b4ac3-68c1-46b9-8567-7061ae539f83", "value": "T129018CCAC009CB1081EAE8AD22D75045B864C3CB26458FA5BE6C043ECBB5B187065FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780626989, "uuid": "895a1a4f-bbb3-4bc5-84e6-7cf40c52b958", "value": "24:kXCKysE2hi0ziQvZohas1JWFOq381llhsCczX:e9Qp+Ms8JWFKRQzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780626989, "uuid": "a6887bad-c367-41c6-bd47-3b59a974e167", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780626989, "uuid": "c4f8b6c0-0a19-4dc3-88d0-00f5b0986cea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780626989, "uuid": "de9d34a9-80d0-41d2-82a5-1cbc4ea5274d", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f54b383-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1780642082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642082, "uuid": "c4e432e9-7652-47aa-99e0-fb3b70775b96", "comment": "Malware payload (Smoke Loader)", "value": "786414e68fbeae39a2ef2d57e52315a3", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642082, "uuid": "7702d220-846e-4ae1-99a4-8bb190f77e62", "comment": "Malware payload (Smoke Loader)", "value": "101eb6d5c3c5be140c681e1d23b86783f40e81552db897e253e2c29609ec11cd", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642082, "uuid": "626efe3c-4dfe-47db-bc9c-b8e8e9686813", "comment": "Malware payload (Smoke Loader)", "value": "40da883f2d5d89b55165c7074a8a2dddda085fd3", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642082, "uuid": "08315c6b-c487-415c-8223-3fa63d1b1e95", "comment": "Malware payload (Smoke Loader)", "value": "fe03355973bffb17ed996d0c434d17619c787256171519ab98f17810f8ede0cef83d6dc82e7759d5e358309d300ad791", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642082, "uuid": "7e7823a8-79c1-446c-a48b-11b3310b9bd8", "value": "T1E4A5490AACE118A5D46EA3728CB712927B31BD580B3263E31E537A792FF37D45978344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642082, "uuid": "ca2d9692-6572-4e0d-ac94-f41d64d58435", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642082, "uuid": "ee40e83e-8390-4a8e-a6cc-285f17a1e034", "value": "49152:Q8gHuwQnLNkx0P12UmFoKXgW6EgVE0Xiz5:Q8dhhAHFojdhiz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642082, "uuid": "368a2d27-e013-4a80-ac10-3eb9a52d9b52", "value": 2077200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642082, "uuid": "5e21bf7d-d3b4-4ca5-89c5-3cf6d93a2340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642082, "uuid": "970966af-bcb4-445a-9075-340199d8a367", "value": "101eb6d5c3c5be140c681e1d23b86783f40e81552db897e253e2c29609ec11cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a416533-609f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780637188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637188, "uuid": "80bb9428-19f4-445b-9b41-3d569bbff222", "comment": "Malware payload (Mirai)", "value": "f6754ee42351ad23304a0e4cdeda54da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637188, "uuid": "d9b2d3ed-b465-4946-9c01-fc03b106b582", "comment": "Malware payload (Mirai)", "value": "104633cc17f2294fc5a6ac7f7224ab30b26be13908a3a64ade05b048af275f0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637188, "uuid": "6ff80bae-2370-4f4f-a1cd-4b2eb7a10577", "comment": "Malware payload (Mirai)", "value": "914e8c0afe0cc0484b90e9a5c0076f4d2ab2dc5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637188, "uuid": "fc580b12-1748-44d0-81b5-d07e5d134efc", "comment": "Malware payload (Mirai)", "value": "4c1eabff0dc474ec9de6ac564bf404e167c0f337a2575b803991f52b77f5fd791278416d605faa79cc08be898c980f11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637188, "uuid": "89a74837-9626-495e-b448-cc467995eb74", "value": "T1E23484366B558EB7C81ECD7301E589111CCCA9C712A82B6B76B0E65CF76B84F09D3C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637188, "uuid": "0117f829-079d-4eb3-a501-e03ae5238074", "value": "3072:IvWkxkEZcd4DdVQ3f4PoeL1eJpulSq5qa+J7i2a/mFAxBm+3EY:8hxkE+dLMV5qHJOT3xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637188, "uuid": "53c97148-830b-429f-b704-611f0bb0c807", "value": 244468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637188, "uuid": "3aada14f-52c7-4335-9935-fdd0138b1647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637188, "uuid": "25e43027-1b2f-4017-98e4-85c66908e747", "value": "104633cc17f2294fc5a6ac7f7224ab30b26be13908a3a64ade05b048af275f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09fe416-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681759, "uuid": "b4c2f5eb-2040-4951-80ac-5c5550c86aa9", "comment": "Malware payload (Cosmu)", "value": "07e1535126043d324e66c54a3d1d3c3b", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681759, "uuid": "cc7ba66c-7027-431e-b924-a8dc5e8f4c1a", "comment": "Malware payload (Cosmu)", "value": "10c93806445f0d55511be58d503114bf8e08e8741fd67059ac6543c6e2b9ea54", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681759, "uuid": "3428e448-095c-47e4-8aad-8989e2f19d5d", "comment": "Malware payload (Cosmu)", "value": "641c9490d43cd1bec7cb6d813a572701400f0788", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681759, "uuid": "4a49aac3-a288-4374-8714-233995794048", "comment": "Malware payload (Cosmu)", "value": "29b1880845c26a0cecd3d97debea04887e2867bc1120d04a95bc7cbdd9219eed53436d5be3bb4682fa86be8c204a7568", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681759, "uuid": "e141b1a3-e26d-4cf7-b5aa-12589609ec5c", "value": "T15644F1553C93C4B3E0414D7289E58BD18B7F6D03B6E2E15BFF990A474EB028C4BA72A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681759, "uuid": "5d525684-1915-43a6-b2a2-2f40dca710ab", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681759, "uuid": "d94fa0bb-597f-47db-ae36-5ddc0bcd8147", "value": "3072:bQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB3:W9lKgzelZNQSBQGH/CSpWqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681759, "uuid": "58e3c1ce-f324-4586-9c2b-06edf566197f", "value": 264898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681759, "uuid": "907a4dd8-305f-4446-8fe4-798744227927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681759, "uuid": "821ed21e-c5d3-456a-befd-e7e5e53d2639", "value": "7zFM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da50efdd-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1780648677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648677, "uuid": "33a6d6d4-9af3-4afe-982a-36547b257bda", "comment": "Malware payload (PhantomGate)", "value": "6725ed1bf3badf8e75e44cb003c89810", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648677, "uuid": "806f5de5-e93a-4516-a93a-8a8f4513a76e", "comment": "Malware payload (PhantomGate)", "value": "113eb91e940161feb9d3849e239328ca24fa241c2d7f38ceea5504625c6da467", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648677, "uuid": "873182b5-b0ec-49b3-8991-381be12ee96f", "comment": "Malware payload (PhantomGate)", "value": "926a497f53c8db70daac07f6d22e25ee82ea177d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648677, "uuid": "00fe3a99-8115-44a3-b34b-465b694a8b17", "comment": "Malware payload (PhantomGate)", "value": "1ba0c9dc7b1a5225c2f48c4addc3a085ee0f792be4f8f758c79669743c5bdcec8858077267135ad571ef7b30f1bff156", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648677, "uuid": "4ab5f250-4ad6-49dd-8ac4-fc488a09b693", "value": "T1B863309B0966A8C433958F18968D1CBDEEE5757702D348EEC2960ACEF10E5BC401E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648677, "uuid": "15751bcd-da2f-42b0-89be-07e15c96ae18", "value": "192:Qh7UvHcOVTcoX0NU/BFR9hjdziFr32JK9cSKbnXMZJBs/1h1jzfd9ZVK6Ty+idxD:sa0UVj7OcN/VHkSZnpjBCy70m06UNcP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648677, "uuid": "45bc5f19-37cd-48f7-8620-5910a15d8aae", "value": 72843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648677, "uuid": "cacd2904-ba97-4fb5-bddf-61fa7d4f3946", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648677, "uuid": "8341a373-c3bc-481d-9d35-e08cc690a876", "value": "scan_doc00004.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c180ccb-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780641513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641513, "uuid": "9668c83f-1d59-40f4-a605-3d2c7cc9f599", "comment": "Malware payload (Mirai)", "value": "98dde5f290a0fde8bb5a58cf839df1a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641513, "uuid": "9cc8d522-8986-46a4-a554-621555ba3694", "comment": "Malware payload (Mirai)", "value": "120adf48c4621a2ca76cedca8fdddcfd0a12b1895469a24c19e4e2ff332ffc32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641513, "uuid": "09d877f3-01f9-4125-80dd-e74ab829dac2", "comment": "Malware payload (Mirai)", "value": "a5979be10e12b30f95c11cb4eca894bf8e7c2f04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641513, "uuid": "d7bcda87-183f-491d-a6cf-74d5923a59b5", "comment": "Malware payload (Mirai)", "value": "632d2084c60aa47fdd691d2066664f8ddb22be657149873664774f31ea54ca5726a7cba729460aca11234c26911d23de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641513, "uuid": "fc570538-369b-4010-8f8f-afe25f2fa287", "value": "T1FE230891BC819A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641513, "uuid": "f4ce782d-3c72-4096-8b8d-3a3c4816d746", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THE:5DmKF7Gxyk8cqoHAmWurAufsG5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641513, "uuid": "b51cf636-1c04-4ba1-b534-5c091d726bfd", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641513, "uuid": "f6d4fa50-d605-4ab1-a78a-102939dd5697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641513, "uuid": "bf10e14e-47ad-45f5-99a5-b12c5f36e2b6", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb65b04-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681781, "uuid": "57649fc0-8386-42f8-8bf2-d277aebfd312", "comment": "Malware payload (Cosmu)", "value": "5732eabd713d93db5094a6ac334a1416", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681781, "uuid": "6f8235a6-b517-4e54-bce0-5a647bfd1085", "comment": "Malware payload (Cosmu)", "value": "136f9dde47fcf202f77a7766ddd9db8e21c6020bd39336d94ff44e400c63bf9b", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681781, "uuid": "2ba7d4a7-09f9-4805-a3e6-d2f46e50df8a", "comment": "Malware payload (Cosmu)", "value": "d3724dc63804b9ab126c176c7f04b5e65010f4fc", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681781, "uuid": "8b9fcda6-c407-43a2-9839-816213da18e3", "comment": "Malware payload (Cosmu)", "value": "bd9be8cce05c2c84284ceff664998e6e3284711a833695a4fb6dc6b2c020fbc8202cb4ecd4cbf12c5953ab97416fc9b5", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681781, "uuid": "f470c44c-2d27-416d-a10c-3285dccd76cb", "value": "T10D5402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681781, "uuid": "b3a15975-c2db-481d-93b3-9551599657d9", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681781, "uuid": "12aa2218-45e3-45ef-8fba-2ed119512608", "value": "6144:0FlKgzelZNQSBQGH/CSpWqT1oAXjiU4bzV:zfBQGH6SfRoAX+U4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681781, "uuid": "88e993e4-80bc-4813-92f7-1c73bab7a05e", "value": 290817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681781, "uuid": "7dc86c76-b2e2-4c10-98ce-f1b2d521f607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681781, "uuid": "6b7a8cc3-63e7-4940-bbca-47ee2daa621f", "value": "AppSharingChromeHookController.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997a7331-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload (PythonStealer)", "timestamp": 1780642985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642985, "uuid": "9955e018-56d3-4eaf-a201-163310d2a6c2", "comment": "Malware payload (PythonStealer)", "value": "26eca4737b804eea06cf2b426865e4d0", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642985, "uuid": "567aced7-95ac-46b9-b1ea-79afd3258dcd", "comment": "Malware payload (PythonStealer)", "value": "13ee89082ab51d25549a46829ee13d44b04dce19db1f1334faab7294e5116b90", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642985, "uuid": "9d05d495-8a16-4f54-a299-218196b26e66", "comment": "Malware payload (PythonStealer)", "value": "4703f920ef73913be9bb2ce209064db2118dcc3f", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642985, "uuid": "dd2474c2-b147-4284-8775-03fff6fefebe", "comment": "Malware payload (PythonStealer)", "value": "85e100aca5ec6e5fc3b7a2c355a673f712a4eab45194b977001e0cf69885e3a43f1f4aecdc8ce5dbd6fe3ddbd0a852d0", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642985, "uuid": "655df3f4-7fd6-4270-b1bc-5c5f1c0f79ad", "value": "T1D286336AFFE3A8FDC58B8175DA640CF1B411FCE1155160AE4284D2F827138B06FADB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642985, "uuid": "e6c12835-907d-4acb-a8e9-fe4e2a166cc1", "value": "20bd67bca6c560d47ee260a75029b116", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642985, "uuid": "d9fd3757-8f16-4e80-81a9-f32f8a1dd020", "value": "196608:NtS/wGT4uGwmPBmlzr8be6uluqHpPXts+yCC:+IGTPqPAlzr8qjJ9n9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642985, "uuid": "8562d345-552c-4918-bca8-68e1ef601357", "value": 8186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642985, "uuid": "e3e568dd-9be3-4807-9a4d-a621f0e46240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642985, "uuid": "63ea0561-f361-45ea-bcdb-abc49febb481", "value": "13ee89082ab51d25549a46829ee13d44b04dce19db1f1334faab7294e5116b90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a778f836-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1780642149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642149, "uuid": "b52dc0ce-1ee9-4364-92b6-445b261fd73c", "comment": "Malware payload (Smoke Loader)", "value": "1e8c32759ed4236fbab4e64c908476be", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642149, "uuid": "671cc9e1-e693-4ee8-ba92-ff060e5299e5", "comment": "Malware payload (Smoke Loader)", "value": "14ff6574af1d17ede667d9e251c676fcce293554bcd0382292a71faf01dfed88", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642149, "uuid": "fe872ca4-5172-4ada-925e-2f0a43525211", "comment": "Malware payload (Smoke Loader)", "value": "acdc215fd36a60bea52f327a7ba07d3977d49b7a", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642149, "uuid": "27d27530-737a-4b82-8c0e-9d372d6744a8", "comment": "Malware payload (Smoke Loader)", "value": "6408beaa4f2c702463f575d431049dd9846db6c6f432153e0eaca1fb47dbe50f09f2b1ecd38b8b653cae66e9c8cfbae0", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642149, "uuid": "0bca1bf4-12b6-4444-b947-8b04a0f28e1a", "value": "T1DF242A2BD29330FCD552C078526A7232BB72B63D47709EFB03C287359E61AD09E79664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642149, "uuid": "d5dd3306-543f-4927-b29f-dc7fd3f2a659", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642149, "uuid": "7218d11f-4ddc-4837-9593-234e0fe1a5e5", "value": "3072:wFoWC5C9nJvzUL6p8Y74iRzfioaJ/GQPvlzP4BQOGAbHQQdKFvv:XWEC5zQ8DVa9Jnl7PAjQQdKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642149, "uuid": "109e8f06-d0f5-4496-b618-21374e8500d9", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642149, "uuid": "a748bdb2-566f-45d7-8041-5feebda8f78e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642149, "uuid": "250507b2-4427-4112-b690-73624db7923e", "value": "14ff6574af1d17ede667d9e251c676fcce293554bcd0382292a71faf01dfed88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c950a282-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780648648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648648, "uuid": "6aedcc9c-c887-4068-a8b4-b5238a3e669e", "comment": "Malware payload (MassLogger)", "value": "5bd36afeec596fea704dd84b9943291d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648648, "uuid": "36f6086d-1cb0-4430-9995-268c39feda32", "comment": "Malware payload (MassLogger)", "value": "1555640cedebc2846d967fde69fd51539f7f0ebbc9b53b2b7e61a2cdf7628bb8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648648, "uuid": "2906f32e-4d9c-4842-a889-9817f729fbd7", "comment": "Malware payload (MassLogger)", "value": "fe02d913cf055dea4cf26de1c1d58ce08914e32b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648648, "uuid": "e017ede3-618f-499c-8757-e5cb156ca503", "comment": "Malware payload (MassLogger)", "value": "4a2fcecc6830d87948b83566b54ebbf18b7571d02d43d8d6ad618955d9f0c131c9492c68abe94126c2ba3b815ebf6895", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648648, "uuid": "5b839941-ecc8-4175-85b1-6bebb7e75246", "value": "T183355B07D66E574D180A3B65106F5DDAFE89CEFCEF726BC4E08E90B160EA1110B856B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648648, "uuid": "29f964a7-6a7a-45da-90df-753451c449bf", "value": "12288:y9hy2hMsZoknG0sEBATDzgFdCubUjdrnjJkKgNAxqZjV9g1PRlJIfAfmdYZ5J7Sk:8hHGjCATDzxclhZx9sKO5J7YrARn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648648, "uuid": "4654b71b-00cc-4643-acf1-84dcea8ecd38", "value": 1103484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648648, "uuid": "a83f4786-ba5a-4f56-a145-cfe1e22b599d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648648, "uuid": "3413d0d8-9a55-4968-bdb5-11a15cf69227", "value": "DOC98716525 - ATR520260506-Draftpacking.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d68fd5-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780642873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642873, "uuid": "6473bbdf-2801-4cef-8434-c6c41c4d681c", "comment": "Malware payload", "value": "f0ea4c47bc8fec96770d023f1025bcb3", "object_relation": "md5", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642873, "uuid": "21adc916-85c3-464c-b374-79ecb91e8126", "comment": "Malware payload", "value": "15e6df0c95f2147952308e640d55270e9d097639eaebb34d4b352415f1c6bceb", "object_relation": "sha256", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642873, "uuid": "00ed83ce-5e67-4f8f-9138-b548a9d61dce", "comment": "Malware payload", "value": "a3d2ea3aa5850ecac5e75b0cc1467bda57dbb776", "object_relation": "sha1", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642873, "uuid": "563d8620-08a4-4e01-b4cf-71a716e829ee", "comment": "Malware payload", "value": "87ae2ea2b8ffb506d82548312ee5af3d665c1a37f121f356685018d49b5887aa5654fca889fe6d0e2d31a2a54d5040fe", "object_relation": "sha3-384", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642873, "uuid": "986ee0a5-c504-419d-8418-af7d3e03fa0a", "value": "T17D27DFC0F224F548EB550570582976A8496729303754D8BABE8BB6C2597C2EAFDF0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642873, "uuid": "08565f24-2462-4b61-bc29-aee4070ac446", "value": "a6054568ba980e12ef4939785dfd2ceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642873, "uuid": "c55b48b7-6272-45ea-8569-85dc82423f41", "value": "393216:uVBR7W8Fn2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlki:sBR7W8FK2OGfEhP0JqHOG8qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642873, "uuid": "0c19aea6-cdfb-4f28-ae1c-fd85150cc639", "value": 21015624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642873, "uuid": "e712375f-c8e1-46af-a738-c0a905883bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642873, "uuid": "c671ac80-e998-4db8-a6a3-9c1f4edaa038", "value": "15e6df0c95f2147952308e640d55270e9d097639eaebb34d4b352415f1c6bceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9b6606-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780643102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643102, "uuid": "20debe3f-63f8-464c-aac4-d75f0b1b24a0", "comment": "Malware payload", "value": "e09ec50e49ade542b6fe9c2c434b8382", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643102, "uuid": "bd04a64a-2a93-481c-b1c3-c3e105446695", "comment": "Malware payload", "value": "1613ba8666c7cf0449ffd8309813025f885570478367e88cdacc5960943949d2", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643102, "uuid": "c75dda05-d46f-4b1a-9d07-e2ecb39da735", "comment": "Malware payload", "value": "8095f1726743d7f104b8edf40b72dd6a0e97d3b0", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643102, "uuid": "5db719fb-db77-4e71-a9ce-fe3f87fe8faf", "comment": "Malware payload", "value": "b9ce0fe6e907ac24bb5f28a2d9d11b8bbb7cc57156c46209f70d6561004f88a3d770f909269967fcb4983d9e770d0e2f", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643102, "uuid": "f9b89103-9ced-49ce-9344-df35fd05bd89", "value": "T1A951E18E34F3608183B2A015453BB99AFA385A95834CDF18863D46BCBD714DD635BF4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643102, "uuid": "1620ee9a-f017-4f20-9e04-4d4a7ff9242b", "value": "48:ESCFgrA9xyc1n+5+6Fw3Fbl50+14WcC1TmWazLlB8XVxlBuLUjgOt3ZfuT2ACB:E1IcRY8oWcC1TmJzLlBiVxH9RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643102, "uuid": "67ea2120-e1a0-4cd6-b3b8-d7eada68ecd6", "value": 3059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643102, "uuid": "36453d5a-1bb0-46c3-b24a-cbeddad627d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643102, "uuid": "d7b44711-bf73-45b4-b251-54104fdd7234", "value": "1613ba8666c7cf0449ffd8309813025f885570478367e88cdacc5960943949d2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efaf5d0b-6116-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780688656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688656, "uuid": "ea366386-de9b-454c-9a53-f20bfab2e5f9", "comment": "Malware payload (ACRStealer)", "value": "fc56cbd1c795ee65869dd465c83d9523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "not-ACRStealer", "colour": "#FB3AA8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688656, "uuid": "14d82b42-c271-4e39-a47f-424b333e95fb", "comment": "Malware payload (ACRStealer)", "value": "16a8f92653ea8838ce2fa376cae48f3f448e7ac95758afa23c0ac1e808a78f89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "not-ACRStealer", "colour": "#FB3AA8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688656, "uuid": "9dd6b031-8ef4-47cb-be41-4f212896fd77", "comment": "Malware payload (ACRStealer)", "value": "5055036dc0a3588c99f53fa160cd803609a68453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "not-ACRStealer", "colour": "#FB3AA8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688656, "uuid": "07755208-efa4-4c7a-80fb-afd0613523f8", "comment": "Malware payload (ACRStealer)", "value": "c8bb210c84ee576c8931927f2de0743c1af2e5943e5a5f8cf079fa1c75c9f85e10d4643211e7e7f177d3b27cc30e9e61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "not-ACRStealer", "colour": "#FB3AA8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688656, "uuid": "05a521fd-2bd0-4110-a284-623ecce8aaaa", "value": "T132364A427CD009EDC0A9733188B67296BB65BC490B3623C72F62AA783E72BD15C77745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688656, "uuid": "3b4ceddd-45f9-44eb-be58-9551120079ed", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688656, "uuid": "2e3ecf6f-e4cd-4cc1-9ae0-f7138a4493b7", "value": "24576:0Uyf+DZ/SQUbEmIQmpxR8DI6mB7vyKfr+PwGVpic/EAXP/nBele7tKDyiv4uvp:0VmDZKQkIvpxR8D5u7T+liSEGBnCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780688656, "uuid": "7dabb452-9324-4812-91aa-ce5b4b0ff462", "value": 4881032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780688656, "uuid": "113e7d8d-6f5e-4611-ac69-e4a539ee708c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688656, "uuid": "75bae192-ebdd-4d2d-8ac4-bd6349237922", "value": "\ud835\udc7a\ud835\udc6c\ud835\udc7b\ud835\udc7c\ud835\udc77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8588f683-60b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780644669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644669, "uuid": "6520f931-ecbf-463b-907b-7e0c12c65003", "comment": "Malware payload", "value": "26e1dc22a484d8cfb12705560366a3e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644669, "uuid": "a3f8db00-ae55-472b-9d01-a8c7c8cc9f50", "comment": "Malware payload", "value": "170e118318384d0dcbf2584e8257e54cfb54b67749b3e10fcbce6d33400e2219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644669, "uuid": "73261508-f2ca-431d-954f-9efb32341c4c", "comment": "Malware payload", "value": "8d624f3edb519138939be9953e626ac5817113be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644669, "uuid": "69d6747b-aafe-4741-9690-f606669b6933", "comment": "Malware payload", "value": "95b031863d266620d803e4cdfb2612acbe9359afb6dfb3ad35bd993d5413aaa9de50795da51bfb986c84fe48d1c79a5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644669, "uuid": "b4665e02-073e-45e9-975b-d6808de56873", "value": "T149C733F1BC3426E2D05AA334B8C51A4B3E5EAF918D6572CE1378B2DDD1929210CE7B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644669, "uuid": "de3b1a1c-8fd1-465e-8587-05e1925b921f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644669, "uuid": "8bfc9f51-a44b-49fe-8aa5-3f7b36d24959", "value": "1572864:K5AWU/u2bK5fjFHJ/U8YjtecGFRTwo2ffvZ17:GRAcZjZJ/rYRBQwZ37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780644669, "uuid": "953f617e-cd91-459b-a79c-38cf2fe18877", "value": 53322264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780644669, "uuid": "0518bc4f-f289-4b66-80d4-92e78ab700e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644669, "uuid": "00744f6b-71af-4cf1-8b59-f575521ca08c", "value": "Nightcord-Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba431629-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648623, "uuid": "9268b61a-ef81-48bc-8dbd-02c1c303e4b9", "comment": "Malware payload", "value": "f94ffc47c368ab0303c9147a7df30faf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648623, "uuid": "be1f9700-1609-4689-8f11-e89340e26949", "comment": "Malware payload", "value": "1790413cbee69c1137c475c9fd7c5e4d49fe1cdfbe3c537f0f2a7f68b119f1ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648623, "uuid": "bd7bc204-afff-483e-89fc-6f92c4cd6ad2", "comment": "Malware payload", "value": "526f5be01d6bf82b3a9513c941d766bbd45e11e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648623, "uuid": "2ee1a05b-67e1-4282-a651-20c12a20ca26", "comment": "Malware payload", "value": "616953e562dec733042716db624a22c70b47ba4532ceaa244cca959229f120404e29f9fd27b021b4c8ea58a831073f59", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648623, "uuid": "e9c41155-6393-45cf-9f9d-d2d1ec5646f3", "value": "T171E4FF6628BB5000820762EA573B63F97577C983BA1474B8F84FF17CEF8AC1C5660679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648623, "uuid": "db1bc84c-7cea-4aee-afb0-d9e68657bf4c", "value": "3072:Z7FFTJ1VS4mzHvwzN4hYSUH0mjqv1L1cjl75u1A6Cv3BBrleAcw3AhOGxK5Htkk:BFFT3SpYWalYeJ3XQhg5HtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648623, "uuid": "ce2edc06-5e43-435e-adfb-a3830ba18b2e", "value": 698522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648623, "uuid": "11470f36-4bff-4563-a02e-2f3b863b1bc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648623, "uuid": "5a10ae85-24a2-4493-b19c-db910f3afa4b", "value": "daron_document2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673f3a50-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780642900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642900, "uuid": "016b5166-b126-4b56-b88e-bd846279490d", "comment": "Malware payload", "value": "2c2fb4098bf6981b4c3bf0c5d83baaa9", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642900, "uuid": "416c44fb-45d0-4790-bcae-e43d31be5c19", "comment": "Malware payload", "value": "17a5159ed9959ee60178535fe1790505e2a7bf8c7accae1f8c59596f354bf8fc", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642900, "uuid": "7ee2a176-948c-46b9-b48f-872fccff1a5c", "comment": "Malware payload", "value": "dfaff22eb0c6893d9844abef2cb4fac56258c099", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642900, "uuid": "373a7cbb-7dd0-42f5-80e2-1757c90fa70c", "comment": "Malware payload", "value": "61b43128a4a4504366e847ce4818951a5b75e2512ffbf3be8a337bcaedcb7b7fc6f6e4c54e06b756775310c2e4349d64", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642900, "uuid": "03a64cd8-11bf-4b50-a7e6-1db4f7ad686d", "value": "T10B0833D36B4B8CC3A2329A7177FA6C60BDB11FB218874531237193E9AF516614FB4683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642900, "uuid": "403bc99e-e61d-4338-9ee2-c77f9b18bcef", "value": "1572864:6VO7yi/3J4tyHqrBch/dalZnlyGB5NCXKfKbzAWopkMtYAgibuw9wmqsNY:H//VgBc5dCvnIKyb/4+ibuWqsNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642900, "uuid": "b78cfa83-c9e6-4495-8fe0-36382f7f5fab", "value": 79422560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642900, "uuid": "3a9a7b15-7211-480b-9fdc-fc0083926fc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642900, "uuid": "584a7164-75a6-4d09-9a07-4782feab0f13", "value": "AIMr.AI.Free.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41fccd6-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780638815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638815, "uuid": "eab82b7b-8ca8-49f3-8811-0added2fea46", "comment": "Malware payload (Mirai)", "value": "31becd004557c0a5842e5f941c72d06f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638815, "uuid": "85157891-781c-4cf8-babf-0f7e2a31232e", "comment": "Malware payload (Mirai)", "value": "1939d20bc8e84b21e24f7eb6d09860c0071780ec1bb110718109a54c8a5d84b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638815, "uuid": "73922c5d-ff74-43ab-8fa8-a3ef10c3a1cf", "comment": "Malware payload (Mirai)", "value": "974996ddb9a0be0923aeea08553bedddd1741c25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638815, "uuid": "d670d4e8-3e46-4698-b1ee-3fbd14475ad8", "comment": "Malware payload (Mirai)", "value": "e088227d48f7a96f6e8e5b167ccb39a3e1597dbe33e52376ed139edc3b196d4553040754f6a6f85aef8aa4da04d42b5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638815, "uuid": "beee3158-be70-4a12-8e29-97fbfdd4cf1f", "value": "T19DF3E837A70D0F43C05329F02A3B7FF18F5EAEE315A55180662AFEC586728B22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638815, "uuid": "67b0e05a-de21-4396-9866-472f77b69d61", "value": "3072:J/moPTg5QoE+w0ii1xE+2Uv8ACt63M2Jwu:J/morg5p53Hx12Uv8VtmZJwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638815, "uuid": "250aea14-8c46-40ec-b007-72e6ed6aaa36", "value": 169368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638815, "uuid": "273680ca-f77b-4973-8ed0-7a3b8e3a62ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638815, "uuid": "71c3fce6-99b8-42e5-9a78-6ccf6a658b00", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c733d2b2-607e-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780623304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623304, "uuid": "f30a4edb-b2df-4f22-ad65-5b6908320907", "comment": "Malware payload (NanoCore)", "value": "953203cf8f6bfeaa1a1755a62ff2248d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623304, "uuid": "8b1528fd-140d-4e97-a1f7-914eba4a0cbb", "comment": "Malware payload (NanoCore)", "value": "193f74b8b5cb8c3e82bf7e33f4ee083522f2a893c7c1b6959d22188e7a5f9319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623304, "uuid": "42bba0b6-e5c1-4300-9ca7-8695bccfbf3c", "comment": "Malware payload (NanoCore)", "value": "7368e9eeee7b3f5e85e9be80741976014299b442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623304, "uuid": "48c57d3b-3f8b-4d2a-8e97-8255785f08df", "comment": "Malware payload (NanoCore)", "value": "aae30ba2322bd529002915ba065afa9825eb394ce0bfc6a655d920130ff807125cf6b79e5a1649e4a578965f89f22324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623304, "uuid": "19875a21-beee-42d3-87b2-c89faf21f979", "value": "T17014CF6537E4492FE3DE8678702242028379C2E798D3F3EE28D461B69F663E44A471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623304, "uuid": "d7062f1f-cf95-4189-876b-bdf64637735b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623304, "uuid": "574ad8dd-167d-4b78-ad2e-20d47dbf5948", "value": "6144:MLV6Bta6dtJmakIM5g6fA+eXcTTacsRy3Cj+O6:MLV6BtpmkluA+eXsaDCUp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623304, "uuid": "0f27d487-5992-4bef-8e81-1a775bb34aaf", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623304, "uuid": "f2245c7f-ab55-46d5-8e1a-367acfb7473e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623304, "uuid": "42079073-9884-4a2e-9530-04798e1d1ebb", "value": "ennovar.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd74e466-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780648628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648628, "uuid": "f0d0b172-74aa-458b-b55b-0ba46b3d51a0", "comment": "Malware payload (Formbook)", "value": "7a6e9e10efe7b2ae95bd6c0f34b03937", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648628, "uuid": "eb9a7339-e9c8-44c6-92e4-da29abb31de4", "comment": "Malware payload (Formbook)", "value": "19404df6ef74b461f9cfd6df77fde47b55a9fe6352040a801acffd8d512ed65b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648628, "uuid": "7f7e0ff4-ec7f-4221-8962-4c3454a156ae", "comment": "Malware payload (Formbook)", "value": "c9cd521c5bc60e91250e8004819a056ea39ed284", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648628, "uuid": "6c2c45cf-1dee-4027-ae77-1386d276e535", "comment": "Malware payload (Formbook)", "value": "5d1c5fe18df8e5b61cfd23e56ac3ff4447735e745f8176692a64711e4486ebc0da07bef6561e699e1d59c8ea850aa461", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648628, "uuid": "327d719a-f276-4bfa-9782-7932e29f7653", "value": "T153E54B17D66F974D180A3B61106A5D9AFE89CAFCEF727BC4E0CF90B610EA1110B851B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648628, "uuid": "9e53c28a-eb63-4d4e-98bf-ce74b309ef99", "value": "49152:4Wx3uLGVmdnsQtoNanxMAoTJho3zljykehXQ4OsBTyo+v/6OfpDHSprZlCzt2+7E:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648628, "uuid": "4fed7d9e-f059-4e05-b6bb-6faa8eeea611", "value": 3119224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648628, "uuid": "d44cb7b2-6567-4dd5-b4b5-fcdf2246cc1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648628, "uuid": "765b1572-5f14-42a3-bf8f-c1478ab6ee23", "value": "\u8be2\u4ef7\u5355 TCS06052026-5218.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf73e0c-60a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780640707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640707, "uuid": "e89773f8-fd81-4935-837d-2d8908823d9a", "comment": "Malware payload (Mirai)", "value": "af54096df0782fa0f553305963136c16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640707, "uuid": "66bb646e-ad27-4b96-a160-2ae97e485517", "comment": "Malware payload (Mirai)", "value": "1a3c5c96ed6661fe7d70088ea578ca97ceffc99627e1e834dc1a423def9a5986", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640707, "uuid": "3b724b54-bbe0-404b-98e2-99f2a636203e", "comment": "Malware payload (Mirai)", "value": "54fd0dd75028bcd346dd42b029f6ce1ac013b795", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640707, "uuid": "2c148995-39ce-4ace-a66e-c55c6e9c2d96", "comment": "Malware payload (Mirai)", "value": "c8be723e9bb67afce89246aa5b66a2505b8c5b3a6377c06cc6445e7c101806ba5854ee3c2189394955755abc073d8bec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640707, "uuid": "133f1710-5abc-4b1c-b563-f3bb0f07293f", "value": "T140C3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640707, "uuid": "2d87b407-50fd-4bf1-a661-2b1a2c1f971c", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMhN:MwCvdHmezn0nUPMu9KryXsMhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780640707, "uuid": "7a2ec1f1-8c16-43c5-b6d8-c81a2b55ae04", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780640707, "uuid": "1dca6cc6-97fe-4e3e-a3f2-3779c9b19e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640707, "uuid": "f57d9a40-e00d-4c7a-83eb-21118e394b44", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98112149-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780638687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638687, "uuid": "cec2c414-22db-4aa4-a367-678cfdae37f4", "comment": "Malware payload (Mirai)", "value": "2c009474e5e2322d0640329a8dbb8564", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638687, "uuid": "c4e91596-78da-4e6f-abd0-44a6c4d2f397", "comment": "Malware payload (Mirai)", "value": "1c07ec4db3c95af750a0160e579d538a0b5a107d49cbb5966912dddc0f6b0d8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638687, "uuid": "f49c9046-05ab-4ba3-8b70-4e83f1c3bc43", "comment": "Malware payload (Mirai)", "value": "6ebd74a5ffc7077c85dd3b78165c3ba8c4b88e59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638687, "uuid": "3b987c61-9964-4753-807d-ccdcffedc509", "comment": "Malware payload (Mirai)", "value": "7260ba9038a038e1995bd5365b47b03f96ee493e990aafc60aa024a6448d0a09d239533a8fdbc2c1f2180658126cbcb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638687, "uuid": "7a576177-f7dd-4a40-b53e-dd8dca7e064a", "value": "T129F3C434F8088F1BC6D322F6E75C469E7E291FDB97EA31029A34FE9027E65D60625D10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638687, "uuid": "ddd57f8b-e58e-4457-b8de-ee3bcc7bbe3a", "value": "1536:/fVktp+yGIpWA+u9S+m4Bk2FWPu4VKxokTA5S/xXCdEfcQ0oMElv8wywzAS9NvoH:/Spkw5V3BkC4uj85S7kQdjV5vRIRme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638687, "uuid": "5694b65f-f451-4cba-97ab-a4bcb1f83520", "value": 163784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638687, "uuid": "0677249c-bc77-4346-83b8-142ffa2f715c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638687, "uuid": "ed2e5097-e200-4248-95be-6960bfd107ca", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c0233b-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649453, "uuid": "e7184f41-e0a3-4d5e-a46f-7b5535cde40e", "comment": "Malware payload", "value": "6b6e418321b182f4bbd6ca9b62e02c34", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649453, "uuid": "ce5c3f12-884a-4a1e-9bb6-2e37cf5565fb", "comment": "Malware payload", "value": "1ce688f920724af1cfa34a8ddb8e3b7300fd7bd175bcfdc78aaa9f3be2c5857c", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649453, "uuid": "332c61c6-b4fd-448f-a87c-214e3a0cbe52", "comment": "Malware payload", "value": "3b0b4a5c43723d18a00afc073fa76cc92139a656", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649453, "uuid": "3c6aa504-b9b6-47f1-893a-1a08f7d39e43", "comment": "Malware payload", "value": "cc41e81d14749aae2a53ea8d3a61ddad964d30a227399a1debc9b2113c8a63ac61e273612044b2337cd94a3ef2ab4045", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649453, "uuid": "3d6aed58-3ace-40ed-b39f-89f91ef89afd", "value": "T18C02AEA05845185997B0EF72208023612BCDB90B3ECF551FBCA3DA4C40BFA8A5B0D4EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649453, "uuid": "22659981-fc37-42ee-afe6-188fd7845fba", "value": "192:hS4VC5vmvwa9EBEdt25FNZTkb39OSJpiacIkxOAsp2Ke:NMSEBEd4Jx+3ASKacI3Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649453, "uuid": "e6d2e931-1da7-4798-bb54-ef5686a75d77", "value": 8402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649453, "uuid": "acaa8d95-f243-4ef3-920d-783df5a2b2ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649453, "uuid": "221df0c7-9256-4728-b44c-08b6fd889016", "value": "photo-698553850.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b905c517-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (SiriusRAT)", "timestamp": 1780648621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648621, "uuid": "5e7b64a5-1ac0-468d-b67b-8eeef860f595", "comment": "Malware payload (SiriusRAT)", "value": "05910df100bfc78ab7787d3238888f2b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648621, "uuid": "d9658443-cae3-49fa-9c91-f1a7eff3b684", "comment": "Malware payload (SiriusRAT)", "value": "1d2d9b8e18d2fee71d835391e9167d3ef26309279d4a186a010556a79004251b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648621, "uuid": "79fceab7-112f-4803-9090-ef7556c6dab7", "comment": "Malware payload (SiriusRAT)", "value": "f35a38872c5596aaadfa04137d313108ad4712f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648621, "uuid": "6a10e539-9c8c-4c84-aece-fda80c9bea3a", "comment": "Malware payload (SiriusRAT)", "value": "ad659ac7c358c357a63b82605ba9c1538d39e6c2863f9cec2d95f4e87f21d745a1485100f7e296b0f611785583bf7d23", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648621, "uuid": "ee6c31bb-6258-49fd-b453-bc6182c9b6ca", "value": "T16903259451F72E0E7CC917F76DFC18D7267D5990234A2BF5FA4E54DE828880C42ACAE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648621, "uuid": "f28293d6-822d-49bc-b8f3-0436ebccca7d", "value": "96:I6SCIieicXV+gROELwd2LW4Jw6owO9kyfyocnNQRoN1d+/HHp3e+BuC+xufT4fIA:kzjoz/af+jkgHvOxqXlQdOrUJj+xRCgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648621, "uuid": "57fc32d1-e33f-4881-a792-a409e0a17e38", "value": 41093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648621, "uuid": "285fecb9-f792-4293-8fdd-dc96341e1202", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648621, "uuid": "d9075f7c-e5a9-45f3-82c4-0c901c80978c", "value": "Banco Ita\u00fa_Copia de Pago.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687622c6-60ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780657505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657505, "uuid": "971e29eb-a7a3-4f5f-925e-6b357e5e137d", "comment": "Malware payload (Mirai)", "value": "d7b081b37076fb1a03dcbe00afb3c978", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657505, "uuid": "c6761d33-34eb-4cd5-a25c-4346d1987354", "comment": "Malware payload (Mirai)", "value": "1d394d2e039d7be2df993b4afb184a7bc92687d4b32ae8da44ce3ee4a600829f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657505, "uuid": "8f251e32-fdc0-41ad-867a-f128ff991d39", "comment": "Malware payload (Mirai)", "value": "5dab1b266e108ed504cfbf2a41a72394c3df3616", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657505, "uuid": "a999fde1-8daa-4cf1-9769-5bb6db2a95b1", "comment": "Malware payload (Mirai)", "value": "6fb9e09ea6b20473575c841beae274fc80d132501db3fbcdb27acea7276bad6112219d26f855e28bba6d5b69a94fb525", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657505, "uuid": "5e8b83df-f355-498e-bc8f-8aa457960cda", "value": "T193256A2AB2B3F1BCD117C13017EBCAB16535B07926316DBF67C49A313D66DA11368B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657505, "uuid": "a90fe1ea-5bed-46c6-8f97-d1e4b3a7a35e", "value": "24576:f7ePuRDNyi7NWne5ZiG5EKWff5CgJWhSxQ:P7NWe5ZinKWXHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657505, "uuid": "33657554-89ed-44c2-802a-daacd6c2c6f5", "value": 1027240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657505, "uuid": "365489e2-b203-4646-83ff-52330a893ccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657505, "uuid": "1ac5b225-8670-4f28-9cd9-ee8bf4a0da97", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3b158c-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780648413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648413, "uuid": "f531ae21-03b1-41ee-aca3-17aa634a74af", "comment": "Malware payload (RemcosRAT)", "value": "7a245ef2033fcf4049c7c6bcbdf0d4b4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648413, "uuid": "6561a8e3-fe96-4aa2-bfaf-8f39c329d393", "comment": "Malware payload (RemcosRAT)", "value": "1f18886a057b457b5d55e9366dfa1e2cf7de3ae8462811de052ca236b083bcf4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648413, "uuid": "c95a7e4c-8da1-425b-b1bf-b3f422d93431", "comment": "Malware payload (RemcosRAT)", "value": "90ac2d234977a072b220d373cdf62798a851af0d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648413, "uuid": "7fa374f1-18f6-4e1a-b31b-0b4959936c00", "comment": "Malware payload (RemcosRAT)", "value": "6349571e56adfb8888ad1a748d86ca378629baa833f4fb013e2bdaf677d035c192df29967a45f7365a698416c2c0585c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648413, "uuid": "901dd0a0-23da-4405-ba91-7c736a32648d", "value": "T1478412267A12738BCDAF53F604D9D6DB6318BE47BF69936710403B8D0E327C2509A43A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648413, "uuid": "b9439494-ae11-4469-8b01-57f9e06ee5ac", "value": "6144:Wp957EYf6+yUHdyyM1DhdDU3Ckp957EYf6+yUHdyyM1DhdDU3Ij:qtpkUcyM1DvKtpkUcyM1DvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648413, "uuid": "da1cb839-dd5a-47b2-876c-ad236bad4413", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648413, "uuid": "157114af-bbf4-4b68-b36c-2a91666abec7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648413, "uuid": "a1d2a346-8e8b-422f-b054-38ebcfc8239b", "value": "Zamwienie_na_przetwarzanie.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2204be53-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1780642355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642355, "uuid": "a49ddd64-66fa-47a6-956a-b2682523cfa1", "comment": "Malware payload (Smoke Loader)", "value": "a2f9db14926c8e6fbfa65db85653285a", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "FakePublisher", "colour": "#0AE6B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642355, "uuid": "fe8334a7-a1ba-4a97-b4d2-19af6d0ed1ea", "comment": "Malware payload (Smoke Loader)", "value": "1f3bdb215b92a957448741a1f0f97063922b9b95feedc8e3602fee35a2e810f7", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "FakePublisher", "colour": "#0AE6B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642355, "uuid": "805b155b-28ee-40f1-a3cc-fc4c916fbe86", "comment": "Malware payload (Smoke Loader)", "value": "176784c637fe90c34a88a7bc825fa350b57658b3", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "FakePublisher", "colour": "#0AE6B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642355, "uuid": "a207f40d-c3a9-4d7e-b7b8-201b2bc4c0cd", "comment": "Malware payload (Smoke Loader)", "value": "3c866cba1dfa8042fd7639ba4230cea77a6ad16d10e8ca34e5f154ca6617263614f4ce0bc778fc7757ff5ef71cfd1a88", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "FakePublisher", "colour": "#0AE6B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642355, "uuid": "a74ba663-a1f2-4c24-a73f-7ccf7e150485", "value": "T12AB53357797C112ACA1287B021EEF7EDAE609CEBD42A00E791B1775C2A7171C322D1E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642355, "uuid": "3bbd37dc-9457-4092-a48d-d4b10e7feaa0", "value": "49152:pxayIRSfaR8s6jYqEVi2GSOJLeL+EPda6ENQICj1j0nj2g0cEoUXKvwgt6hOX:zfYSims6jIyJL8P46kQIS0nj2IElEt0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642355, "uuid": "7b205c7d-81f5-4ee9-99f5-442475c88367", "value": 2473984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642355, "uuid": "b7b6ef1e-8dae-45f0-8194-1d2d78ea335b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642355, "uuid": "6d5a5ad2-faec-415b-9014-b030bcc195e5", "value": "1f3bdb215b92a957448741a1f0f97063922b9b95feedc8e3602fee35a2e810f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3dee33-60ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780669645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669645, "uuid": "361c590b-2ba6-4f40-9926-16a206fe4ca9", "comment": "Malware payload (Mirai)", "value": "30d7e7882d1a888babe44187ac9e878f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669645, "uuid": "1f587000-6d1e-4a1b-9fa2-48bc7b92e98a", "comment": "Malware payload (Mirai)", "value": "1f522ef19fb99f6a7a0d83667fe2927bbc3883967629125bd0975a10b388c10b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669645, "uuid": "642058d6-4ee6-4dbd-a01d-5821cb9ef9fe", "comment": "Malware payload (Mirai)", "value": "56f630f76fd7d8967e600c22c6e175696d3517a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669645, "uuid": "936a52d4-1c42-4736-84ae-53e7bc4b0b89", "comment": "Malware payload (Mirai)", "value": "7f6cabc901065e3956fee1184ab7de6145ffd944f09be5214abe6c16179ad5458f24d936d59691d025fcebff3dd1c1ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669645, "uuid": "b46aa05c-4bf7-474d-9645-3fbba9eb28c0", "value": "T1D1A31CD6BC818B11C5D156BAFE1E21CD33134BB8E3EE7213CE145B2E678A86B0A37515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669645, "uuid": "68e53d8b-4748-493b-ba00-a3b182b9e13d", "value": "3072:3VWRAdrW/chVqDEf1mr1Zl7BaErWPtEVOkmTsq8z:ewqOAhZ3brUEVfoTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780669645, "uuid": "685802d4-a171-43b5-8cb1-d0f3689ecabc", "value": 100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780669645, "uuid": "e742fce5-4456-493f-9122-d18c66540a18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669645, "uuid": "bbd4e9d0-9c45-4cad-96c8-30aefa342217", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea786c1-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681648, "uuid": "f6347835-3eb8-4bac-8f7a-0ed8ed49d25e", "comment": "Malware payload (Cosmu)", "value": "3b469d58c2adc6c52163e1d857b0e559", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681648, "uuid": "f818bf10-1dc5-474b-97f2-f63cc943acc8", "comment": "Malware payload (Cosmu)", "value": "205fab733cf29a02a7be41edc507b96bc336de259589068e01b75148a8f46599", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681648, "uuid": "fb6d20e5-cba0-4d26-aa5b-cb3f4416dc78", "comment": "Malware payload (Cosmu)", "value": "fff59fa4420cbfacd0a22d5ac8d01a99235907a5", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681648, "uuid": "a118e714-e047-4497-930a-dbc47f2dd13d", "comment": "Malware payload (Cosmu)", "value": "a757413f0d13b226f472ecc81ef8d0b876e879291e843a8fbcfc0318268ae6763a6019c8d2e039020dd80c3e6a58900f", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681648, "uuid": "28d82b77-ce2e-4230-a60d-f0d1279edd14", "value": "T1935402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB5D0B4B1EB13844BAA361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681648, "uuid": "c747a1fb-1f63-40dc-807b-ea1eca4c3651", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681648, "uuid": "e66ec846-e079-4766-bafe-0c5d8581b7ee", "value": "6144:EFlKgzelZNQSBQGH/CSpWqTwoAXjiU4bzF:jfBQGH6Sf0oAX+U41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681648, "uuid": "acd06432-9341-4a13-9091-73a67636aa2e", "value": 290817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681648, "uuid": "42cf1875-1ba3-4b4e-91ee-17e92f0dccf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681648, "uuid": "67a875c9-e125-4dfb-beb7-ec0dd7535bc5", "value": "appletviewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20e2f6e-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682191, "uuid": "bda683af-1cf1-4ba7-b931-fe9ebb78860d", "comment": "Malware payload (Cosmu)", "value": "0c41e5a7c11dc9139bdba89c92259f5b", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682191, "uuid": "2ca3cb39-b5bc-4511-8024-10b308341213", "comment": "Malware payload (Cosmu)", "value": "208f44add6215ab211f5a132c04bebf647ffd139346e19eb03d77ecf11228068", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682191, "uuid": "a3d64c5c-1304-44df-950d-f258b6e03f8c", "comment": "Malware payload (Cosmu)", "value": "3601e1fa3a8628008261c6fc5ac355ea531aacd9", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682191, "uuid": "e8ceb7ac-bb33-45c6-9195-38ad1a71e4f0", "comment": "Malware payload (Cosmu)", "value": "3910fac9aca56a48c6653a1bfb7de83f5ea3368bdcd96350c1e0de6a7e727aa7b17f6cfd46fa4d4c502b89bf012b01df", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682191, "uuid": "1fa98111-1d39-4a5a-855e-c0550dc6dc3b", "value": "T18C65F1217993D773D181C83198A68B80C77BBC1796B68123BBA83E975F752DC4B73242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682191, "uuid": "392870b8-2720-45cc-8b76-e709364f1ff3", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682191, "uuid": "4aea9e76-fb45-46fa-9ea5-9b48b412b303", "value": "3072:4QXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB/aUkLKX:B9lKgzelZNQSBQGH/CSpWqTpaXKv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682191, "uuid": "a2ae785a-4df0-409a-9287-55efb6b1ee58", "value": 1544308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682191, "uuid": "8b7c68e8-5ec4-46a0-8edd-d3de09f79c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682191, "uuid": "d872ce16-22c9-45ff-a50e-07fc1a84d966", "value": "AppVShNotify.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ca7daf-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780643109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643109, "uuid": "f4b29156-199f-41ed-b513-5594b47d72f5", "comment": "Malware payload", "value": "630eff545e0c4c8689c3de64daf60d2b", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643109, "uuid": "21a7c2eb-a9bb-4273-bd02-701eda24b3bc", "comment": "Malware payload", "value": "21ee6e62051474637aa93aa0fa6f2eb964aedd9c45395d28a3a03ee937988827", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643109, "uuid": "f713982d-dd0d-44fc-8a96-c0287f8f53e4", "comment": "Malware payload", "value": "3e4ac6607358cd59b521be91f3c4e3736a33464f", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643109, "uuid": "d310d1ff-db8b-4d11-bb1a-5bb216deaaf4", "comment": "Malware payload", "value": "60b8a7c8fa9714d4b71ca62fe939392cda2d26391b73915168a822f6f3a1af928943c80af18dac3d62a00262582cb411", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643109, "uuid": "01f6c8c2-56cb-470c-a5a2-39089438ad38", "value": "T18151009D34F3A08282F3A024443BB59AFA3859A5834CCA14863D86BCBD701ED6357F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643109, "uuid": "b24040a2-3b60-4544-8613-6bb1fb3b2bd8", "value": "48:juLMsSrQ0qy54uf+r1Ac1n+5+6Fw3Fbl50+14WcC1TmWazLlB8lEVxlBuLUjgOtV:juQ7hqyoicRY8oWcC1TmJzLlBrVxH9RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643109, "uuid": "51cffee1-cfca-4e10-8854-8effaaf28f31", "value": 3060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643109, "uuid": "1b00a34c-952b-4fc1-86b1-6d07e138ee96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643109, "uuid": "342ce2ad-9569-449c-8cfe-ced31ca993d4", "value": "21ee6e62051474637aa93aa0fa6f2eb964aedd9c45395d28a3a03ee937988827.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d90646-6112-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780686814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686814, "uuid": "8d2c5001-df39-4efa-94c1-43485f318d15", "comment": "Malware payload", "value": "1d8994f7b89e178cab99d67d52a6687a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686814, "uuid": "68da43f5-2a9d-4a2c-93f7-0972e7e4a92e", "comment": "Malware payload", "value": "22a58b0a23c5dcd4170cd0e9dca8d59ebc074d591a6a539a3660bd1c7811cea9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686814, "uuid": "3ce8b8c5-bd8c-44c4-9eec-82c9138fd860", "comment": "Malware payload", "value": "7513d9dbafdb17c51197a5f653a1641bcad959ae", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686814, "uuid": "538c454b-59b2-45f1-938f-b75d2d1bbc4a", "comment": "Malware payload", "value": "7714caf123d2ebc2e53fcbd002fed6068a2fd7066dac2946900288cb6dce12011373b0a8d70c34fa19146e9f868d1dca", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686814, "uuid": "4eba60cf-b068-438d-9f6b-ea9ac78cf633", "value": "T19A825C0FF9424326E0D100709662467BEA79A87A73C454D7FBD18AED1B686C2EC3325F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686814, "uuid": "cd740374-c853-413c-96a7-740d1fda41ca", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686814, "uuid": "5715d53f-6f0a-4894-b438-a60039f4a4b2", "value": "192:a6hSCngTBvPV0K3EdRgq8PGle6/C/KUSf8zwAVYNd5bo+EI2DoCGJxTmv8U9cthO:LIPVG8PG0Ud8xVOdBo+A0jav8U9cO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780686814, "uuid": "ef589d9c-9262-4111-86af-0aa9f0979022", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780686814, "uuid": "6571c0f4-a977-449a-8e65-f65ba7f31556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686814, "uuid": "32ff7184-d1c6-41d3-b4d3-19e155cd8ead", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59289a0a-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648460, "uuid": "cc2e7ab3-73b5-4bb2-8da3-5ad2b588c193", "comment": "Malware payload", "value": "3b8936f7ae7e938a3dcd6bcfbb0b21a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648460, "uuid": "7c35aeeb-4ce0-48b7-a17b-72583ab895c8", "comment": "Malware payload", "value": "22c6f2b190e32d5da727b803ec16f6dc534595724de66044a6446c5acb1dede9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648460, "uuid": "0dcb9a8c-d1d5-482c-b52f-f9d798ead14a", "comment": "Malware payload", "value": "3bf5bbb78f44513a3694c44d3a6899ff3af75acb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648460, "uuid": "6a237000-5ed5-48e5-a06d-86d2f3629e03", "comment": "Malware payload", "value": "ecca068eff8ed0ccc905f6b59bd5558c3e489c541197e43937569ce87ce696ba0934fbfb3bd296d4794c33c4e51e8848", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648460, "uuid": "37872be7-56a8-4852-a49a-39a6ad294d95", "value": "T151D2DF34C4D83FBDEEAA2A1C06FA6A20D7D68B1E9498860637477D9B4F37D80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648460, "uuid": "3d4a18c7-ccbc-4868-a46f-d30dc591e798", "value": "768:sumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:su+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648460, "uuid": "7256eefb-edb4-44a2-acf0-dfdc44feefa7", "value": 28668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648460, "uuid": "ca8d7fca-0ebc-42bc-8199-c62b16a15d86", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648460, "uuid": "b4a00275-cdd8-4356-b3af-9182e937a261", "value": "23.94.110.24_1780648384280319_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb929ba1-60e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780666664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666664, "uuid": "f35a02f7-bba3-4e89-a781-b05e8be993c6", "comment": "Malware payload", "value": "c3e4c99aa1103b7571ba61bca6381d8c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666664, "uuid": "d8d4a1d8-02d2-4094-8ac4-120870e27861", "comment": "Malware payload", "value": "23dae6012815fc9b53c1c342d7c3535e7d703ae0747089abeaea7241dc4fb177", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666664, "uuid": "7f99098d-be5a-4805-acf5-0af673133640", "comment": "Malware payload", "value": "9c8c7b5aa9a28bf8a28b5602854ed94e0f62f3b8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666664, "uuid": "656db2f1-f701-4895-99dc-cad382c3ab4a", "comment": "Malware payload", "value": "2c90d834e9c43bbb19a68153b4d1bdacaa44220ad08d31231c14775b14e28de6e99eacd4ae3e04a655bac886395cb288", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666664, "uuid": "b8ea2313-4ee0-4b02-8dd1-094ce593bcd4", "value": "T15501C2DEC416DB5041D5E4AE72DB52907811C3CB258A4BA4BFEC483D9BB96487019F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666664, "uuid": "f510f4c3-f4e0-4243-8f38-ad187b2eeebc", "value": "24:kXCKysE2hi0ziQvZohabybNMfFZ3ubM377h7:e9Qp+MsbMEFZYM377h7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666664, "uuid": "0ff318fa-7cad-477e-9aac-fafba6b18e17", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666664, "uuid": "500676d6-2482-4af5-a7ec-7a92fe1b4834", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666664, "uuid": "f42acb3c-f380-4368-811a-32f0825b18fe", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146afee2-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (MasonRAT)", "timestamp": 1780638466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638466, "uuid": "d79ba72b-0ce5-428e-93e4-ede2ed2c9541", "comment": "Malware payload (MasonRAT)", "value": "21a278e9cfa096bd4d316f0f57326cac", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638466, "uuid": "fc4986d1-9bcc-4c77-8766-01fc281f5e3d", "comment": "Malware payload (MasonRAT)", "value": "23ed51909e20f1e128aaf46cd8bc76f5c91488f80e9def6a101e0508a085629b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638466, "uuid": "ccf45483-0db7-4586-ae0e-f135c4d2a05b", "comment": "Malware payload (MasonRAT)", "value": "14680562b97f3d5af33b1bd2b171864268d34def", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638466, "uuid": "3f1d7a2e-53d0-481e-83ae-2e697c9452ac", "comment": "Malware payload (MasonRAT)", "value": "a8d8c42665f33d4f5a033c6948f7c4c1870fcbdf394b4d296b5e2750fe663d1271f434cf284cdd369801266205d4ce7f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638466, "uuid": "609a9213-777c-435e-9d55-0129affa0925", "value": "T19B44190AF75360EEC92BC13483ABA3337531BC5E5230AE2A9758CB753D52E505A7DE18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638466, "uuid": "1c728cdd-d8ad-443e-bdbf-65b86fe67eac", "value": "c8a12676a80634473c83e0bfeb54ef67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638466, "uuid": "def6928a-9db4-4be0-80fc-c5e284617433", "value": "3072:2h1F2OauXFl1JlYGrWLEUdllODk8BLxf2kh/u129/J1BInCn7rQfUnWthNkIg:Q/lauXFlOGrW5dbYtu1k8nCnmUnWfNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638466, "uuid": "34b2f66d-536c-42fa-a599-2e1e51c930ca", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638466, "uuid": "58ac70ed-3e3d-4d16-88ce-777ce571dada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638466, "uuid": "b98ad39f-ef4f-46ae-8b82-3ed124b8f7d0", "value": "svhost.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065b4f84-60f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780673662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673662, "uuid": "1e30935a-5df2-4b67-96c5-c39cc8ec8132", "comment": "Malware payload", "value": "1f09dd64fb0620294ce033b46a160d90", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673662, "uuid": "2325b963-5d6f-4e95-90b2-ec2b29bfada8", "comment": "Malware payload", "value": "2404f2c15054ca691eb182a293acfaccfdb99a0fd31b957d8178d3b109a8d7db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673662, "uuid": "1e2d01d8-1657-436f-8f37-56da43d1c513", "comment": "Malware payload", "value": "f745e61f48993b5ba19e71fc3cbf641c393d5722", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673662, "uuid": "69d20723-2735-48f0-b4c4-048f91b3dc94", "comment": "Malware payload", "value": "9e13cc6fd7fee34b27d8fedae952ec78d769b07cb41537782552853e129e0a2a2a366035e570457fefa6806738973cb2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673662, "uuid": "d923f306-7199-4130-887a-995154d851d6", "value": "T11BD2DF34C4D83FBDEE9A2A1C06FA6A20D7D68B1E9494860637477D9B4F37D80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673662, "uuid": "face31fc-cb21-48e2-8723-e76e5538f3fc", "value": "768:BumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Bu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780673662, "uuid": "f5948e11-d814-4280-89a2-49a6ebdfab9d", "value": 28668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780673662, "uuid": "ded0226e-5906-49d5-b176-61e504e4114f", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673662, "uuid": "b16eef7d-e040-445d-8780-c7fa8f264af8", "value": "23.94.110.24_1780673627809785_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59afc8d7-60f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780673372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673372, "uuid": "248625b3-4905-4504-9c3b-99ad00068a9a", "comment": "Malware payload", "value": "703a0d8eb3d318b6f66f9bccae0e45b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673372, "uuid": "d74633a3-a300-4a79-8a58-7a8409071a8f", "comment": "Malware payload", "value": "2435b536db8bbfb67656990f5bbcbd5167b21cb1ec7e407ae80dd405fd38bae8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673372, "uuid": "8d251a0c-b371-4ea3-b847-47eb26e605a9", "comment": "Malware payload", "value": "959d0c2681d89a8064c40d623da78be78b735ee2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673372, "uuid": "c8a40838-42f4-4c1b-8f69-e224d9feb725", "comment": "Malware payload", "value": "6b4c1df3c937c4bba548329e7581b2a41285161dcfcc082bc18dd7357db2576bc36e83b1d41c71c2698beb6b2677bc3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673372, "uuid": "b74ab0aa-557c-4217-9764-d709bfcb1779", "value": "T1C6E69C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673372, "uuid": "fcd6af4e-6c18-4664-9121-c73fb0cd0cac", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQU:cqYUQuVDt0TZEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780673372, "uuid": "7f5bdb3f-bf0c-4629-9747-b626703c9329", "value": 14614528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780673372, "uuid": "1a9e09ac-2e51-4025-bb47-93d950782cf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673372, "uuid": "c4a39785-4998-421b-895c-8ed9bb60f5e6", "value": "2435b536db8bbfb67656990f5bbcbd5167b21cb1ec7e407ae80dd405fd38bae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1ce786-6127-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780695923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780695923, "uuid": "6296ddb0-ec49-4d63-8249-b38b80fb7d49", "comment": "Malware payload", "value": "b8a2e80eebd21bb64a130ad1e0cc8d3a", "object_relation": "md5", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PolarWind", "colour": "#8605BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780695923, "uuid": "ef57e12a-c0cb-4641-96cc-9298e47a74c4", "comment": "Malware payload", "value": "248299e11acb39df716bd289b087adf9cdf400892c40d2f728e50d0c6d636478", "object_relation": "sha256", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PolarWind", "colour": "#8605BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780695923, "uuid": "f74ef4aa-729b-449f-8302-976b81e42639", "comment": "Malware payload", "value": "b40353a33a5faea9cd8618174b808e9b945ddd78", "object_relation": "sha1", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PolarWind", "colour": "#8605BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780695923, "uuid": "c31e7e18-e776-46eb-9b71-8c9ef49e13fc", "comment": "Malware payload", "value": "d9d0407edab5bdfb1a120c7bfb77b4bc5b66e29e39a1460f02f1618b65d231e5711090bfdcd5b6b3539b2408d8f62389", "object_relation": "sha3-384", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PolarWind", "colour": "#8605BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780695923, "uuid": "68160e4f-b729-4014-bede-ab1d02fab75a", "value": "T15177332671826637EADA1D32D02DCF246E3D6C682BD8D98B43A4B84D79303E705F571B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780695923, "uuid": "c5b9ddef-1d47-4d50-9011-31b69bebf75f", "value": "393216:y07bNJurc5z/r/gr72XZabhKEaEXM8MzdxfsLmmEzsBQM2n/nBAvE2RFM5qH/8LA:9BQA/Yr7RbhKEhgdxELmmEQz2/ik0Hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780695923, "uuid": "8dce329b-586d-4088-8473-577b994d8b6c", "value": 34590720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780695923, "uuid": "e6d7483f-dcff-427f-abdb-2f3c081ff24e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780695923, "uuid": "e93dd41a-f1dc-40b9-a654-a7f9b1f7e51a", "value": "ludashi7.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57af97ff-60a0-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780637720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637720, "uuid": "a3e2aa0b-982e-4cc0-b68c-dc2ac31a9220", "comment": "Malware payload (ACRStealer)", "value": "ecc073d7dc46e7ffad6c91eb83931ea7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637720, "uuid": "e573e787-497c-4f84-95c2-ffecbc8b040c", "comment": "Malware payload (ACRStealer)", "value": "24e18512188e3685c1a5909fbcab8f53691834b47b3ce05de527242c48f484fa", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637720, "uuid": "b1cfd7bb-9a11-4f99-9d22-5ac47480c0e6", "comment": "Malware payload (ACRStealer)", "value": "a0bb52731c96e8e3af8a3c1c9971f5221ba28c68", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637720, "uuid": "09dec9a5-68a8-40f9-b285-9dd2bfb520c1", "comment": "Malware payload (ACRStealer)", "value": "c7c889dccf4598969acce0fd4187c21d1d6724346155961ed552768fbc5b7f3f55c381c42d2cccb94718875b228b967f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637720, "uuid": "1bf95d5d-2850-4bbf-bfd9-734e188f0583", "value": "T133E5335F2282EFDBC6594C3AE643C8D27A37554208F6195B92CC168DB2DBAD1201C7BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637720, "uuid": "df486df4-c0b8-4d9d-ab55-61622a3bd816", "value": "6e7f829348e71343af0c881efbd58933", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637720, "uuid": "71e49a50-461e-4f52-aa08-c4cef7a86420", "value": "49152:ZMOoNdX7PlOtG1KbujY2p3RDL7DKvTT4XIjAhzBOtlVkD4lLzQKDPaW7naAd3OS:ZMzR7PYtzbujY2FRnyD0skD4h9VzfOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637720, "uuid": "6af2dd46-c8e9-47f5-8f87-9138a4cdf94b", "value": 3187200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637720, "uuid": "1837f5e4-d2b7-4b17-b0ef-a25a3458f266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637720, "uuid": "214d9f1b-290f-41b6-bb43-dbe22c3fb9e0", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e851a31d-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682201, "uuid": "ac4b4879-391d-4fa0-8b0d-76200a8755ce", "comment": "Malware payload (Cosmu)", "value": "5536f1ce178780ac8dce4f8dd5fb2175", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682201, "uuid": "e06a0cc6-3606-4b25-b815-40362f254f2a", "comment": "Malware payload (Cosmu)", "value": "269ec11c518ba90097b09faa26453473ad54da0c792603399dabf9ff64be9e75", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682201, "uuid": "50984b3f-ffb0-42c7-b9bf-7ddb95991eed", "comment": "Malware payload (Cosmu)", "value": "1186d9b91b07e50e4e009112fc74de3236290e3d", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682201, "uuid": "f66c7600-e4bb-415d-a3f3-2bb829e7ee86", "comment": "Malware payload (Cosmu)", "value": "075c4ec2dede8498cf1456201647481ef539c17f7b98b149abcae9ee2521ceed2d7f92c5bc68844b9354303bdceee715", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682201, "uuid": "d798b0ef-0953-4695-8c43-78c5b1a9244f", "value": "T1B05402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1FB13844BAA261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682201, "uuid": "48946f75-9c7e-47c4-9fb8-fe93dd77a61a", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682201, "uuid": "4096d028-bded-4335-8920-ef827f87b59a", "value": "6144:WFlKgzelZNQSBQGH/CSpWqT6oAXjiU4bzN:RfBQGH6SfOoAX+U49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682201, "uuid": "feecd528-d32e-4274-a320-9563469f35f3", "value": 290817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682201, "uuid": "4822f4b2-d52f-4a8e-be7d-bf71f99b71c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682201, "uuid": "3fa8125d-5c0b-4b4b-b8cc-4d25f0b78139", "value": "extcheck.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33769199-60df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780664718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664718, "uuid": "5893f85b-d7b3-48d9-bfe0-bbd7a0054b9d", "comment": "Malware payload (Mirai)", "value": "6960aa15ba4c65c302dad5b65203b10b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664718, "uuid": "ea3d1215-b374-46f7-9c11-0845d5617afe", "comment": "Malware payload (Mirai)", "value": "27b48a80ac41924c4c4a10a786191495afc1d9b83364800e250fbb9b125efe62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664718, "uuid": "01c504f0-56c7-4ec9-bbd2-9c00ced67790", "comment": "Malware payload (Mirai)", "value": "1351db4a3360ad7d12a0ce0b153ff1d3d1ad8d42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664718, "uuid": "092aa8d3-6eb6-4829-8488-8c77e90d23a6", "comment": "Malware payload (Mirai)", "value": "8378d4956f8209a11e7d514146ba68c167ca0f6e245f26fca57cd162910ea27a515f986cbd777fb32d6b3097eff6edc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664718, "uuid": "a98d05af-2485-446d-817e-c73d94178ad8", "value": "T18A735C2179352D2BC4C5647F21F74228B2F26B5A31F8C61A7D720E8EFF24A402657AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664718, "uuid": "668a2818-ecca-4283-b6c1-7279a70fe7e6", "value": "1536:5QwqHS7CkjeYr8ukMpZePb6H/zwX60glYY75jthHKMRi:5pqyrnrn6swXsYYVzHKUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780664718, "uuid": "6b54c03f-a100-4fcd-a3d3-3effc77fd5fd", "value": 76564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780664718, "uuid": "aab5969f-b1f8-49d9-904f-66a46b45d4bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664718, "uuid": "ce6e4a91-1e5e-44ad-8d9e-a400ca9b4d49", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deef2dc4-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682185, "uuid": "cc42828e-8fc6-4e3e-880c-28d29b21e6a6", "comment": "Malware payload (Cosmu)", "value": "2a8c788adb7b5cf48620ed2da5f2dcb2", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682185, "uuid": "9e7e664c-67ca-413e-8c8c-68e454364fef", "comment": "Malware payload (Cosmu)", "value": "27b61b57fe2e3ed64556f5eeb9d6a47b2de44f57ca08b4d2114845ce6ced688b", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682185, "uuid": "588b6be3-f0fe-4f47-8379-5fab39c7feee", "comment": "Malware payload (Cosmu)", "value": "5de22f48deebba58f77d91d558028971aac094e1", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682185, "uuid": "95d2cc3a-2d73-4381-82f3-614925aab1eb", "comment": "Malware payload (Cosmu)", "value": "8449b9e18fc7f86e0f833f3619ab859e43fd41273304df3964e504f5c02774b2f0f6f7614f276e1ceb4c9a7058ef9875", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682185, "uuid": "f90acd19-3d20-4a3d-8da1-8457d8ec5f45", "value": "T1046502457DA3D4B3D0414D3188E68BE18B7F6C137AA6E117FB9D0B4B1EB13844BAA361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682185, "uuid": "f7e79b64-80c3-493b-9291-9d32e16599a4", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682185, "uuid": "d202dad2-c03c-4c17-86d5-5ebd329360ab", "value": "6144:8FlKgzelZNQSBQGH/CSpWqTeoAXjiU4bz:bfBQGH6SfioAX+U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682185, "uuid": "495894a1-14f4-4fa8-8b4a-0f46c0c01099", "value": 1537242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682185, "uuid": "6504145b-7587-4edd-b8b6-56f2bc391f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682185, "uuid": "e26023b5-de15-41dc-abfd-b2cfc913e75d", "value": "AppVCleaner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3253837-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1780642249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642249, "uuid": "ab8c8c49-b8ff-40f0-9700-3ecbe424a8dc", "comment": "Malware payload (Smoke Loader)", "value": "11d6c13aa018de6b65a5a438d4c59401", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642249, "uuid": "4bd04c62-732d-4efb-9502-35df008afe10", "comment": "Malware payload (Smoke Loader)", "value": "28410173994ad00b06258e0beb932d48c069ef1f5dcee946166a000d9c9f162b", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642249, "uuid": "d623b14e-5466-423e-b172-cb2fd4295f14", "comment": "Malware payload (Smoke Loader)", "value": "65bd5f36148e4dce407b5f9f90f912f9289139fe", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642249, "uuid": "16e68131-e379-4e06-9309-30897a4ce5cc", "comment": "Malware payload (Smoke Loader)", "value": "0681cbab0f1f5ca5d3603fb0273258570c1c4ebb23ebde4694ad150d7518df7ca1f69b075c2f1e14a65d0164ce95daa2", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642249, "uuid": "1a38ded5-fb66-4e52-9d9f-dd93ac047547", "value": "T1E434296BC25330FCD553C07892662332AB73BA3847754EE70692D7358E61EC06E7BA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642249, "uuid": "91abe72c-e924-48ab-833f-ad55aca0dfb0", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642249, "uuid": "98fa2ea1-228d-440c-b544-592063699e65", "value": "3072:PMkiQ0Ti78ZGAttez2m7sKNqQNmTVm9he0xoyW3k0MnLwBsYC:BsG78sATmZbNmhQa3onsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642249, "uuid": "4e2c1636-3830-423f-bef5-b8da2d30762c", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642249, "uuid": "127d868d-5b02-4aa9-9b1f-bfcbe1d74e18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642249, "uuid": "ed8a9e04-7205-41dd-8b29-bc30d2f7c97c", "value": "28410173994ad00b06258e0beb932d48c069ef1f5dcee946166a000d9c9f162b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1f35cf-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649458, "uuid": "cc601774-1b2f-48d0-9513-85cff5e6b7eb", "comment": "Malware payload", "value": "89744712c7094aff287780885f8ab7bb", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649458, "uuid": "282139fa-e84b-4102-9f29-23a4cd989c10", "comment": "Malware payload", "value": "28af90423bc9d56d72ab1ac5ec9d6a2a1907be43da4345326a448156fc3ad2a2", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649458, "uuid": "b8efb80b-26d5-46f3-a697-260ec75afd25", "comment": "Malware payload", "value": "373111ba12b8f2178595d93669691c255c61a0ad", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649458, "uuid": "1260f7af-8907-4521-bac9-55992242ec36", "comment": "Malware payload", "value": "3caf72b73790ede46a7dc8d35d01377225df6400692ac585f0a0ddecb0174a31e9eec336726768c85816cf27957f1172", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649458, "uuid": "ce480c1b-320f-4f77-a4ca-2cd32f5f08fb", "value": "T18662D0414C8DDD33C686E53A1E70971EDCD50A4D586AA9C91238C2E0EEFE08E4D83364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649458, "uuid": "d85a8171-bdf3-4719-a677-48740375e9d6", "value": "384:eO9NfTJ31ezGyME1xqiul2cOlxozxwlN02bYlk8iKrK:ecRezG9Eul+lxIwX0QWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649458, "uuid": "9b1c2d0d-4158-4cc0-9795-961abadeee11", "value": 15755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649458, "uuid": "cae8cf56-9c80-4160-83a5-a2b8ea9037f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649458, "uuid": "249f250d-dd83-497e-bb5d-85f2f42c9dde", "value": "photo-391417999.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580b7681-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648458, "uuid": "27fc16e4-7ff3-4280-bc79-54a01fd64bb2", "comment": "Malware payload", "value": "3782e382211e9a3efe029ee56f610ab8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648458, "uuid": "53fec587-8629-4fd5-9b84-0c728d17f2a5", "comment": "Malware payload", "value": "28c6f763af625846bfc84bc4b0b8315d89f1d615be2d55d9412dddcf9afe124b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648458, "uuid": "d120c2c6-9a87-4122-bbc8-53e49a7eaa87", "comment": "Malware payload", "value": "633c5b8607129f8dc62aeab419c2a8e4872c349d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648458, "uuid": "69fd6639-3aec-4901-abae-e3ca8793ac4d", "comment": "Malware payload", "value": "548e55939b5cdab8d52d3adbdcc400b8028f551e8f10bbe84cbcbdd95f3553629f6b5ebc0e5edec61fdb917fd83f30d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648458, "uuid": "170ae336-9577-4487-a02e-658dad931d14", "value": "T121D2DF34C4D83FBDEEAA2A1C06FA6A20D7D68B1E9498860637477D9B4F37D80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648458, "uuid": "708c7e19-2c1c-462a-902a-8c9005071399", "value": "768:FumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Fu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648458, "uuid": "ea35b88d-7902-490c-b618-56560dbb270d", "value": 28665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648458, "uuid": "ae89acad-9bdf-461e-b717-8a1890fab936", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648458, "uuid": "576211fb-8e88-4db2-86f7-3fb63f33aa86", "value": "23.94.110.24_1780648383543704_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4250080-607f-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780623729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623729, "uuid": "8ae47162-0ef2-4f00-907f-2b2b28c7df0d", "comment": "Malware payload (Expiro)", "value": "2313403f047917394a9e203805e1e9f4", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623729, "uuid": "2b2cb806-d7df-428a-bd9b-29ed42b9be22", "comment": "Malware payload (Expiro)", "value": "29cd88ff320b8cb19526702008c8866d8463c26bf88e8b0d99a1981873d6f3b0", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623729, "uuid": "77862e08-642b-4d3c-9a94-067cc6652c7d", "comment": "Malware payload (Expiro)", "value": "d84be6e678f9f17dd73859ae96507d3d3c233afc", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623729, "uuid": "e5f2566c-3d75-4e50-bc85-a162d8abbb16", "comment": "Malware payload (Expiro)", "value": "acf87c51b75abb266ece60ebb353b568c2ea01ce2c0a635d5e9ea7e60ae4af7a741f63fe4272c50f667fd1fa62ea2590", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623729, "uuid": "d3824ae2-7242-43ff-8cc7-1d3e4faebe2e", "value": "T1B6566C2B2BE84095D07BD17DADBA8E42EAB278152B3156CB01D9813E0F37DF44DB9721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623729, "uuid": "8f9b6bcc-4942-453c-b8a8-89ab612a6f87", "value": "f11d17d3317eed4af786ea2b9a430353", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623729, "uuid": "89343833-28b4-4fed-a005-f11bf24e3d6e", "value": "49152:4AiH2ey/7sS63MNclj4Lyije9QdAoFbzi8pbrGj0+m6a0L7Fv2FjV+fmKtgEF3ph:cn3sK772hgvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623729, "uuid": "37ad02b7-744a-4f82-9846-df04c067581f", "value": 6173608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623729, "uuid": "050ae012-e9dc-43de-bad5-1fa1471faa66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623729, "uuid": "bbd25d79-6f65-4bf0-9f4f-32ef4de71775", "value": "29cd88ff320b8cb19526702008c8866d8463c26bf88e8b0d99a1981873d6f3b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc215b9-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780642505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642505, "uuid": "e1e08319-03e2-46d8-97dd-180ac6617a47", "comment": "Malware payload (AgentTesla)", "value": "22eefb0e3abf81388f58ea50918815ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642505, "uuid": "5cd8b7d9-3af3-4b3d-bf5c-1b336a327459", "comment": "Malware payload (AgentTesla)", "value": "2ad3a8fcfcfc3540bc93bbd08eb3559f6988b67047eea996509dc1bdedb0e14f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642505, "uuid": "41c0d369-63a4-4631-aab3-11e7752725fc", "comment": "Malware payload (AgentTesla)", "value": "7a5f1c42747a58c19a701f8c3070e18c74af79c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642505, "uuid": "4aa9f62a-2eba-40b5-ad20-1a58d15df3bd", "comment": "Malware payload (AgentTesla)", "value": "7fb7b58e0a03f419f3ca1c927aedf5c83e634bf141d5a8950f6019dba3c1b7d39a77f7fe22d379ba4e40c58f9bcf9a76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642505, "uuid": "60148a79-c25d-42ed-bf71-a1f288d6ea09", "value": "T144D423966B70C89FEFA32672DC7A992A97F43A5149E1021723112F4FAC653D0ED3C364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642505, "uuid": "551b2c71-3e66-4b40-950b-5c9b14652290", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642505, "uuid": "a9fc710c-e2a3-4789-b02b-a95f7cc44821", "value": "12288:slnnfit2cwQ9HzYSlzIOO3GyTo1nsgOhV9q9MQ0Qk3aY+/cRC:4nnfit2c3vXO3csHXQjY+/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642505, "uuid": "9c7e7a9e-ad89-4691-b663-446a11bb2573", "value": 651936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642505, "uuid": "69d15849-d778-428c-936e-e480b8000591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642505, "uuid": "d241ddbc-1777-40cd-be3b-6ca589f21645", "value": "order9696070797-79978600111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40fc33c-60f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780674785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674785, "uuid": "13586202-5532-4894-9b7e-a995798ef9b0", "comment": "Malware payload", "value": "473c65b922d3308a98c6b76c7d99a196", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674785, "uuid": "3046328a-3a6d-4f74-9d46-2c03dcedda01", "comment": "Malware payload", "value": "2add9429d2822ae0c01c08bbd66c3a110ef2e9c3a00cded1477657e9024e391e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674785, "uuid": "a1e47701-d351-4de4-8606-53e49d3e7088", "comment": "Malware payload", "value": "d8d789af0ede2ce38a50b516f7603376589ae141", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674785, "uuid": "970c332c-ad5f-471f-b738-6ede37749ec1", "comment": "Malware payload", "value": "929c8953b302d58e46d3a5000e8fbbefbdfafb955074e9175175983b1381806f11834556f2db60890297d4b5309985ee", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780674785, "uuid": "f1bd35fc-24c1-4c7e-811f-a0a33944dd2f", "value": "T1CD0523377734D211E1EF821D35F04F70D95949BA48AC61A8340A2D65AFA3FEB2055F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780674785, "uuid": "d07379af-9be2-4234-88b6-2cea7243e8db", "value": "24576:YQ94THFClJLWjLK24pc9BBb5SpRuWH7UCjQN/O:RiHMlNgGu/WRTjQN/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780674785, "uuid": "4dea4d85-4dc7-4686-beb6-1dcd00058f9d", "value": 828496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780674785, "uuid": "1f1feb90-7637-4cf6-a054-4a63a175ce02", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780674785, "uuid": "8bffbfe8-aa52-4f55-bcda-4d628e50eb11", "value": "\u041f\u043e\u0432\u0456\u0434\u043e\u043c\u043b\u0435\u043d\u043d\u044f 4908-451.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1207db10-60a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780640610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640610, "uuid": "ea537c27-d09a-4447-9615-775d5dc15e57", "comment": "Malware payload (Mirai)", "value": "aaad160e1410df61c44598d951190e28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640610, "uuid": "c26f5d7e-bd54-4149-9791-d29d55128b54", "comment": "Malware payload (Mirai)", "value": "2aefed7aa3005f5c7e7bf72a84cff46bd011d230385a4e4796b87896dcd797f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640610, "uuid": "b001788f-12d4-4e95-a5e0-eb6c0810c7cc", "comment": "Malware payload (Mirai)", "value": "6ada28c02d4b1cdc0b3e111b385a7c1b2827d1c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640610, "uuid": "eff9ea34-4649-4372-bd4c-bb8b0022af45", "comment": "Malware payload (Mirai)", "value": "3ffb5d4944a3242e1501caf525ab1f0edd803be04b77b2505dbb61805e8f2dca044935a6d5cd6b5282b650d485afa99c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640610, "uuid": "49dd8cad-951b-4288-8370-538c75f3655c", "value": "T1A4C3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640610, "uuid": "70eb282f-c6ee-423e-b344-3a3142ae9f11", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3Y0j:IaOulLUUogcQ9BvMEWSWC2h3Y0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780640610, "uuid": "23f724e1-9f5b-4794-8305-cae41b3f63ab", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780640610, "uuid": "cc13cef9-82fe-416f-a879-c72d7dff3412", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640610, "uuid": "b2c01576-aea4-42f9-bd3b-de2445723e9a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dd22fa-60b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780644837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644837, "uuid": "04bb532e-12db-415c-a845-df4d851e4d2f", "comment": "Malware payload", "value": "476a38987b9e9c39d7f567b4b99cd598", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644837, "uuid": "77b8872e-cad9-421c-9ca5-18daacd51ad0", "comment": "Malware payload", "value": "2e2ee193c322ad694600f31af19e5eeca1233bc284a8174d7ed0adaca37890b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644837, "uuid": "45034f4b-4c16-41f6-9b10-c8fca08e486c", "comment": "Malware payload", "value": "d397ca236de7613e275bf0a55380ed72139c36ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644837, "uuid": "cc4cbaed-7a59-4798-b5a9-ad85fb4583ca", "comment": "Malware payload", "value": "5151acbc7e30eddaf98d5ba3bf0183555448b144971ee261c73412577801e40bddd1fe5a610f694cbad7ad246452cd3a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644837, "uuid": "d14c5bdb-7c23-4a97-ab16-d1549c51a2c3", "value": "T16205D53DCC55012EE132D929C5A6049FA8936607633CE81B20CF775BAF63886B79739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644837, "uuid": "9b39ee7f-feef-4ffb-8444-5e260c41e653", "value": "3072:lCQoJ7+7WBc5PpoVmB57yNTw6ZJf+6e9htxwehByFs8rZnYvp1mH5HYhUWH7tbTW:rkcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780644837, "uuid": "ead51f69-f1aa-456d-8b0a-d7178c8e4730", "value": 803766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780644837, "uuid": "1128d090-fa82-43a9-b710-8d640f82ec14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644837, "uuid": "66378abd-e60d-4329-bf4a-876e2cc1f897", "value": "Quotation for Industrial Engineering Services-8765234567887_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e56181-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642782, "uuid": "668031a0-4701-4fab-8844-59c74c902e44", "comment": "Malware payload (RemusStealer)", "value": "3f3c40e6cd10bb385464d8601df30060", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642782, "uuid": "645acd87-1246-451a-9964-531ffd11fbe4", "comment": "Malware payload (RemusStealer)", "value": "2e842eab0c16ddd1a2ec4a56610adb58d115b65a1e08e9b67e7e375f8eed0873", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642782, "uuid": "e9344ea1-e0cd-417d-ad94-0bbeb486040c", "comment": "Malware payload (RemusStealer)", "value": "58761f5bddb95bd8f91340e995cf42322d47cf30", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642782, "uuid": "a687aa2c-5bb0-46a9-91d0-42bb01954ead", "comment": "Malware payload (RemusStealer)", "value": "f6cffeefc2dbe82ee5fbd9b5bdc1dbe5027d9f3554c0a7388757e3a264b0dc659ad56553b368519f515020e8628c2d6a", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642782, "uuid": "ca82773e-b810-4839-a4df-29394fcd9831", "value": "T18324186BC16331FCE553C07883666232BB32B63C47749EFB02A2D7309E619D05E79969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642782, "uuid": "016b8ef2-97ef-4b37-8338-eecec89db289", "value": "20c08c2c4fbe56b4d08586185a84e7e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642782, "uuid": "8dd6c94b-755d-499b-9483-51eaecb9a984", "value": "3072:+uasQyBVshtd+fOUIA1qwMpfUkwMU86O6iy5JuRw1pdvbH:+SDs7BlDUkwmn6iy5JTdvbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642782, "uuid": "a1e92210-e0ee-486a-998f-ecc8f2019e12", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642782, "uuid": "475c6432-b1cf-47a3-a9e4-0b7924c76590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642782, "uuid": "4fa979d1-5e78-4216-8e06-5ecae41134c9", "value": "2e842eab0c16ddd1a2ec4a56610adb58d115b65a1e08e9b67e7e375f8eed0873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f3726c-60c7-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1780654436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780654436, "uuid": "8849e361-5976-4177-96df-1406de064b94", "comment": "Malware payload (Berbew)", "value": "283b77f45a1f492b8612640220c45add", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780654436, "uuid": "39119133-0c51-4e8b-b925-b11b5e4e7bcb", "comment": "Malware payload (Berbew)", "value": "2e8905f8f76ba88b8a04981889f9daae7341166b8f0526ab331c5b9a9cba719c", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780654436, "uuid": "4c580c18-4d7e-4f62-8530-d4d5e47f3a21", "comment": "Malware payload (Berbew)", "value": "226966b92642446c744174ef12c5842aa4c57d61", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780654436, "uuid": "83e54faa-837f-41b3-a4ea-9348aad05f34", "comment": "Malware payload (Berbew)", "value": "491847545a2280de606d19aae20c1896b6f54f62b806feef92feabf749ba7eb4b49981446d3be724cfcd32de9c7b2abb", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780654436, "uuid": "5034238a-eff7-4707-aa2c-7333953e57c1", "value": "T127535ABF10F50E96E048317B147F26BBC263D2E953B7914A33DCDD4C82A35A2E6656D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780654436, "uuid": "60c6b515-8645-4536-babb-c109cdfaf2a9", "value": "2fab100e73dccce3c372ff3389e461b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780654436, "uuid": "b2105570-d832-4f7d-86b4-4e86dc142306", "value": "1536:D2AnXVHogQ5iIb0/Mb5uluNSzYB86l1rU:FnFHogKiIYI1N8YB86l1rU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780654436, "uuid": "5a3e0b85-d9cf-4a38-9f70-29cae3db1983", "value": 61965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780654436, "uuid": "25ff2ae9-17c4-4407-99cc-77e6e29993e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780654436, "uuid": "b5b0f9f6-e759-4bc7-a9a0-f2b2d446ec8f", "value": "2e8905f8f76ba88b8a04981889f9daae7341166b8f0526ab331c5b9a9cba719c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2dff983-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682219, "uuid": "3f1c02dc-3aa1-4250-ac40-fcc83c6716bf", "comment": "Malware payload (Cosmu)", "value": "2b4715961c5e14d38ab2d8401700bb35", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682219, "uuid": "c4b25b7f-84ea-4f4a-87fc-172e1596caac", "comment": "Malware payload (Cosmu)", "value": "2f943746497982349460d2ce8b9c952ddab0dce3435d8981fa4eda5f657f81e3", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682219, "uuid": "2affc357-ca06-4cf0-b17b-57d962bfee65", "comment": "Malware payload (Cosmu)", "value": "729607a8795cb37022b18e51bb7297f77daedf7e", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682219, "uuid": "d2d83106-458c-49ad-9e67-c3002cfd9a72", "comment": "Malware payload (Cosmu)", "value": "fba32d680ab14aed0b93d2b7ad1ff4babad7f1734c5415cac590d1eaff1cc3a1fd7c5c62bcc43ad4be4ee0d6e9e3f949", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682219, "uuid": "cf057c9b-42f9-46ff-b7ad-36ba6c0178f6", "value": "T15E75AEB27B93C26BD4EBC23DB5848557A7F29B024D5392A397A0DE3DCA391814DDCC42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682219, "uuid": "31054802-5ff0-423c-8b2f-338aa3eb9557", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682219, "uuid": "983b6566-0896-4d23-8400-d0d210a65531", "value": "6144:19lKgzelZNQSBQGH/CSpWqTPueF/mNyB:OfBQGH6SfKCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682219, "uuid": "5e806f62-db73-4339-9272-abc12fa16764", "value": 1552240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682219, "uuid": "d380ac37-3cc7-4817-961b-713c54058b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682219, "uuid": "570c70df-e852-4eee-9f6e-62453728beb2", "value": "node.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e46828d-60ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780643207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643207, "uuid": "cf009faa-7843-4076-a76d-31ba72678423", "comment": "Malware payload", "value": "ba6a49064ecca58837bce2be40455cbd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643207, "uuid": "2b5860de-23d3-483f-a876-d6e97f01052d", "comment": "Malware payload", "value": "2fc3ea1b8e6b5936ba7a3c2dd423d3476878e6611c586e9900c11703865d9a16", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643207, "uuid": "38100c3c-3e66-4d68-9b3e-272b587ce8be", "comment": "Malware payload", "value": "362b4f5bdb393366c24a3fe2960469b46d58152e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643207, "uuid": "7394b226-13e7-4ba6-8079-29208c1e8405", "comment": "Malware payload", "value": "d966bc9da00ad4a8b1a0d2f2c713270809b531665f38610d2cf5198d5f2c78a42e7cd20828c79bb2d99e364f5e35695a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643207, "uuid": "ad2ab5c9-3ef4-4df0-9001-da7edf0b7347", "value": "T15905D53DCA14422FE972D518C899455FF8C16597222CEA4790CA7F1FAE7388673C329E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643207, "uuid": "0f5915d9-140b-418f-9710-0b0f96c61275", "value": "3072:aRqS2V37CY23ErpyTf563zpivctiun3ca/Nqznc5lWDJ/m4y0qfYbW96aBNNpNb3:IyeY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643207, "uuid": "bc024786-f6c5-4e1d-b2aa-3cb9690d35ff", "value": 836060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643207, "uuid": "0d7787ac-8bca-42a8-9678-fd7c84f060b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643207, "uuid": "c0c2df21-cbe4-4f64-90de-e8eb31ccad94", "value": "Quotation for Order SQ1372707.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ce0941-60e4-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780666782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666782, "uuid": "3f5e50bb-0642-43c9-b2ae-3c2ff418d2c5", "comment": "Malware payload (ConnectWise)", "value": "dd2921d9ebc08f5f8aaede061b773fed", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666782, "uuid": "0e074ae6-260f-40f9-a522-7de0586595bf", "comment": "Malware payload (ConnectWise)", "value": "3012b1f9fcf06070ee922552cd19ac3804f151dae55ebad93afec9764c6e7acf", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666782, "uuid": "79764484-f3fe-4c68-8f6c-a72780ac8cda", "comment": "Malware payload (ConnectWise)", "value": "31f2615831d29c83892b989c52cf227966931065", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666782, "uuid": "257e18f7-74f7-4df1-ab21-71adfaa43d2f", "comment": "Malware payload (ConnectWise)", "value": "9ddffaf3251009f7852cff0f9574854bc2326d3afff6da58d21515a453772050f0568868e7b057958696b6dc3d959288", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666782, "uuid": "41bddcc3-833b-45f6-a633-b5521ccd3f09", "value": "T168836C43B5D18876E9720E3118B1D9B4593FBE110E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666782, "uuid": "5f0c1e3a-fa02-4333-bd0f-88e04c210906", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666782, "uuid": "dfd2167b-3e4b-4159-9aff-f3bf65730645", "value": "1536:6xoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYT77Ju:IenkyfPAwiMq0RqRfbaWZJYYTxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666782, "uuid": "1d9a79b3-dfcb-4b2b-98fc-0e1672396859", "value": 83184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666782, "uuid": "935f39e8-1852-4132-8d45-fa515f8c43a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666782, "uuid": "9521f229-36c3-4fe2-a4c4-5dcec77e4b72", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf5dc5a-60db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780663338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780663338, "uuid": "2e7988e1-296a-42ea-94ad-f8b54dbafebd", "comment": "Malware payload", "value": "b3225d5d352d143195d87da2f841dfc7", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780663338, "uuid": "f91116d5-f7b6-43f0-aa34-79d1950997fc", "comment": "Malware payload", "value": "303c3f9eb4958549291bd121b558c0a66af7a7ed9d535745a5dfdfbfe9dc2f1a", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780663338, "uuid": "cc86d20b-f234-4838-b023-460a5d821fdd", "comment": "Malware payload", "value": "9ef67e4bf986863146467cdbb203744f807c2623", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780663338, "uuid": "fb6ca38b-554b-4a48-bf15-be94b46f970c", "comment": "Malware payload", "value": "91af1c609e3ec124fa7977189f9ee4dbf590294df54958ba1a0a90eb067f749df4de8e8d810ad789f8a80ba2e2f5b257", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780663338, "uuid": "0f12bc2e-26d7-43ed-b7f7-c8ffc1e4c441", "value": "T189E402AB73C15F62CA992BB2C4E3863003F5E4973273EB59298113DA5D433E4DE59B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780663338, "uuid": "904fbc1d-5a18-4b0f-b8f4-940218c6fa95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780663338, "uuid": "ff8cf16d-24a8-4180-b3da-a0130bfb192f", "value": "12288:1JVt1918SuzpvriS0bhWTL6TpwU4AuwTT9LRPpE0mWvLEFjFfEHLTg0j1b0lhruB:1JVvwzpM0TwrFpE0TvoFjFf10BEre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780663338, "uuid": "9610c64a-d402-4dd2-bdf3-141daa72171e", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780663338, "uuid": "cdcf3fa6-f5f7-4c92-b2b3-e0f7e345d935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780663338, "uuid": "63632432-f589-482e-a24d-726d7cd07403", "value": "303c3f9eb4958549291bd121b558c0a66af7a7ed9d535745a5dfdfbfe9dc2f1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f993dd-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642138, "uuid": "3f6792f3-6854-44a4-95c1-d6c666174fa7", "comment": "Malware payload (RemusStealer)", "value": "fe5f7495b119363048b9700bdde2ff2d", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642138, "uuid": "d5a006a8-4de8-48c6-b0c2-3bb596ecfeca", "comment": "Malware payload (RemusStealer)", "value": "309897cd3c081cb1901b8be1671b1548f8a433aebf83bef02b7fac15ae8c311a", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642138, "uuid": "a0dcc781-3b0b-4521-85e9-22f5897bd5b0", "comment": "Malware payload (RemusStealer)", "value": "a742d8ae10a8ff36f43679cf620feab24f5a9535", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642138, "uuid": "08463f46-6e77-4988-bdaa-6022fb50ffad", "comment": "Malware payload (RemusStealer)", "value": "cf0a10847040e2afacf1b22b240f2f2becfacc4336dc18f37b2ce15221aaff3fc3bb51c0cb85cbcb1e688b4a6a654126", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642138, "uuid": "29c3c270-5bf5-4df2-bfa9-aaa099a03b9a", "value": "T120242A2BD29330FCD552C078526A7232BB72B63D47709EFB02C2C7359E61AD09E79664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642138, "uuid": "e155770e-b09b-4de2-bf1b-8d7ce52f3497", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642138, "uuid": "dc52e26d-0e84-488f-882e-2f622a5a892b", "value": "3072:wFoWC5C9nJvzUL6p8Y74iRzfioaJ/GQPvlzP4BQOGAbHQQdWFvv:XWEC5zQ8DVa9Jnl7PAjQQdWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642138, "uuid": "eebae254-24e8-4e91-a5af-4e536af0ceb6", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642138, "uuid": "14ac465a-ce32-4aed-ab0a-1400955ae131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642138, "uuid": "9811454a-1e96-43a9-a80e-38ac25af7c05", "value": "309897cd3c081cb1901b8be1671b1548f8a433aebf83bef02b7fac15ae8c311a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9c9e47-60f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780673647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673647, "uuid": "22848446-1851-49d5-b4b2-43d032e6f2bf", "comment": "Malware payload", "value": "9c39f7d32f2ee43930036f9f8e3f3b74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673647, "uuid": "98143401-a2c6-4df8-9faa-2552abd0bc48", "comment": "Malware payload", "value": "3134340c3f9d5d4e821a8d23332c21ce71d82f2f23834720b187cbdbdf29c6a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673647, "uuid": "ab52d06e-9f25-4d47-a7ba-cb75e2e3ba63", "comment": "Malware payload", "value": "998dd53777584412f7d560dc42a90814eb3062c3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673647, "uuid": "ac28bfda-0b9e-46ad-a0a6-8e29777fd4ce", "comment": "Malware payload", "value": "5a4e807cfd53864b08c733399fdf86c557b1b5e5fef53da99e99c634ac7a69abc3d73f909c1278ff22c745ee510ff1f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673647, "uuid": "6df839fa-7821-4ff1-b248-60a2e647d06f", "value": "T121D2D034D4C82FBDEE9A2A1C06FA6620D7D68B1E9494860737477D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673647, "uuid": "d54cc3a6-204b-4529-bac8-9abed4feaf16", "value": "768:bumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:bu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780673647, "uuid": "cb3b07c9-576c-439b-8392-b55f75e4e1b0", "value": 28650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780673647, "uuid": "d735e813-6d64-4bf7-a60a-f834dd06cea1", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673647, "uuid": "5b5edada-2b9a-4648-87c5-b56bd73f375c", "value": "23.94.110.24_1780673621088941_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71116c8a-6115-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780688014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688014, "uuid": "4a3ac398-0efe-4430-878e-2db1ee8126be", "comment": "Malware payload (Mirai)", "value": "4b42cb13a36244e93e2337a4a8fc6629", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688014, "uuid": "85f27510-7fe3-4738-b6c0-8a26a79aee47", "comment": "Malware payload (Mirai)", "value": "31513e3d9edc69076a0b8cf474e1d2bb47e883fb113b44f551e54219eb20dfd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688014, "uuid": "06f66f7e-63a4-43d5-b7c9-2d930ee69c43", "comment": "Malware payload (Mirai)", "value": "0e2d3fbe426d1a3a0ea8ba6b62ef8f12c66f0004", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688014, "uuid": "3849eee4-a03d-4d01-bdaa-dc9c4864d0c5", "comment": "Malware payload (Mirai)", "value": "15d79189109f3566d7084319d927e9998fd987ad786c0bcbd2a006f944bdb83ec188d96c236ead17ad14af849018d464", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688014, "uuid": "27a1b9aa-327e-4828-b92c-f1fce289f24d", "value": "T152730645FC819E01D4D822BEFA6E118D33A357A9E3EEB112DE115B2433CA91B0F77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688014, "uuid": "7feae320-aea2-4f05-8ac6-9ca7112cd499", "value": "1536:LpnTwP+ZcdMa/ukw9+9AkBiCafw+cWHgaoLmpMguHcUzVUHalw7W7uH0JsfCZCVr:CPzMQux9iAoidfvcyoLmpMguHcUzVUHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780688014, "uuid": "acc2d8db-d123-4013-a6d7-e3833076ec1c", "value": 80132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780688014, "uuid": "1470d159-febb-4654-aa71-bc800d0d9b21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688014, "uuid": "3776dddf-74d5-48d5-9dbb-b8760ffd9226", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876ff154-6115-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780688051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688051, "uuid": "61642124-acf8-4b83-a260-b3ea5f974298", "comment": "Malware payload (Mirai)", "value": "790e146cce1dd334d6970a05706cd441", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688051, "uuid": "799b830e-cd7e-456e-aa16-cbf19e03e64b", "comment": "Malware payload (Mirai)", "value": "31a7a8549d00eb014a24c8e48ce45e6a74d385bc8004b311ba856007c8f1d5c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688051, "uuid": "24901645-9323-4fb0-9e91-8dfe0667c41b", "comment": "Malware payload (Mirai)", "value": "8d7caec5517ea4556516d255d84932560d93fb42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688051, "uuid": "a91b7d83-f640-4ed7-92b6-d3d3cbfa5698", "comment": "Malware payload (Mirai)", "value": "e7470dd06d6db0984290e10782fc54542b831709bda8ff7ac9eb0034ce48a8b8e1d30c43a02436fd14677e327392684d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688051, "uuid": "d6b52399-1c41-4973-b96a-694144ae51f8", "value": "T1B4140906AF510FFBD86FDD7302EA0A0134CCA81726A53B757674D924F64A98B09E3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688051, "uuid": "15598271-34a9-4c64-8f7a-7a848a86f770", "value": "3072:gqDHvsiIFV4TKfrYBieO0Z3J9IEGQElC47S0:gqjvduVsVlZ3JYZlC47t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780688051, "uuid": "f5792140-2eeb-4290-95ec-9da270f57a24", "value": 202928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780688051, "uuid": "ad435581-acba-44d9-a472-f23a81d87832", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688051, "uuid": "2372492e-15ef-4b1a-99d9-88e3beb5afc4", "value": "nova.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0ff17f-60f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780674106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674106, "uuid": "9cf8cf00-02fb-41a7-8003-9234469c28d3", "comment": "Malware payload", "value": "e2e7885177bc5bda2cd18ba30181c707", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674106, "uuid": "47dcafe2-5afc-4c82-a41c-5e25b8804985", "comment": "Malware payload", "value": "31e0bbfc36fd9497dc406c119bfab7a6c13133c4710044c35557f1938020bc35", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674106, "uuid": "2d8b390d-c860-4462-b152-84a8b6886f1e", "comment": "Malware payload", "value": "ecd7ead9422043d0ffc7b467a8c4e13d1fa68ffe", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674106, "uuid": "10e678c5-2862-4ee9-b4fb-5dd4a958617f", "comment": "Malware payload", "value": "37850be8b6a1f65b5442ba719d641a5f48b917c951ab3e7164f64bc3b13ede89e64491b046c6c2fa5f29c2c4edff2f02", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780674106, "uuid": "6266ddb7-50bb-4b70-8288-64008b15bdbe", "value": "T19B535C9EE7321F32CCC8C2F95B2167AFD501897D1237E8511D2CD609833B978F8A6A24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780674106, "uuid": "37953d83-4e2a-416b-92e9-b673bdd7844d", "value": "3f31a7866f74667f87832eb6a3bec06d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780674106, "uuid": "1cece977-fc55-433f-a6a2-5b7889ec31b3", "value": "768:+wCaAA1mS1dDQOaw1SHbPn1CzlPuEcKE9puXojCoDE9qS00GsgVGHeCMVq/1H5tG:+1axo7NCFuEsuXtqnWKGHLAot1cgCe8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780674106, "uuid": "7f9d1f89-2432-4bbd-a878-a17e3ccd96ce", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780674106, "uuid": "1d76924a-4305-4936-a0a9-85260bce03b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780674106, "uuid": "83c5a234-2a4a-4fdb-a3bd-a0fc1e0407ca", "value": "31e0bbfc36fd9497dc406c119bfab7a6c13133c4710044c35557f1938020bc35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ce342c-6101-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780679450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780679450, "uuid": "174c3f85-3a2b-4d88-a12a-cd41765480de", "comment": "Malware payload", "value": "29b3be6fcd6256991100ad8f42578f49", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780679450, "uuid": "2d301ac2-4e7c-4e81-a109-52159b8e5f4d", "comment": "Malware payload", "value": "328e0c70f0471edaa9e705719a3f52eb4ad537b3f3926a1189776ec3fc6a8e93", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780679450, "uuid": "e1f62089-8f8b-4a1d-be72-215f576188e2", "comment": "Malware payload", "value": "80e663b37c247617938957fab9e6950ce6c75c6a", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780679450, "uuid": "1c6bfd98-c1a5-4fa9-ac7e-34b7d3289f20", "comment": "Malware payload", "value": "2bf9f84f30108ff5f53073bad07c16fa7ea699e615dbd6f3556fa0ab6cc55a97d50271d992e38b790a9d38580447890b", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780679450, "uuid": "424f48fb-604e-4147-989d-6f8d553c89fc", "value": "T1FB735A9FA7B72FA2CCCC42B136736491A63680AC21BB80853466CF9C537765C95B72C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780679450, "uuid": "01bd926b-4651-4de7-a1b4-6ee847ca3cc1", "value": "d864d432c435ff40afe711bee7daedce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780679450, "uuid": "455a429f-f7d5-439f-b21a-346adad3675a", "value": "1536:rxj/5za2dpvMpUghkYXY9EGVl3iE6yf5oAnqDM+4yyF:VjZa2lkgl3iECuq4cyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780679450, "uuid": "6a27ac12-1c1e-43bb-9071-48bc75ee955d", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780679450, "uuid": "2e9374b5-8481-4e5c-82df-e269cdab097a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780679450, "uuid": "6a4b7496-7c95-4ed4-b694-06baea5bca4a", "value": "328e0c70f0471edaa9e705719a3f52eb4ad537b3f3926a1189776ec3fc6a8e93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d605c6-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681984, "uuid": "26ecb7fb-3271-49b8-8b07-0a126b967bba", "comment": "Malware payload (Cosmu)", "value": "e04e85d0dd7fb6f41eff4cf998d9c23b", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681984, "uuid": "1d995354-2808-4511-a6e0-dcce4f098f08", "comment": "Malware payload (Cosmu)", "value": "32904403dfcb493b86aad6a17b7b2cf7bdd9ce5f9922461e285c1c14f4c42a27", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681984, "uuid": "9c9f99dc-06a0-4b9c-bb7e-11b23b8a46c7", "comment": "Malware payload (Cosmu)", "value": "f605404958895ce5f644283ca51e999984bcdc61", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681984, "uuid": "8de45dff-5620-485d-adb3-9bcd4a6abafb", "comment": "Malware payload (Cosmu)", "value": "5a87c3519c9c178451ad9d1e062a624256843d166d046f0e943e2d5bdc0afb4bc6b3a9e803553b46c77754ee2853f603", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681984, "uuid": "d30ad10f-8661-4eec-9069-c3679dc1b6c3", "value": "T11D65F1217993D773D181C83198A68B80C77BBC1796B68123BBA83E975F752DC4B73242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681984, "uuid": "331c0900-83d4-45a3-a95b-f729683c0d74", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681984, "uuid": "28341409-f437-45e0-98e5-86588fe6f5fc", "value": "3072:4QXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB/aUkLKX:B9lKgzelZNQSBQGH/CSpWqTpaXKv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681984, "uuid": "cda9af1f-18ce-4964-9b70-65ed08270b05", "value": 1548454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681984, "uuid": "7d9ad332-6421-49b2-8744-a58a6b1bcc9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681984, "uuid": "f5ea4471-86c9-4c29-a5f6-c894a29d8002", "value": "AppVShNotify.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6690c8b8-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780636886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636886, "uuid": "9ca42215-6076-4535-8646-b622da343d39", "comment": "Malware payload (Mirai)", "value": "8934c1c1fda1fe3685148d8325173ad4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636886, "uuid": "8197d16f-0868-4fc1-a271-49356d70b4d2", "comment": "Malware payload (Mirai)", "value": "3352f2ce5764e2875177af4eeb54c2fb92072326ee84e9ee65de86738f73824d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636886, "uuid": "86584151-1e79-4b35-ac52-e433d090dbd2", "comment": "Malware payload (Mirai)", "value": "5a0d023ec8245476158e2bf4b8a3e1ce5a054bd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636886, "uuid": "6df6ba57-f6ac-4f31-b9b9-1fdb84429ffe", "comment": "Malware payload (Mirai)", "value": "9553daa6d10d5cb71d47f36bc136b7ca3afcd92772908cf19043ad22da2947df6b7970b88331b313d526b63e6b3ce197", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636886, "uuid": "e2859e1a-d5f5-4bee-9b40-a7ba4e782526", "value": "T1F5B33A02B70D0F43D1132CF02B7B1BE1879EFDA519F9A584A11DBECA5275DB22182ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636886, "uuid": "aec1c8bb-f4fb-48fc-aa37-8f5b528bead1", "value": "1536:X5yHsXrxIPB2K30vmYMDGU1MCORjtWNCb+p5W45UctNiAhcARhHIHNyGM7x5yzSL:X54s7xa1YqWQCiL1/hcARhoHeWTez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636886, "uuid": "c8a678e5-5aae-476c-bc90-498d351f8490", "value": 116820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636886, "uuid": "abc39d5e-d450-4cd4-b315-8a743ab431b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636886, "uuid": "f42b2116-7a10-4d8e-850c-79b1371d055d", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042030b4-6105-11f1-a769-42010a9c0008", "comment": "Malware payload (Koceg)", "timestamp": 1780680959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680959, "uuid": "7eebd852-fddd-4324-9ace-aca06d74cc4b", "comment": "Malware payload (Koceg)", "value": "5030167ae8970abfa353c96794cc9e78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680959, "uuid": "7cebb41c-d968-4fb0-8bea-181e94c5a695", "comment": "Malware payload (Koceg)", "value": "339f1b62b45f958c9fc252ee158ecdcc1db7db6039977a5ce0a3b310571a9418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680959, "uuid": "8e07caa6-3a81-4319-bd8d-828300dabe12", "comment": "Malware payload (Koceg)", "value": "1a0508db44803e21f2a95e81c35bdab8746b407c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680959, "uuid": "73c8f4b1-8062-420e-9e23-a37709a4e03a", "comment": "Malware payload (Koceg)", "value": "22ff0aa38596393c830e67434b3f03a7fa7bc86b9ec35485e52ed2312f8d3e0b36acf0f38d7e0c4c836ca14bd9d8c4ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680959, "uuid": "0d31b08e-5cf4-4f65-b5c5-aa666e2c7254", "value": "T1A3D4230402DBCBA4F4A47C742BE73FF56E22087A4C5C6F6613D99DD1EB960CA88C0863", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680959, "uuid": "82c76dab-a3bf-48b0-b141-6e9799e8cbe3", "value": "08b656407b8d307979dc72c3fcc683a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680959, "uuid": "65cf5454-d539-474b-b532-798d3d8fca57", "value": "12288:ACCs5xOKx2NhGAbrbzNtVUIb04wPMJbjd:AU5xOui9n04wPajd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780680959, "uuid": "04adffa2-b898-4fa7-b6eb-57c3e4a0be38", "value": 601891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780680959, "uuid": "45ac776d-45d0-4e33-aead-551e2e01d6f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680959, "uuid": "6c63444a-bfdb-44e3-add8-feb202add967", "value": "autorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7dcded-612f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780699390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780699390, "uuid": "a590500f-cfd3-4426-ae17-1b69674e1b54", "comment": "Malware payload", "value": "be55722df3588c05d5df9a2744b4e24c", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780699390, "uuid": "4407a2d8-0bfa-4ae1-af79-d0ddc093bbec", "comment": "Malware payload", "value": "34136ff6b07b30293c589e25253dce91ade3323011fc55f36349bd468729d20a", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780699390, "uuid": "ee503a11-83ce-4481-8818-db51a9f20c9b", "comment": "Malware payload", "value": "dc570e21fa4c190dad7f204c9405c274481fb759", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780699390, "uuid": "fca6de54-f1f0-49d9-b8e4-e1e518c35974", "comment": "Malware payload", "value": "6e91b4d2861b8b9672e7169b9efdd555a5a2ae5554444e2c895c1a20333de72ef339519c7f821c0e3e12c66c1dc38d4a", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780699390, "uuid": "db2e59cb-281d-4a3c-85b5-74da3208de33", "value": "T180A48B742BA9C08ACEAC4378D49C12F046F1BD15F937E79F30617EA87F73691891864A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780699390, "uuid": "a033b1aa-4d0e-4b25-8c6f-34b93459e95d", "value": "6144:807AIq3kSL1z3pPPsagsQrTUPzxpQbZOeSUnF4ZK7Iy7i7AV9bdfRJIf4aJehBez:dk3kG3vQmzmZeU+ssy7isVFHpzra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780699390, "uuid": "2f1a1541-7573-4bbd-b9e4-3a384386f682", "value": 470104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780699390, "uuid": "f00a41b7-6bcb-463a-adcc-eb76868c6834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780699390, "uuid": "2326a8ed-c897-40fa-8ba1-74b60d0119db", "value": "34136ff6b07b30293c589e25253dce91ade3323011fc55f36349bd468729d20a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fe9d39-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780641905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641905, "uuid": "b115420c-5c09-4897-8b71-eb05d9c96fd5", "comment": "Malware payload", "value": "b560a15b4d5d663045e3bf8a6c218673", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641905, "uuid": "1caa5b5d-a02a-4c81-bfc5-83c51bdd6f75", "comment": "Malware payload", "value": "346680f1754abccc4efd9683a9d3bbf100bf40e32eb9866a3e8506604e6c2dbe", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641905, "uuid": "be49004a-e906-4f39-a3d5-8396ea926ed5", "comment": "Malware payload", "value": "27721efa3ad5f61a5cc0cde9e357e3f87e2e6516", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641905, "uuid": "0627590b-2704-45eb-a748-a3ee29efc5b0", "comment": "Malware payload", "value": "5ed05bb50d07605b83e5800dc1b63161316c82703e92d479f7ed210b0ef8b105ef7cd0908fe89d7b1dcfaa70b606da55", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641905, "uuid": "9962794c-6580-4795-a3c4-b0c47eee9a10", "value": "T19894B5537BE0627AD14A4EB45678E9BA68FF0F14FE913C160412BE32B67239361512CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641905, "uuid": "2ff8597d-4755-4215-9d5e-3b64117540b1", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641905, "uuid": "48217d42-28de-4239-97c9-2ec8a37c550c", "value": "12288:yFUNDaNuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu3:yFOaNuuuuuuuuuuuuuuuuuuuuuuuuuuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641905, "uuid": "61a714e9-86bb-4fab-96ed-2345279f7667", "value": 418888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641905, "uuid": "159ef8f8-70a7-45d9-a0e7-b4f92bf0fa03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641905, "uuid": "4b2ae7e9-2a19-45d3-ba86-a15c8259939c", "value": "346680f1754abccc4efd9683a9d3bbf100bf40e32eb9866a3e8506604e6c2dbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bd355c-609d-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780636427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636427, "uuid": "610a4eaf-3d15-4a03-b687-7b4d0e2a8adf", "comment": "Malware payload (PureLogsStealer)", "value": "2d4092eef3b1eaa95f9c2e834e39188f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636427, "uuid": "5d2ec94c-fa3b-4166-aaf4-41bb774a59be", "comment": "Malware payload (PureLogsStealer)", "value": "3475a00014822804b7ff1d82e6f2edf7990e8f4b4c63cd79f54d7e0e5668388e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636427, "uuid": "3407a989-ae69-4057-9c24-10a85b02d0dc", "comment": "Malware payload (PureLogsStealer)", "value": "7a6d627a0dfd273e3615a50b759ec0ec2dd539cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636427, "uuid": "e243a4da-1318-416d-9f9b-a6880993f11e", "comment": "Malware payload (PureLogsStealer)", "value": "e65331640a4a9addd1dfdd76b6a914dfab99e46aab4374325034eef381c4475bc4da2c96bda958b805e9c19c182af0fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636427, "uuid": "99707e04-9d17-4f8f-b4d2-29f48d600f70", "value": "T1017522643B4ADB51C9A61BB90820EBB303759D8CE411D72B5FF17CDB7831B6E2909287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636427, "uuid": "01b4766f-432d-4367-ab26-c463c2e3bd5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636427, "uuid": "a138f8bf-5215-408c-b9bb-ef2862a357f1", "value": "49152:4AtO5dIOD1v4BWtHL63ut/8eJ9t2RSDA+Tt:AWOD1xtHLxEG9t4SDA+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636427, "uuid": "d29906d2-f0c0-42e4-8f01-6c8ff048c5cd", "value": 1679360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636427, "uuid": "6183317e-a8da-4172-ba75-28346dcbfd0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636427, "uuid": "6095b5a8-5e8e-43ce-9e7d-65fb5778a1ef", "value": "2d4092eef3b1eaa95f9c2e834e39188f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31062740-60b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780646675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780646675, "uuid": "d2091b3a-796e-4faa-ae30-0551a0754ca5", "comment": "Malware payload", "value": "8eb7ab92e2ffb1a871fb16c749fcad8d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780646675, "uuid": "b0676556-648a-4065-b4f2-d4307ad8444c", "comment": "Malware payload", "value": "348d3296ab67d9fd18052da782234daeaccbfb6038b93db334c7cba35d4e6e00", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780646675, "uuid": "e96dbbec-f15f-45b0-aea5-cf25cb3c23d4", "comment": "Malware payload", "value": "3db50294d5c4ecb8bec143989f54424d4e631cab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780646675, "uuid": "f1d423ff-5f40-4601-93db-32eec7a84176", "comment": "Malware payload", "value": "cc525a08ed63cef61d4ea1a6abe144bde12061d11503c16432437fde8cf529a1bbecdc843aa8fd9b92eadd53bac78b39", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780646675, "uuid": "2695c0dc-70c6-44ac-a1bf-df0063a33508", "value": "T10E136D6526953C25AE99883B5C7F2F0CB9A983E2304491DDBFCA3CF18C15A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780646675, "uuid": "6805d839-9b48-4322-8f2f-3f99b6400196", "value": "768:Vr9NyXsZztCA9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:9HusZIco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780646675, "uuid": "a7b59c74-5624-45e8-88ca-9999f9c88880", "value": 45501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780646675, "uuid": "2e2d88ce-c07f-469e-ad3b-2d6e31f4ae8d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780646675, "uuid": "dd406d97-1ee5-4fc4-8439-d213a4173110", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce00727b-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649515, "uuid": "cf97eb89-a851-48a1-b35c-23899a6f58d5", "comment": "Malware payload", "value": "f3926aa4dc78e279ef30ef9f1d24056c", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649515, "uuid": "c30af951-b6d9-4beb-90da-dad0f29e7c91", "comment": "Malware payload", "value": "35714868ec40bcd2be363effcabc2aad584529070d582e583953ebe3fa008c8e", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649515, "uuid": "85540c15-6020-478b-9bd9-49d7de79ffd2", "comment": "Malware payload", "value": "3b57aafda68eb0633dfeebac038f1876d1219f72", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649515, "uuid": "3eab0523-0dcc-4d16-b99c-76404b92b008", "comment": "Malware payload", "value": "a0c4f28dca77dc179e2b6343149ecb3d726f8c438ebd70aa15c46d3c4184ddf0d1739027696f9c0ce33b688b71de28ab", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649515, "uuid": "a6050ef1-fe65-42cd-847c-d4579fa9e8a2", "value": "T10542AE59D5ACF298D33FAD722E72141E9B08CF72489BF86AC61CD72316752DF517008A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649515, "uuid": "c7763e2d-c9be-4b7a-9580-01bb47d8ef0b", "value": "384:CR4XA670nSann7YnzUWHF/Qh75yhULC2CJhGQWhqDS:CR4XA5nSanQW5m2CaZqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649515, "uuid": "89cd1df9-8912-4c86-a682-3a75ce5dad6a", "value": 12426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649515, "uuid": "ff472214-d4b8-4658-95f9-de829cf63b77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649515, "uuid": "96545dd9-d32a-4741-8897-52a04d6113d8", "value": "photo-693552044.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a489f1-60cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780657121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657121, "uuid": "426df009-4a5a-4d8b-b159-77e35c0a2929", "comment": "Malware payload", "value": "e1746ab5f1c34eeaf3535237224665e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657121, "uuid": "d40fc067-a7ba-4291-9d18-15620f9c946d", "comment": "Malware payload", "value": "3587a363f2ebf9d1ab1042968f85860e41c560544b938e0ec01faa0900080bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657121, "uuid": "aa52124a-4bcd-4bba-8e04-ee5a85dfae35", "comment": "Malware payload", "value": "2eac2ffda9de70e3a8b3f9b5b509b526ed572358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657121, "uuid": "c167547d-8346-492d-bcb2-f681243b3145", "comment": "Malware payload", "value": "c9b562f49f74039068afb7d11464e8d2c3d1f9b60c56d443158553608919ddee9b2d53c46639794f7146b2f6d1ca6143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657121, "uuid": "d991ad07-46c4-4a19-b42f-5bb6bfea8e52", "value": "T1D9F42942DEEF4E9FC89F3135440D1D0399EEA49806308AAEEE53AD55FBD258358252F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657121, "uuid": "6cd5f1c9-9d95-41bd-92a9-21e9106b5576", "value": "e32b4ac7ab5fd558a3dc552ea08a2659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657121, "uuid": "ace4bb44-c628-4e35-8a2b-f438ef591d27", "value": "6144:AEkWY+BPdCF2hNP2xJ3yM85dADmEohAFVwQjOk9HysVI:A5WYQdg2rOJ3SdgoPlsVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657121, "uuid": "6d263022-ef81-43c4-87a7-3cd4d59e05e9", "value": 746928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657121, "uuid": "ddc43c57-8682-4dc9-9222-ab0ac7f753c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657121, "uuid": "fb99b4dc-cfaa-4976-a5fb-f935385b025d", "value": "NVIDIA Overlay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab830be0-60a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780637861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637861, "uuid": "633c3bea-3510-4123-a4e2-e2204f053f8c", "comment": "Malware payload (Mirai)", "value": "c6e4fe2e13877ef0a3cf45552642c623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637861, "uuid": "f5e3610d-857e-41bc-9bb8-b20281298506", "comment": "Malware payload (Mirai)", "value": "3593929d11ca6b09dbeae4b0513eae0c9927b70532c22ecba849db113bccf3c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637861, "uuid": "8de4c89d-1d1e-4038-b242-d4032e1e9305", "comment": "Malware payload (Mirai)", "value": "a72eba87f901d22a11ac35364ea07858382b957e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637861, "uuid": "67ee4031-10ba-4650-8bb6-cbe5c7b802da", "comment": "Malware payload (Mirai)", "value": "b6a8b8c7fb856a7b8dcb2c13e43c2f25c6a989ba15e69595046b000de2d348122bbca4474f9504d6f65441b4b83588d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637861, "uuid": "fb08d4ff-c673-4b3e-bd39-29f55694a813", "value": "T1C834643A7A129F7FE169827107F79E708F5925D726E1D284E27CD6084E3118E184FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637861, "uuid": "7ab6c005-172a-4441-a050-f6989b59b7d3", "value": "3072:DnonaDyp7MiXhVT+o3yHyOO5nv5cqKMbePezjUi:roe6qoNOYv5DKMgyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637861, "uuid": "95f64eda-bfb5-4add-b659-130f42dd67f1", "value": 244436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637861, "uuid": "61adbac7-cebd-4698-bcb5-7c6f869375f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637861, "uuid": "4d793d7b-2a32-4e5b-992e-08af0909fbee", "value": "3593929d11ca6b09dbeae4b0513eae0c9927b70532c22ecba849db113bccf3c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde09e98-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642643, "uuid": "48c87193-7adb-49c4-a888-875e6ecaf08b", "comment": "Malware payload (RemusStealer)", "value": "8edf939093f663573a101d534d6091bd", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642643, "uuid": "c617ec9a-0b65-4f5e-86c6-d4750623a9f2", "comment": "Malware payload (RemusStealer)", "value": "36264ed4b85465434dcb1bcf151e2c41702c12107126b605abb5479273aea702", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642643, "uuid": "60670267-6589-45b1-9ead-80784ce0f5f5", "comment": "Malware payload (RemusStealer)", "value": "196cec7b2cdb4ba9a6ed2c52032aca62478de53f", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642643, "uuid": "241877f6-e486-4431-9b4f-ebebac4d1d7a", "comment": "Malware payload (RemusStealer)", "value": "3fc7ab843763206a6f857af83a7bf318a5b87e203e18343852f5d6afab49aa27fe3f9bba0641f559c54cd5da8d9b4520", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642643, "uuid": "5326fd43-988a-4103-bd09-246b01816473", "value": "T12224186BC16331FCE553C07883666232B732B63C47749EFB02A2D7309E619D05E79969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642643, "uuid": "3ef25f3d-4245-4575-b2d9-776f8279ad1f", "value": "20c08c2c4fbe56b4d08586185a84e7e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642643, "uuid": "7eb9ab18-c627-43a4-8611-d70bbe8ed22b", "value": "3072:+uasQyBVshtd+fOUIA1qwMpfUkwMU86O6iy5JuRw1pdvb7:+SDs7BlDUkwmn6iy5JTdvb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642643, "uuid": "5c16d9f3-e9bc-4bfe-b02b-5e1cec34c1c9", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642643, "uuid": "928d2dc5-a05c-4faa-8499-593876aae713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642643, "uuid": "f262778b-5787-4dd9-891d-933b3f304397", "value": "36264ed4b85465434dcb1bcf151e2c41702c12107126b605abb5479273aea702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccbf748-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642131, "uuid": "4ff552e2-e856-4afa-9821-42e2c338da9b", "comment": "Malware payload (RemusStealer)", "value": "7a1944e4add15db0584eea93fddce1e8", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642131, "uuid": "4ad32d27-e05b-44d1-9351-e077c3b87cac", "comment": "Malware payload (RemusStealer)", "value": "36338b31d0266e2c04c244f0154af9db9b36fe8f7fdb51c8dfb0827c82bf8757", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642131, "uuid": "2ba43b4d-1a9b-4095-adcb-0ade175e02eb", "comment": "Malware payload (RemusStealer)", "value": "7c546d744a9092131c8efa6a1dac01aa15cba16f", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642131, "uuid": "2fef1795-9699-418d-896a-fda8af6581cf", "comment": "Malware payload (RemusStealer)", "value": "56e5dca0fc07bcf853283a32afa817a1c41bdbe747d95e8a28c3c3bcb099c56d9ac735c1f937b245ef331bf88a85c5c8", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642131, "uuid": "5cf27086-0860-47eb-b0f9-65bd0be97a0f", "value": "T1F877BE17BBE84065D0BB9234896B9756E775BC210B3093CF2250B66D6F33BD05E3A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642131, "uuid": "47d1b64b-590e-4815-afc2-c0aeb0144789", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642131, "uuid": "7c609ba4-1f83-448d-b499-36cb800fac91", "value": "786432:GEwO8KztiKRRqGRj2EzAget9fZa/tHdI:kO8KpVRRqGvet9f8t9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642131, "uuid": "bc0c5f99-6d95-419b-9b7b-38a9a2a3b29f", "value": 35862705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642131, "uuid": "192f541c-f9b7-4242-93d9-db18d3e30026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642131, "uuid": "80bbffcf-2095-48e3-b583-9ff6020e67fa", "value": "36338b31d0266e2c04c244f0154af9db9b36fe8f7fdb51c8dfb0827c82bf8757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13ecbe2-611d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780691558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691558, "uuid": "cf2e6cb6-f117-4f1e-99fd-239987b62da3", "comment": "Malware payload", "value": "12c0be818709472b75223559e30bcebf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691558, "uuid": "4d074869-d395-46cd-82d7-e7b32cba481e", "comment": "Malware payload", "value": "3691b34daf3f995b3729f79c9d400a981af91862929a6b51d1cb5729ed1034e3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691558, "uuid": "e1cfd0dc-2b33-4892-8e71-48bd217c9e42", "comment": "Malware payload", "value": "6ca3f68b333b9557043d89de24cdf873e1988392", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691558, "uuid": "d2120982-a265-4c37-bb04-38c4219174fa", "comment": "Malware payload", "value": "f39698cbb3231486da11afca29d9016aae9c1caa214e0f5b56f6ff84f03aed492a0842ffe6c39647d53b04191e5715da", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691558, "uuid": "cd2b557f-9599-43dc-8619-e4d4d72ccec7", "value": "T162137D6566853C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691558, "uuid": "226e25c5-16ee-4ff5-af6b-4c291767ef23", "value": "768:dXRWNGxVB9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:nlxsco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780691558, "uuid": "5cee08c4-bb63-464a-8e56-da3c51147ddb", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780691558, "uuid": "e1c472df-e8a9-418b-8007-c72aa8664c41", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691558, "uuid": "e8d957bc-6352-4ef3-aa30-099d23f16ed2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568fca5a-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648456, "uuid": "c8177d6f-8dec-447b-89b8-0ef83e6f4f14", "comment": "Malware payload", "value": "03847d2edb175956373a48ca4c106b49", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648456, "uuid": "17acdf36-7240-48c8-93d0-7368f5583140", "comment": "Malware payload", "value": "36f9adabf2ece4e6ad0d1704f0200937d32346233b503d94335bfa228b4b724e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648456, "uuid": "8999b0f4-21e0-4893-bd5e-1ee80d5cad42", "comment": "Malware payload", "value": "02c522e0c9b8634e5f400c22905fb7f3072dd3d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648456, "uuid": "72c398ab-facb-433c-806c-5cd3826ed4ac", "comment": "Malware payload", "value": "1f5a1ea4447ad868792ec41d17474b6725dbd8f2ae3b24bd41b6b036e76c6aed21397c36828e87daf37ba36e43e7b6b3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648456, "uuid": "9f64d956-911e-4fa4-ab61-2277f83a6311", "value": "T11CD2DF34C4D82FBDEEAA2A1C06FA6620D7D68B1E9498860737477D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648456, "uuid": "a89c284e-47e0-4823-a810-5f0182cc43d1", "value": "768:3umWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:3u+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648456, "uuid": "fa42d371-c809-44ce-b8d2-29d6bf82a45d", "value": 28659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648456, "uuid": "3d0dda2c-e294-472f-89de-d0a9b6d36e68", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648456, "uuid": "d539ccbb-7ca8-451e-846b-040b4bb45ea5", "value": "23.94.110.24_1780648382067886_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab35a3d2-6112-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780686823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686823, "uuid": "f7f4f5e9-99c1-4836-8cc6-139a9ac811dd", "comment": "Malware payload", "value": "677d5a334d208679b6915ac4757ae98b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686823, "uuid": "1c09b283-6743-46d3-991e-8bffc96805a7", "comment": "Malware payload", "value": "377127e31f71d307b667de3103c44e1642ac73ada0f96303c5d40f8fe4d5acec", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686823, "uuid": "0ff63352-ca90-4d4e-b9b4-74cf97c69b29", "comment": "Malware payload", "value": "f91b09baa5f92be9b390b45394fbfaacb7332e6b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686823, "uuid": "3b9bab68-6a44-4b45-ba0d-42bc309bb0c1", "comment": "Malware payload", "value": "64b1b37ea7bdf77698711f5ba00b5d79b58b62e095fe11dc6039ebe42d06a1b76b01828044099cfbb5934175b1c37218", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686823, "uuid": "aac9aef2-4772-480a-82c4-5e65617577ae", "value": "T123825C0FF9424326E0D100748A62467BEA79A87A73C454D7FBD18AED1B686C1EC3325F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686823, "uuid": "2d230159-ee64-46cb-90b6-cdef4b067471", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686823, "uuid": "c041d1a6-660b-47b9-baaa-3b3c211c27ff", "value": "192:i6hSCngTBvPV0K3EdRgqwPGle6/C/KUSf8zwAVYNd5bo+EI2DoCGJxTmv8U9cthh:jIPVGwPG0Ud8xVOdBo+A0jav8U9ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780686823, "uuid": "8d0524d7-f0c4-4b36-bbc7-f36c02179b58", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780686823, "uuid": "88d00c5d-5af3-4b1d-8b8c-ba87ef5c29b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686823, "uuid": "6e02c9df-1ff4-4642-a78a-de57395c11da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda9c84c-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648656, "uuid": "1867491e-b4d1-40a5-919b-ce96ded810f4", "comment": "Malware payload", "value": "f1abd3aa14a2063b0e73808045d548f2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648656, "uuid": "194e09e5-5593-43a8-b54a-775eaa95cfaf", "comment": "Malware payload", "value": "381b0b3e95031c670b5e4132125a254e7c1e6bb3c0ae9c6a6916bbd2af2a9b02", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648656, "uuid": "e12d9001-8b96-4b46-bcb9-e5501ce066c0", "comment": "Malware payload", "value": "d1dc2a79fc5d037e604b68ea9856bb4d88f10e7b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648656, "uuid": "df52fd63-6f08-4055-b080-22303203a004", "comment": "Malware payload", "value": "ad05c477027bb07084664fbfa66e6bbb72042b357b5e99f116f1ef8fd929e3edfd529b27e131abbeee3c5267db827764", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648656, "uuid": "fe4f607c-9139-403c-8a37-5a6a3d8c3262", "value": "T1F505F63DCD14412EE872CA19C99A046FF8C1465B622CEA4760D73B9FAF7288273D725D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648656, "uuid": "2bb75626-2e1b-4de0-add5-5ade5d943767", "value": "3072:zHxszvnwU8sCWJTYiTR4eU8pxRnKpUq2IKnWo4vhMU2oNtFpZivPPQtSjLWBpSya:+bnwU8sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648656, "uuid": "678b21a2-84e3-482e-ac49-387180536a0c", "value": 818996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648656, "uuid": "fab29f84-7f46-490a-aaf7-0cb6aaceef19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648656, "uuid": "1657b619-f334-4220-b9f1-45b28baa6c9c", "value": "PurchaseOrder_006231_Shanghuigou_20260605.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1829dfa-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649441, "uuid": "30f21ffc-7218-4796-8895-643b1d0fd532", "comment": "Malware payload", "value": "0a9d5eac2dff150fc1b89bc2041456ff", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649441, "uuid": "5e412df7-a1c1-4989-8247-763293f18317", "comment": "Malware payload", "value": "38dbae9c53b5ba742f378984c86daf8d38d65c2d005e62b668a346013fa84176", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649441, "uuid": "f2a056f3-7001-42c8-ac4f-abff87494fa4", "comment": "Malware payload", "value": "0abb0ee2a30149c07d715677aef25951b77a57de", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649441, "uuid": "b444bdb6-e3a0-4bd9-9a9f-eaaa381d5f20", "comment": "Malware payload", "value": "8a70c554b947402aa0fc4a38db689f61f704bbb71ef4465b9561217afa97552d83220273dda79ba1e2fcea0ef727ac85", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649441, "uuid": "7df6b797-7b72-4306-82b6-224822194d5a", "value": "T13072D05284733FD7EF6FE1259F05BBDD0A27300D67269D43927862BA6F510402BAA18A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649441, "uuid": "b09146ab-3773-41fc-bc13-2a7fd0b0bf2f", "value": "384:VQMovjv4zBWVTzGu+kxJP05+o6bHXpgGb989pbzJYb:tejwlW5Gui5v+/bSPCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649441, "uuid": "c1b992cf-07c6-456d-a614-770af6bda071", "value": 17282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649441, "uuid": "6658b1ab-b260-4d21-bac9-ee13d4cd223f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649441, "uuid": "8a886cd4-6293-45ee-ab8b-a0cf94156f68", "value": "photo-906780287.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d35941-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (MasonRAT)", "timestamp": 1780638464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638464, "uuid": "268207e2-fea0-4048-bc71-66461529b99c", "comment": "Malware payload (MasonRAT)", "value": "9b79eee49d4683d480f663fe8140a487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638464, "uuid": "2f82f15e-e21a-4cc4-b05f-6036e378f9d7", "comment": "Malware payload (MasonRAT)", "value": "38e5e2368688ef46e6746730d685ef88028e100286757666ffd2a596717ffab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638464, "uuid": "1288e12a-45d6-4e07-b69c-0fe1b84efb22", "comment": "Malware payload (MasonRAT)", "value": "2625d1ff1a03566519890c6aef8c4c86e766b80d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638464, "uuid": "a16fd532-9e79-4469-a1cd-391dacc3b0c4", "comment": "Malware payload (MasonRAT)", "value": "a2034af2f6bf8dd6d6b527a95fef59a0a3515586837791e6425129343ff859711b0a7328529d37fc5c7732769ecfe889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638464, "uuid": "78d928a1-eb41-459e-8de7-2ca817490ec4", "value": "T14A442906F75360EEC927C17483ABA333B531BC5E5230AE3A9798CB753D52E505A39E18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638464, "uuid": "b62c34b0-3e51-4881-9777-319289f213e7", "value": "c8a12676a80634473c83e0bfeb54ef67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638464, "uuid": "93035c70-5153-4f9c-9bb3-709f1aca7ca5", "value": "6144:W6XwtxAjXDN0BQz1wSXgoIOrSCn4Un9XNk:fcxAjXiwwYgoFOCni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638464, "uuid": "e4c8f404-4c86-44d7-a5f2-c28158f7b63c", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638464, "uuid": "98b6ec88-1230-407b-bb71-7a552a342f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638464, "uuid": "be5f393c-4b38-4d71-ba8d-303efc6215d9", "value": "svhost.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6648fde6-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780648482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648482, "uuid": "36a72ec8-5e19-44dc-b2a8-174e2202053e", "comment": "Malware payload (RemusStealer)", "value": "47c73b8f3f5a7a79e3079764e7e3160d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648482, "uuid": "5212582d-61d2-450b-8f71-27ee6b58d52c", "comment": "Malware payload (RemusStealer)", "value": "399349b048f9c914f98e301878d67c515e96f626dc7944d4ed0793cb4c31c8a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648482, "uuid": "cc6aae37-24c2-49d2-bff7-bd50339734be", "comment": "Malware payload (RemusStealer)", "value": "4ac559bf219e831f368553280e9c710f10aa826b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648482, "uuid": "a9924d85-6157-48bd-a289-38ca8e005e9b", "comment": "Malware payload (RemusStealer)", "value": "65e988e14a29724d39d0ff835959c02e69c2b039f6e2c45f4d270730bd89c0c0d1ad42ae0064134e8ca711a27ea24e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648482, "uuid": "f60e2c95-e304-4fbd-9e2c-ed82ab8c8a3e", "value": "T1CF342A6BD25331FCD652C07892266232B732B53D47399EF702A2C3359D21AC0AFB9975", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648482, "uuid": "8524d6ca-92aa-4d6a-8ee6-e3b66e4e1be1", "value": "8b41a1754e41495e9695410df2f316c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648482, "uuid": "7ed0f5a9-f198-4f61-a0b3-c6dab8780b8d", "value": "3072:oYBWrKIvx11uXZ6xCDtCFf/HeeT2kx68/2SHEKjy/iXekw79iGOK1Tn06K:jWms1hwkPOSHnjy/kK79i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648482, "uuid": "0ab3b1d4-35e6-4f40-9bd6-3d668e9f00ce", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648482, "uuid": "f1b649db-7159-4b48-b02d-34242a8234e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648482, "uuid": "0e7abcdf-2a94-41cf-8289-b9400022752e", "value": "SecuriteInfo.com.Variant.Zusy.605845.36376792", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767b8f76-60bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649798, "uuid": "5b628d81-1d7e-4971-8761-0f2e1dc1bbf1", "comment": "Malware payload", "value": "3f0b88abfc6468f8ed0c9674f2f0ecbf", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649798, "uuid": "b5dc6f35-fc0d-48d6-9e6a-b4a85b22c814", "comment": "Malware payload", "value": "39ac450cc894356244e773b5355fd33d38a2840a8f6a734b0129de980bbaf26a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649798, "uuid": "6bdd930c-0db6-44ab-85e3-7d81e181d863", "comment": "Malware payload", "value": "b0835cb181d8924fe9c91fbf1a08daa9f6502cab", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649798, "uuid": "0fe9e7af-3142-456a-89fd-60039ef3d376", "comment": "Malware payload", "value": "66bf48a780915342957b65685473eda0025f21a2753463db049b53e264a7eb001d1e353beea82b5cbf1babea73ced8f8", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649798, "uuid": "1b034097-c3f2-4921-b91d-6001730eca9e", "value": "T14851FE142BE84325F3B3AE7A98F756144939BD0AF825CE1E0090824C1C62B08FC79F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649798, "uuid": "eb4c3c60-6bd6-4172-8d6a-e151d635f226", "value": "48:8ztPsErF6tz6NKJx2Fa2+BCOMdXbl7dX/Pg:8zdsZV6GCwmph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649798, "uuid": "90e49a00-9421-4e13-9071-b193d1403026", "value": 2679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649798, "uuid": "1280f19c-fd61-498c-bf4a-f82134e6c80e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649798, "uuid": "152a3acf-d157-40da-8581-9de6d1fce827", "value": "CamScanner 19.05.2026 12.45.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def64fd4-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642242, "uuid": "4f3f0dc9-a70c-41c5-9369-f62df6dd257a", "comment": "Malware payload (RemusStealer)", "value": "720d7660779092374a0220603097e1da", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642242, "uuid": "a97ebe44-260c-43a6-86f1-90f4583314d1", "comment": "Malware payload (RemusStealer)", "value": "3a14fdd5579f73548531790e4434a0ae99025aebfa69d48e6397e8944aec0222", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642242, "uuid": "fd4bf447-2853-44d4-95f9-f7fb5823f92c", "comment": "Malware payload (RemusStealer)", "value": "d12228d1b6d0adb801c44fb3076f1ff64bf0d545", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642242, "uuid": "db445239-686b-4ebf-a9f7-2c03b1c9999f", "comment": "Malware payload (RemusStealer)", "value": "6ed1c3cdecd785a62ec8f5b25b1d4157fca04e80606de21879efffae36ec476ddfe4a6c8c029f4770a61ea106565933b", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642242, "uuid": "b93d7239-e38c-48c9-8c42-5bd96053b5f9", "value": "T110242A2BD29330FCD552C078526A7232BB72BA3D47709EFB02C2C7359D61AD09E79664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642242, "uuid": "75592f57-8548-4316-bb74-e3b0bb24b97f", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642242, "uuid": "0f7e7428-524e-4f48-bc64-5454c38310cc", "value": "3072:wFoWC5C9nJvzUL6p8Y74iRzfioaJ/GQPvlzP4BQOGAbHQQd4Fvv:XWEC5zQ8DVa9Jnl7PAjQQd4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642242, "uuid": "3a9660fb-001d-491f-979c-e611c8510f8b", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642242, "uuid": "ab135f4f-9841-40fd-8904-69be563b57bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642242, "uuid": "955d34b6-4a54-4cdf-81ad-3f2c4198b14b", "value": "3a14fdd5579f73548531790e4434a0ae99025aebfa69d48e6397e8944aec0222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d5c5e9-60fe-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780678009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678009, "uuid": "032f9c0b-fb81-4738-b8ef-c88e56aa9c8a", "comment": "Malware payload (RustyStealer)", "value": "a203b757417a4c85a6decff16510bd9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678009, "uuid": "5d8b911c-6ab3-48e7-868f-c6998bf29ca7", "comment": "Malware payload (RustyStealer)", "value": "3baa5661412c1f279a5336cb6429288f5f9d4f25f3e218dc78fdc8f1cd91131c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678009, "uuid": "a90093e5-6e18-48c5-9e72-472d8d8a7075", "comment": "Malware payload (RustyStealer)", "value": "098784b42aa215eda491118fe67ee9a85e7296cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678009, "uuid": "7e1f607e-4833-4a3e-9cfa-be9db814073f", "comment": "Malware payload (RustyStealer)", "value": "449ec73b8d0c67715d4ebe4e6946df330a4b5328f9f3eb840c5ca0afddc090a066a4f3b7bc1d1a278fde1b32b84d033d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678009, "uuid": "666e0bc5-12e4-4748-96ce-c8309d4b5a1a", "value": "T14D36225469E705BEC00AE3B1CA4D6ABCF15BBF994F718C036F4A39506F32916E835E24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678009, "uuid": "b95da50a-0f73-4d45-a63c-6bb1a46e798f", "value": "66e4622a2560a497065719058a0b3263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678009, "uuid": "a0a0db88-48ad-4f6a-8070-594efadd059e", "value": "98304:YrMyD24FJpf9zBpqkGa2syLhSF6sl8GhVvIrdiKge:veJpfowKLhY6S88vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780678009, "uuid": "23081561-c217-49f4-8101-24a7daa70a7b", "value": 4866560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780678009, "uuid": "c771fd97-c3e1-46ef-a75c-46627c2c2978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678009, "uuid": "2cc953e1-431e-4cb7-9288-b39573ec5255", "value": "Jun4_agrm_rate_confirm_Bol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d8daf2-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780642864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642864, "uuid": "09d83e03-caf5-4c72-af0e-c953b4bbbae2", "comment": "Malware payload", "value": "8c4f8abe69bde5e1a53ca98fe22e13aa", "object_relation": "md5", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642864, "uuid": "89e58fc5-427c-43c5-8952-1335b29ed322", "comment": "Malware payload", "value": "3bb92771e287aa0a8bdd8e5b5bb697427223eaefded3d9b64b5d5c32ad40f3c2", "object_relation": "sha256", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642864, "uuid": "82260fac-4dbb-4c63-ae2c-571c41f4389d", "comment": "Malware payload", "value": "d6b6eb84b0718cbd02eea586637679b4d77bb34f", "object_relation": "sha1", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642864, "uuid": "4a3bcf0f-e233-4b78-87f2-91ed28e7f4b0", "comment": "Malware payload", "value": "1a70517a462e11e9edc58eb5104a2c25a4ae3323e3616c2dcdb71fe84ff261d1464ce1a900af9269677dc2c43f755502", "object_relation": "sha3-384", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642864, "uuid": "853c59e3-f528-4a76-9e51-c921e5449642", "value": "T1C827CEC0F229F548E7550570582936A849662D303754D9BABE8F7AC249782EAFDF0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642864, "uuid": "87e1b7d2-b591-4c40-aad4-215ac110df11", "value": "070b9adc453bae3837e4f26dcac90001", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642864, "uuid": "9a036a8f-ae6b-4d55-8a2c-171ebeacdf58", "value": "393216:jXVxcaTtqtn2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlkr:jlxcaTtqtK2OGfEhP0JqHOG8qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642864, "uuid": "7905ea23-9bce-42c1-b1a2-1e67b978d372", "value": 20968520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642864, "uuid": "c5783fc2-bd4f-4e6e-9f45-e0f0f3960be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642864, "uuid": "5d251bc9-f223-40da-b0e3-2e956a4fc46a", "value": "3bb92771e287aa0a8bdd8e5b5bb697427223eaefded3d9b64b5d5c32ad40f3c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0648e646-60d9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780662065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780662065, "uuid": "f88c9020-52b2-44a6-bbf7-3ddc999ffccc", "comment": "Malware payload (MassLogger)", "value": "6405d7c16eb9fbf7671507e79052cfc0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780662065, "uuid": "2a81e865-867e-4e94-9abd-91e47380d1c7", "comment": "Malware payload (MassLogger)", "value": "3cb5f6bde1e261e82ef04429734d27fee1de4c065a043610e78331a02eda9722", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780662065, "uuid": "b6480a76-213d-487a-b846-516bae754fa9", "comment": "Malware payload (MassLogger)", "value": "8a89cbd2ed9b2dc87162ceecc8be739102d1a614", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780662065, "uuid": "8df84775-7554-4286-a37a-90178fcdafae", "comment": "Malware payload (MassLogger)", "value": "0aa89f33558ffedc017c2f8931a0a99228cae9051b5e77a37d2c895eeb9e78bbd48f3fa80265178c93569bc8284d430a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780662065, "uuid": "b30942da-6042-4483-a0da-86dea57c8949", "value": "T1D6D5DDF98AA60EC1F17C361A4B6989ACD92CDAF8961D2E77E51543C275F003D208BC7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780662065, "uuid": "9cb1e8a9-a873-4eda-9398-41adc84d22bc", "value": "768:fSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSG:Gd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780662065, "uuid": "82e1e4af-0a0b-46b8-9e39-a18639938ceb", "value": 2971283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780662065, "uuid": "c8991363-d35f-45d1-b58b-e284334b816e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780662065, "uuid": "c67588ba-aa6a-4bcc-8485-4d1b1933255a", "value": "Dekont1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fbec38-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780643138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643138, "uuid": "891c629a-6d68-4b34-990d-af1fb36d4e3e", "comment": "Malware payload", "value": "80aa80360f8178dae467cec5bc1a2d52", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643138, "uuid": "3dd7edfd-6916-44be-b427-aa0cf1731a04", "comment": "Malware payload", "value": "3cfcccecc23442397cba2d3e10d51da1f71fd179707364544ced55221c9271fb", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643138, "uuid": "dbfb9262-e7a5-45a4-bfde-5f7462478bc8", "comment": "Malware payload", "value": "2d22fceee3b48944d07966c12587559af5ac8b2b", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643138, "uuid": "df8930b4-b66c-47f6-8eb9-e23c554a1c10", "comment": "Malware payload", "value": "740120658f1be7cb1bbf19e4d707462a84d173dc663067446e814c69eeaf6ede1bfc71053ce89603b3ee66ca480d427f", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643138, "uuid": "c416f763-98b8-4e8c-aa08-23dfba75331c", "value": "T10C51F08D34F360C282F26064417BB9AAFA284A95834CDB14863D97BDBC715ED6317F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643138, "uuid": "0cff9bcc-1d74-46fb-91a2-2970999e3abc", "value": "48:Jm9lSOYyPzt4KK4cQ1hmc1n+5+6Fw3Fbl50+14WcC1TmWazLlB8+VxlBuLUjgOtV:M9lSmt4+mcRY8oWcC1TmJzLlBFVxH9RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643138, "uuid": "e6ab79b8-e36e-478c-abc7-302fcf731f39", "value": 3050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643138, "uuid": "7d839d7e-72cb-4d2c-aa1a-2072a380dea3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643138, "uuid": "64d72d06-be52-4450-b336-488ee27418e1", "value": "3cfcccecc23442397cba2d3e10d51da1f71fd179707364544ced55221c9271fb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879db6c4-6117-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780688911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688911, "uuid": "9ed3f073-cc1e-4672-9860-54bf4dd5967e", "comment": "Malware payload", "value": "0fc02a8a4fee21eb0de45e2036939594", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688911, "uuid": "2cd085fd-f5c8-4704-a8c5-67672e3950ce", "comment": "Malware payload", "value": "3d0cf0aecab4b0ea6bc1fc2e8b880cc9e8a3f20a415d8360bac4187c2f10c9db", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688911, "uuid": "e4e64926-b4f8-4610-99ea-bd4ec7cc99ae", "comment": "Malware payload", "value": "ad059e4fdada0e593c3e0d255788e668493b9a51", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688911, "uuid": "320e40c0-75cf-4680-8e35-3dff7e1bfbef", "comment": "Malware payload", "value": "4600f2f44454baeb18100f23564b530810b9daad7ede38c8d89955c1efd0cf539586fcb5f22e839d46a3ddf373ebfcaa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688911, "uuid": "bb06dd02-ea4a-49eb-9814-1b9789aeb893", "value": "T1D7B38E1030C1C432E566117988AAC7B98A6DF8710F756BD7FFC406AD8F366D19A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688911, "uuid": "927f653e-15e6-4aab-8871-0842e2a5f5a9", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688911, "uuid": "fdd87f4b-5070-49a2-9c10-06d08ae895b0", "value": "1536:ljKtSmJd7d52Dr59gzmkVa8S9rL2sFTfEcvSn0Mv3fx/h5Km26E8Yj29:dKtS2d6oS8S1LFTfHm3fx/h5Kmuzj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780688911, "uuid": "0910cb52-e920-4d5f-aa29-f043cfa94289", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780688911, "uuid": "c9d175a0-d61a-4468-adc8-113e05fa1146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688911, "uuid": "4dfaa354-e22d-48b0-92cd-5a4b3ad7b3e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cb871c-60df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780664727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664727, "uuid": "2a1648ef-4639-4a3c-8c46-c2b311202177", "comment": "Malware payload (Mirai)", "value": "20493273de465c52b2078b1a7aced246", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664727, "uuid": "a2ea5671-be3e-4e3b-8c1a-95ac289eb842", "comment": "Malware payload (Mirai)", "value": "3de8411494ccf1f02a88fcc09b51e328fdab2fb551aedb7f1a8f0fc075ed6e58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664727, "uuid": "285f1eb6-6c76-4cb4-ac5a-81bb3ce6806b", "comment": "Malware payload (Mirai)", "value": "765ad4fc86efeec5ca7eefbe0bbffb8289281f18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664727, "uuid": "880a7e9f-50a0-450b-8ba9-b48f117cbdc7", "comment": "Malware payload (Mirai)", "value": "8b750702a9d2c2704f6001f8ed669485ce315d4a72106ba36130d4324a435c04a7de05ef8a87295c2c6ce243c701ffe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664727, "uuid": "8181fd92-07cd-4156-80c2-51a5c081ee18", "value": "T15AD35BB2B047B118C6E014F4AD8353EE3DC30914AF6ED5E22D8BF1FBA9653CA5506B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664727, "uuid": "39cf8fd9-2c09-419d-a40d-360e142a9ed9", "value": "1536:g8uM4vF/vY0o9IYKU3gYfPW6uz/dzkO+TObVagQZOMg3RDnipby/LW:pu7F/bBYfPly/dzgObAkMg1nipGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780664727, "uuid": "a48f9ac4-d989-4c2f-99b9-e027c4d17d2a", "value": 132980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780664727, "uuid": "00a08d29-a712-462c-8620-e5af29026f43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664727, "uuid": "ee82533a-710d-44e5-a50d-bfc5248c57d4", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a19d704-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667306, "uuid": "3f64c741-c496-4ee3-9b1b-6a53bdb8559b", "comment": "Malware payload (Mirai)", "value": "6e5a7b84a4f4d6ab8eaa71fede798d66", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667306, "uuid": "f7fb0331-632b-483e-b92e-de61c704e1f2", "comment": "Malware payload (Mirai)", "value": "3e4ae8aa79c9d5b175f4d7df4e44213c95eb8b345fb789645312b5885b499d11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667306, "uuid": "8ac35e19-47cb-426d-8096-73ddb795b055", "comment": "Malware payload (Mirai)", "value": "3e2d235a4df70f6c11389d9b7a8b52d29afd7a8f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667306, "uuid": "4ca01979-01bb-4853-97fe-3a864502b35c", "comment": "Malware payload (Mirai)", "value": "a80277a5890ebcf52a5a9d0ff637acc45e429c9ca2b5c90043a15e880ad4ab2a07488605f098f086dc2f605310f80918", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667306, "uuid": "06b09db5-7538-41e3-855d-bddc8837ab32", "value": "T1D7E32945BD92CA12C6D722BBFB6E438D332723A8D3EA7103CD255F51378692A0E7B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667306, "uuid": "fca5942b-17a7-46e4-b0c0-eb6f92a444eb", "value": "3072:+nZor+7zBFJ/SR9lznCnEY094K9cPCGiLox93IYiV4ulzRLCQJ:yqBRzzCnEY094K9cKGiLoxxIYiVLHLCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667306, "uuid": "33b246d9-e846-4f91-a872-097386c0ef48", "value": 153112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667306, "uuid": "166d40c4-7919-4e60-adb9-8885d38bebed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667306, "uuid": "027d8d49-987c-43e0-87c5-a8c7d27707a6", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a931724-60e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780666126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666126, "uuid": "f4f058ac-7d39-4a95-ac97-34185f6ac648", "comment": "Malware payload (Gafgyt)", "value": "2cd5da92cf58d34b168352f09c2eb644", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666126, "uuid": "8316ac69-d95a-4484-aa62-9ff08dbc6472", "comment": "Malware payload (Gafgyt)", "value": "3ea9e6978f6b9e79669f6eb35009c19069068be28f49910e59dd7bf0e26a35f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666126, "uuid": "ef6e3a92-2b78-4747-8a6a-6ce9bca4f0d4", "comment": "Malware payload (Gafgyt)", "value": "778aaceb536980d6aa578f4eb3d57e0468b9f41a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666126, "uuid": "5cc393a3-89db-47b5-9289-950bb22d483c", "comment": "Malware payload (Gafgyt)", "value": "1b4c0ab73ba7dffcc59c7c45203b0dfc63bce3d915bd5371b6f7dc1c0c571846180e7d7677127393b3ebac718035424c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666126, "uuid": "50004016-df2c-465a-8c7e-6eca154027c3", "value": "T1B4C32805D5508727C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666126, "uuid": "2e3185f9-1f90-4a63-9191-a23713651cef", "value": "3072:WkYPgPggnAb0JWaY/VfhEDx0dn+mTQOY5NX3cn:lYPgPggI4Wa8hEDW+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666126, "uuid": "c773c185-4cb0-4d91-a86d-47500fc58be4", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666126, "uuid": "1472fa70-c262-4364-b540-825ddbc23f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666126, "uuid": "63031c34-7ce1-495c-b212-b57e1679a0ba", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9838b777-60c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780653290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653290, "uuid": "db66e4aa-6659-459f-8d69-a8ac5c603a63", "comment": "Malware payload", "value": "800015d9aaf6338b5fe0a8f4de3bdcbe", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653290, "uuid": "07494d0c-0f45-49e3-99b1-28b91846f03a", "comment": "Malware payload", "value": "3ec0910b0e3c4381b01eb1f64b2c686d00bba7d2db20cf1ce3d3d2d93e84932e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653290, "uuid": "ad8f4be4-7db7-4e53-911d-d0445f725776", "comment": "Malware payload", "value": "3b787fc3af7ab64e697c396112deccf9fe210dc4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653290, "uuid": "54e1a143-1aec-4f9c-ae55-6850862635f0", "comment": "Malware payload", "value": "cb6ade52aed2c940300e733c3b11978477178e9a49bb0d2c4fdfe8d9142c5d5fad61bddc514ad2231732681b7f3be73e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780653290, "uuid": "550ac060-e7aa-4664-9940-2024bb10bc12", "value": "T1F65733DCD4A6CD473467BC3ABBF764E349246938FBC3AC6A6444629A74C63E446F3804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780653290, "uuid": "e5a4a089-3b2e-489e-9b48-d8533bc2f687", "value": "393216:kpvsxpC4QiVeSwO93538JAhraPS+CMNorN3xIv8/SKD75Wco5/u+OPh5px3ylPu5:zC46Sv504GP3o34EmxPO55p8uy90Fcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780653290, "uuid": "fa9620b7-1d72-4cbd-bb12-0be68e500740", "value": 28908117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780653290, "uuid": "fbc3f193-d6e9-472a-b5f8-d53df0f2d2b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780653290, "uuid": "0eaf92dd-43a8-42df-8232-f228f4c423ef", "value": "QuarkPC_V6.7.2.809.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcef5bc-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649538, "uuid": "79dad620-ff68-485e-9b69-04b025186a59", "comment": "Malware payload", "value": "768668ab8a31e6a5c7a09a0c95d1995f", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649538, "uuid": "1580a36b-163a-4fda-80d6-82432d0218dd", "comment": "Malware payload", "value": "3efc5597b5fe29d1f58f7c148d5346a0e263429cf00dfd4991386f76fd43e276", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649538, "uuid": "b9817fcc-8c56-4629-9941-5dd72e8b622d", "comment": "Malware payload", "value": "3147adc5dc9184407771be75d9143c07c1cb9823", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649538, "uuid": "b9299809-7081-44ee-913a-d4d7d3c23c63", "comment": "Malware payload", "value": "6f1955a15f6a03e76439da7f80376e2c55028a7eb1bb4dea91fa4299caf6bbe9b2a2c3dc45178c340997692e08660af3", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649538, "uuid": "af1e0b71-bd1c-4e66-aa84-ab3bd717dc70", "value": "T15482D175FB763AC3D5A0A873A9A1C690B9BC4A2D17243B3C095CC5A05F247B22D4DF43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649538, "uuid": "483eb391-555a-4dcb-b663-1e368b7fbfc6", "value": "384:/WcyZUsIXLoFs5pcKakMLtNH6DDYZ65exOz99n+YQr8Qq1RXxMVyr+JN:/WbUsOcCnceML/aYZ65ei9n/qy1RXxML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649538, "uuid": "4fac978d-19d2-4db2-af4e-bdbab0bafbfd", "value": 17594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649538, "uuid": "cf9dbc3b-1968-40df-a6c1-8b9d278d1952", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649538, "uuid": "0a5b63ec-a663-4cc7-ab03-9f50ed292eb4", "value": "photo-130976748.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c67e0f-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780648668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648668, "uuid": "c4b94232-03c5-4f7c-a1c2-41eb54d62b84", "comment": "Malware payload (Formbook)", "value": "56e99da1ffd3380cbed19039ae335412", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648668, "uuid": "3f14b949-b88d-4831-aeff-e167c826168d", "comment": "Malware payload (Formbook)", "value": "3efcd2e618da2b692521aaa727d2020bd68c31cfcb85249c8c048ae479271dda", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648668, "uuid": "38d8a985-7555-4450-8f87-402ef7da9ed1", "comment": "Malware payload (Formbook)", "value": "f3a73607fed796b6ef7cc377284fd69516e8b948", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648668, "uuid": "2dbe5056-cad0-450d-bf81-ffd41230f7fc", "comment": "Malware payload (Formbook)", "value": "35aa936fef1b83757c45ff77c5e717fabbb115660f2251b9bd76af156d5e25bf4e8e1b69ea87f9341fb53a431e967d5d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648668, "uuid": "af550f29-96a0-4178-a240-423bcc9b90e5", "value": "T1C2E55B17D66F974E180A3B61106A5D9AFE89CAFCEF727BC4E0CF90B510EA1110B851B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648668, "uuid": "61f3fe61-cf96-472f-aa16-0db0806f8b10", "value": "49152:omcJ1APDbMHQ29xQrCA77ThlXI1WyJzmXyiqn5uWE0ON0dZCj2irexjEMW:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648668, "uuid": "3b51a3be-8f11-4b85-94df-e2d8d8e2d7db", "value": 3127284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648668, "uuid": "a4bc2c88-59e4-4362-ab3f-2a7eaf4a9b32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648668, "uuid": "f1e6adf9-896b-483c-9f93-1f63f88f715c", "value": "M&M RFQ SUP 09-2026_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5ef890-610b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780683817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683817, "uuid": "e25a3d02-a2c8-4148-90f7-08d801421f32", "comment": "Malware payload", "value": "45d7540cc48d45d46753e3f037e5abd9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683817, "uuid": "23ee35ad-bda4-4f15-8afd-08922adba449", "comment": "Malware payload", "value": "3f33ccf1ca7693c39478bfe3e435797e9ca75f8cc774e3893f04484b433c0cdf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683817, "uuid": "f2825f9e-3900-4d9f-bbda-2439d446cee4", "comment": "Malware payload", "value": "f83a8fa5bbb8ce98301b95712a8b20b452333e56", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683817, "uuid": "d1dbca5c-f91d-48c1-ac62-b2f47515d287", "comment": "Malware payload", "value": "5e5f34182e755377bbae24607aeac214beaa9d7999d9ff9c6cca0fd4e9ae0417e9b1357d30a9d8fc0e75d4e4a9054fd7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780683817, "uuid": "ebad54e8-9b54-419a-bf66-79fd9e498651", "value": "T18F51A0C561846D382CB7AA13B7B7812830C1A0529CFE7F95DAC8FEE88A9ED147154B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780683817, "uuid": "b7108af4-599e-40a2-b4fe-a7a07816b5b6", "value": "48:ipa270a27N7hpa2va26Gpa2gna2zPpa2fa2KWpa21a2oUpa271a27o7Upa2fOa2C:i827D27N7h82C26G82ga2zP82y2KW82x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780683817, "uuid": "b825c653-984a-4337-9193-e86bcd770f44", "value": 3007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780683817, "uuid": "a182de4d-36de-4566-b380-6f804990708e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780683817, "uuid": "d4a9c1c5-7753-4b8f-ad2d-57dabc2b9f87", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b60355a-6109-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682770, "uuid": "813ba538-f1fe-4069-8632-ea231d13430f", "comment": "Malware payload (Cosmu)", "value": "0c59b823f6d80629c8ccebcdebfa6780", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682770, "uuid": "bd272e93-658b-42ee-8ad8-5abf6eaac391", "comment": "Malware payload (Cosmu)", "value": "3f7d0458f189330054601185e60683e2415a4beef52cb3abc333eea5e62ae863", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682770, "uuid": "242a679b-b90b-4e34-b08a-b72b1c4b2de3", "comment": "Malware payload (Cosmu)", "value": "8fc1509e04331ecfc1776aaf916ebe63d8d0054b", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682770, "uuid": "e4761b13-ff0b-4e87-a06a-c39867ecc39e", "comment": "Malware payload (Cosmu)", "value": "b06f945400b9a0b24b6fa9a27f2b0509d219ee1cbb87a80c43223251aa09e364f888445ae5e6a3fcacdfd9aa2903c2c7", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682770, "uuid": "455177cb-7abe-4e29-9f99-52434afc2f1b", "value": "T19444F1453D93C4B3E441493189E58BD18B7F6D03BAA2E15BFF990F4B5EB02884BA7361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682770, "uuid": "b2e2c9e8-20b6-4a28-9013-bd804df79e44", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682770, "uuid": "a44756a2-5db1-4aee-8a65-c24f86a77ad2", "value": "3072:TPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBn:jIlKgzelZNQSBQGH/CSpWqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682770, "uuid": "a5966bc2-520c-4419-bf11-e25684776783", "value": 257464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682770, "uuid": "925b2aea-571a-41c2-aab4-db1b31a46e03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682770, "uuid": "2ccb2c86-9798-442e-83e2-c2f50b747bef", "value": "AppVShNotify.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee48163-60e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667126, "uuid": "f617ee8a-a5d9-4662-9b00-2e459b46fe34", "comment": "Malware payload (Mirai)", "value": "0186c3521bc69dfc8aab041972ec1da8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667126, "uuid": "593c50b3-1c4f-4355-a5a0-e1c4caaa40cd", "comment": "Malware payload (Mirai)", "value": "3f8029cbb1d00eb6a8cd4ce1ed92a240e3216725019a7b0cf3f58eb7102c76b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667126, "uuid": "723bf8a5-e473-4d75-9057-20ed6fddc2ec", "comment": "Malware payload (Mirai)", "value": "5786a884571fbef54b275218de2d661909e1007c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667126, "uuid": "497435b1-f4df-4708-a3d5-c5617743a92a", "comment": "Malware payload (Mirai)", "value": "22d0ded579b6daf5607eea96e96cd5a53100a37fa3ab7fd791c931ec9e9210d519642f1ee8eeb1d61dc460db79fbb409", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667126, "uuid": "b29931db-67b2-47c0-bdf2-8d29154449cf", "value": "T1D4931886BC81C712C5E061B6FB1FA1CD376643ACE3E67203DD19AB59674B85B0E3B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667126, "uuid": "1ad8af65-1019-4462-93d4-d6695fa1aaac", "value": "1536:02sYw98V0mJuct95vFnJAm2/DpoHZFWVVBjrV:02sX9y04u2NjAhLKHZSVBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667126, "uuid": "fb7c7dd7-b54e-448a-8977-905c47c60170", "value": 94752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667126, "uuid": "02377503-dfe5-4a33-9a69-10cb7f51e978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667126, "uuid": "d2cc8655-6d95-4717-b33f-05837f8b89ba", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dc5f1e-6086-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780626713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780626713, "uuid": "cdf339b2-40c1-4e2e-9f5c-7ed85e1b9749", "comment": "Malware payload", "value": "552aac463482b87343426e3dd383b861", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780626713, "uuid": "b5f26908-a363-4405-870f-bc4b62505dc3", "comment": "Malware payload", "value": "4016f6e4fe141cb8144bef18ab52dc4fa8bd6ffddc1d06d4d0e41fd6afcc9402", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780626713, "uuid": "150e42ec-8ddc-4da9-a442-f8ee8271605b", "comment": "Malware payload", "value": "71c4617f2053a3d4c0a8398868c38ed03168cc67", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780626713, "uuid": "847decaf-c4bd-4e6d-8580-06a1799369cd", "comment": "Malware payload", "value": "7c855fc641239c1707432983c579975d90bccb16b2a7a94164e4e36216f65f4e9aae79570cbc6c84c65130fcb63d29b2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780626713, "uuid": "29b71999-2242-4846-ad0d-14c6da9f74a8", "value": "T147F0A747B487F036804039E4D765F75AFC747C476262CE4CB8407B50DFD24747861240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780626713, "uuid": "5d027a58-90cc-4a22-acab-fd8bd29eaeb5", "value": "12:lSjhh1OL9ephRjk4Y4bou7Co1VOq2xddNizdI/HXHQ:lk1gYpTr8i3fOq2bf8IfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780626713, "uuid": "5fb52746-4182-4904-9a93-9c0c27c4c079", "value": 494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780626713, "uuid": "e48fa549-6eef-423f-bbff-756bbacc4769", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780626713, "uuid": "08c51923-cc2f-45f0-acc5-167bac00e173", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88535eb2-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642526, "uuid": "fadd643d-74bf-4813-8963-30308f79ad6f", "comment": "Malware payload (RemusStealer)", "value": "be205b7e33bf604fb64ed55fd0fdfefe", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642526, "uuid": "e9ea73c9-bf3a-4fac-a075-55de687439a1", "comment": "Malware payload (RemusStealer)", "value": "40d107255c8798449af12192d94d3310afeba59873a6a753be5e334c0e940c7c", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642526, "uuid": "2537eab0-c31f-4852-ac53-40989756e404", "comment": "Malware payload (RemusStealer)", "value": "4381ab9222e3be666add8ad9c690f2dad5b4c181", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642526, "uuid": "08b31e03-4969-461d-a6ea-eca90839a1da", "comment": "Malware payload (RemusStealer)", "value": "6ad67295a8aa8d86961ccdfce8d8763331335cb782e1b0140d9b0affca0adc5b88afe7dab301c3beccd9fb904d614777", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642526, "uuid": "2f1531dd-1ee8-440c-9051-a6ad3b0be9a9", "value": "T13534296BC16331FCE553C07883666232BB32B63C47745EBB02A2D7309E619E05F79969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642526, "uuid": "23eedc76-433d-4226-8052-948b8742b07a", "value": "20c08c2c4fbe56b4d08586185a84e7e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642526, "uuid": "7ba7b69b-237e-47c1-94ff-a102859a92bf", "value": "3072:puasQyBVshtd+fOUIA1qwMpfUkwMU86O6iy5JuRw1pdvbB:pSDs7BlDUkwmn6iy5JTdvbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642526, "uuid": "b82d5031-9aaf-4d57-b827-791faa5b72a4", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642526, "uuid": "972b01f7-5520-4f6e-bdf2-a81e3045ce44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642526, "uuid": "8ca816ee-2443-475d-97ae-e62e78c3dcaa", "value": "40d107255c8798449af12192d94d3310afeba59873a6a753be5e334c0e940c7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970bc875-611a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780690225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690225, "uuid": "3f9de86c-9859-491c-a8e2-d84cc76d1af8", "comment": "Malware payload (Mirai)", "value": "b94b8467c9df337c188fb7dbe3dad3a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690225, "uuid": "f50c91f8-7ffd-42ff-b78e-b66b20a0ad0e", "comment": "Malware payload (Mirai)", "value": "41ac5d2c283bdd67ee8e1dc5f5bc5b0035b3352f257efeaa008b6904215e8fb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690225, "uuid": "da2e791f-4a1f-4b28-b277-d865df13003a", "comment": "Malware payload (Mirai)", "value": "8a74838807f282283c7fc1c1069e398399c9a943", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690225, "uuid": "e0fedcc5-92fe-4092-bd32-9b12a24c4cf3", "comment": "Malware payload (Mirai)", "value": "b6f7690d8a8d567ba7846d808d02d4fad535baa2c2680a0b65107a04414e113f836d4a77eb33d0e77f18d833e1c2e688", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690225, "uuid": "061e4a99-0f08-4ac5-b0c9-02734149cf36", "value": "T17ED34A63DE26AF4AC126E0F0B1B28E741B53BD2949470EFAA576EAE44143DCDF105378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690225, "uuid": "e2a8f2b1-6bf9-4eb9-8cf1-8b66f64763a8", "value": "1536:TE46pMDVBngJCzLnxCV7Cj0CwKZW6c/m6+DkxPIWICE3uxU/Bi7WNm:TEbp8n+YLxEmj0qZN6+YPIWZEe8Bi7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780690225, "uuid": "43f4a72c-0032-42ad-8ffe-26e22d19ae41", "value": 142812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780690225, "uuid": "f8756f4b-271e-4b4a-b0c7-5b6f755ee9b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690225, "uuid": "d72eb91f-a98d-4d9e-8507-01a7901582b7", "value": "nova.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47505f82-6109-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682790, "uuid": "f497627a-0dd4-4910-b3eb-56f64b84cfcb", "comment": "Malware payload (Cosmu)", "value": "e29b5d1223b66bfd1a24fb418bb2ede0", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682790, "uuid": "9f2be98c-b4cb-4dd4-8da6-baa58aad5709", "comment": "Malware payload (Cosmu)", "value": "41e8f944d012c5bda1e764c433f0dc2d076103f39f5b44d6a4fd17f006c32dd5", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682790, "uuid": "2c129798-d786-410c-87f3-de4e053c7a28", "comment": "Malware payload (Cosmu)", "value": "c1e7deaa2fb1a08eb3116bd99586c74c92c766ad", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682790, "uuid": "15ddf060-85c1-42ba-ba95-6f92a7b26937", "comment": "Malware payload (Cosmu)", "value": "eb85fd230713d93f0d83d0b9e25d63dd2792ea5595d838ad684b21c37fb411b887563a0cd6346828f5c00291a66d6686", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682790, "uuid": "0c0cdbee-46e3-43f1-a4d0-72653accb9ff", "value": "T15B5402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1FB13844BAA261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682790, "uuid": "771907cf-c2b4-45e2-b4dc-5d44b32eb543", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682790, "uuid": "9b06f413-55f7-4577-a7f8-4ae1b211e665", "value": "6144:kFlKgzelZNQSBQGH/CSpWqTaoAXjiU4bzN:DfBQGH6SfuoAX+U49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682790, "uuid": "c9e757a5-6ae4-4ea3-87e3-d900b9fc2186", "value": 290817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682790, "uuid": "085ec4aa-d129-47fe-9f07-3076dc6cea8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682790, "uuid": "3ade79d6-8ad0-4b7e-b4ad-c4a9efbc3153", "value": "java-rmi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cad7e4-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780641898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641898, "uuid": "af0e16bd-6211-4fd8-8b44-942e543a9211", "comment": "Malware payload", "value": "faea87ad14c728e4c92f7b918cd968a5", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641898, "uuid": "8cb10878-71c2-4748-a82d-c4edafc8ecc6", "comment": "Malware payload", "value": "41f82408cd9b04aea807a548704945dfefd960791b78aa2fb6eafda4dff330b2", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641898, "uuid": "6d12741b-b134-4036-b1fa-840b6249b934", "comment": "Malware payload", "value": "0c45c84accd88f9392748707c4448b12a75a2cac", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641898, "uuid": "26a79aec-25a1-4607-8eac-4e876ed988cd", "comment": "Malware payload", "value": "b16b30e4111e25d01fc0707bada4d8fa9f7885f5cf52c678f928051d54563a16244f398bd5c3fc407bd7fde5c15735c0", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641898, "uuid": "1e63a41d-816f-4672-b4c5-2bf5bc427c3d", "value": "T1C594C6A377E5623CE0068EB2167988BA34FB1F24FE507D024552FE72BA7279322551C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641898, "uuid": "c2b978f1-aebb-42f4-a43b-3ad3b6deaf0e", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641898, "uuid": "af9e50ed-2beb-46ef-9c9c-e375eef10566", "value": "3072:FVqoCl/YgjxEufVU0TbTyDDalQ3Ov2qaRxzg3:FsLqdufVUNDaGOvfWlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641898, "uuid": "4a65e373-fdec-4683-a75e-dee373179d19", "value": 418972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641898, "uuid": "4985ae66-34d7-4b99-90c1-33edc3efb493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641898, "uuid": "7a75b486-7520-441f-b82c-d1c834fe286d", "value": "41f82408cd9b04aea807a548704945dfefd960791b78aa2fb6eafda4dff330b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed11c52-6109-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682964, "uuid": "75ced366-4d86-4978-9a75-ff4b9fab90ff", "comment": "Malware payload (Cosmu)", "value": "b78576d9eafddeea8c2ef63bce6946b4", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682964, "uuid": "7d75c0ec-15ab-4b22-a499-84f20ec4a2e1", "comment": "Malware payload (Cosmu)", "value": "424a217f14d2f4b563246ffe96ce6d12ce6588e31d8d8ad3fd14444fdad71d2f", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682964, "uuid": "4227d263-fb96-4332-992b-73632c5a2280", "comment": "Malware payload (Cosmu)", "value": "4e8890c0fb6757995d122dd82af8c152d4d58f4e", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682964, "uuid": "791d73a7-9d06-4995-86ac-e0aab36a6157", "comment": "Malware payload (Cosmu)", "value": "75e97697bbe365917a140959784ae23bf47939b4ffeebfc23b5507dc25fa56106191c0e715f9e670001a6376bf7143d9", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682964, "uuid": "a8f4a661-967f-4d2c-a430-786430c8cfb9", "value": "T1E965B6123067C40BE6676CF617CF817055F46EED60EAD30DB286BB1A06F9328159F7A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682964, "uuid": "2bfb62d8-bece-4e37-ad02-408ee5120a59", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682964, "uuid": "6f2072ad-0c21-4b87-8c6c-a2dee7eaa08d", "value": "6144:oFlKgzelZNQSBQGH/CSpWqTD29PREoAXjiU4bz:ffBQGH6SfWAoAX+U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682964, "uuid": "f2b4082a-920e-4c12-9ffe-2a35aeffae20", "value": 1537223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682964, "uuid": "bb7b754d-225c-4d98-ae8c-20927ecd59ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682964, "uuid": "d0563cdd-6e04-4e72-aa03-19e38ad23731", "value": "acecnflt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e0384b-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780638816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638816, "uuid": "b128423b-59a2-4800-8bee-77f1dfd86472", "comment": "Malware payload (Mirai)", "value": "d41c7046c31231d88143ff977755d735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638816, "uuid": "67460f54-da24-4449-ab51-41cbe635b1f3", "comment": "Malware payload (Mirai)", "value": "4286fa6edd5aa7c0a797b15c54cc5b0ebcdc7f1789592557660fe1b037d6781c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638816, "uuid": "7079a23a-fa74-4015-8420-aef9fe79aee8", "comment": "Malware payload (Mirai)", "value": "28871fdad6580ff38c04b1be0b29c6649f1e1718", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638816, "uuid": "629eacf8-9116-4d83-b9d6-9df916044a2e", "comment": "Malware payload (Mirai)", "value": "6027b0b09a296efb8499c6ddaceee267a02cbc5ef2ce018005caa0eecd38435370e9e2e20d68ab8e97132463e68b237d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638816, "uuid": "d02b48b3-27a3-4540-adca-db5b7242361f", "value": "T17A04E8B3F908CF66F407A3B244574D15BC30BFE7096246727323B8AA9D3A0D61563E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638816, "uuid": "f492a85a-ccf3-4528-ac82-7f23d3cd8eb2", "value": "3072:2qilo9F3aYtsXb8f0Cs7p4yZjXBxJIqL41y2aHsvQ:276uL8f0CsiyZpL0y2PvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638816, "uuid": "bdb177a8-144f-44ac-80ea-c6a155a40941", "value": 177412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638816, "uuid": "c27ba47a-b4c7-4782-a15b-2a8171c634d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638816, "uuid": "f4b76e17-c0b9-4a35-9b41-5c5abb1e7186", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02347ced-60f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780673655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673655, "uuid": "0591fa86-2a57-4ecb-aa4f-ddcb6cea5835", "comment": "Malware payload", "value": "13911bb0544c8f759f901c2592815871", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673655, "uuid": "45d576be-6a7f-4771-9469-84151dd602c3", "comment": "Malware payload", "value": "42b65d5cd8934b6c5826fdf191b9134394495682681861d7e7255e36b3a9c7a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673655, "uuid": "cf1ae3e0-52e9-44cf-81b6-d32467aed834", "comment": "Malware payload", "value": "40f241c2f793de89efe7b8bda7dc274139920edd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673655, "uuid": "d8d5c10d-79bb-4625-a85a-c06917f8325b", "comment": "Malware payload", "value": "72bce5b297c5849b879dbe1e1142aaf8d64f78e275fa8fee7e855b1d6615a6080b1ba97f9fee4ab1c3a1aa060d609862", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673655, "uuid": "b8e15cbe-0058-41fe-a1b6-b218504c7272", "value": "T12AD2DF34C4D82FBDEE9A2A1C06FA6620D7D68B1E9494860737477D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673655, "uuid": "7054ddd4-2f7d-4ddf-afbf-bc307c650f4a", "value": "768:KumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Ku+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780673655, "uuid": "79d08be9-3bf3-4e93-b4ed-c96ff5fac3c2", "value": 28659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780673655, "uuid": "28e0c13a-c3bf-4949-a73e-5200e9b26856", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673655, "uuid": "4bd4d923-ac49-4b1a-a75e-6af70eb13d72", "value": "23.94.110.24_1780673624564266_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf91ce61-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780648659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648659, "uuid": "dd59f94e-08c9-4238-9f91-aa791d8afca0", "comment": "Malware payload (Formbook)", "value": "0c087219822fded30f25428b592459d7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648659, "uuid": "ef00563a-d974-407b-8ef9-e5badb63a0fa", "comment": "Malware payload (Formbook)", "value": "42e968cf95be266fb1d2fee75bd5259a340cd90e253259d8d1ec83099ab7f6f5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648659, "uuid": "7ad44a2a-830f-4312-a694-d454c80de31d", "comment": "Malware payload (Formbook)", "value": "45f56bf0be754ce99b49dac960fc370e9e6473ab", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648659, "uuid": "01f430c4-a34c-44b3-b482-fd3af3456c38", "comment": "Malware payload (Formbook)", "value": "644723625773ba149bf3f0221a91b8565dc04714f034948c895ac5e409cb3cf81e244577f9502e5e064d375b2b554d44", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648659, "uuid": "ef51942a-33cc-45e1-b943-e1ed9f7b8579", "value": "T16905183DCC68412EE473C92CC995446FF482161B622CE84B64CB3B9FAE73986B7D215D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648659, "uuid": "7a9d1e08-c3a9-4090-b227-082852c306d8", "value": "3072:Mzs2alDuLdhJrfgsSLmNZwmFr4JL1zH9pbTCkTRH1J31SBNmoMHaSCB94aikdzUa:GJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648659, "uuid": "8ba9c4a2-d7ec-4230-95bd-2c7c3a89da3f", "value": 817716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648659, "uuid": "c3691818-60fd-419c-b2e6-fdfaee184470", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648659, "uuid": "4e4791c2-37da-45a1-ba52-febd5cacb5ee", "value": "SKM_C120009809.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34dead3a-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780623918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623918, "uuid": "60ddb95a-974f-403d-95af-bece23660a4d", "comment": "Malware payload (RemcosRAT)", "value": "8c4fc5559033b3456a955b46162cba6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623918, "uuid": "937f5353-8e2b-4741-81e0-6a02cf4ea54a", "comment": "Malware payload (RemcosRAT)", "value": "4352a28a58035c1a2cd8490ec71af6b043384aa4a0f24aa24dbbb05145f0ffba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623918, "uuid": "36ede953-f1e1-4d84-b2e3-725422c747a5", "comment": "Malware payload (RemcosRAT)", "value": "cfd637e92b5176500897186f85765596bbb6ba48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623918, "uuid": "ad62c3f1-11cd-4b82-8d21-05c39a4f1981", "comment": "Malware payload (RemcosRAT)", "value": "52c01864d6ecac80a02301d63f40a44c3f5dff0980a8587ad8e266d9ee73061e98b2b396f08af5537b4b139b8aca9a78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623918, "uuid": "1d34ce77-5e7e-47f1-8153-54d622cc92c4", "value": "T1EE649F25F7A508F9DD77967CC9424906D672BC5647A0E6CF03A00A9B2F237E09E3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623918, "uuid": "c8a0ed42-0d71-4d93-9e50-e35e9371cb67", "value": "b400bba2fa478b1b6e64f988728df3c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623918, "uuid": "410c2bda-de5b-4b2e-a402-5d3bb010f460", "value": "6144:OFE9AwnMkQZZvdNAo+mlPHppvSrItGA+iVe1MBim6:LAT/Z/NAo+mHppnHe1Mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623918, "uuid": "bac22492-e680-42ea-91ce-366e79a31818", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623918, "uuid": "14ff90aa-6a56-4ec2-9e00-e450daa3af19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623918, "uuid": "1e944885-d180-4f07-aac6-1e46bbc4b107", "value": "x4352a28a58035c1a2cd8490ec71af6b043384aa4a0f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03fdce5-6103-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780680389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680389, "uuid": "fa7b6a46-07c2-4f6e-ac42-d7dcf55ecf9f", "comment": "Malware payload (Gafgyt)", "value": "ceab79347edb13fff0090ac1e87c7553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680389, "uuid": "d9aa94a5-8ea4-46fa-b6dd-36ea26da412e", "comment": "Malware payload (Gafgyt)", "value": "435e31ea435afc89b889c37a90b26f94c9dfffe92da0113e43fd7de3a0f27a9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680389, "uuid": "ad85e2ab-a53e-48af-b90c-8628a7d1804a", "comment": "Malware payload (Gafgyt)", "value": "dd2ede173a4bf7123416270ec42f34da6b9bdb5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680389, "uuid": "25806f16-28e8-4a8d-b5b7-036ac42d68b3", "comment": "Malware payload (Gafgyt)", "value": "fbd4a10968197b6a1a2a361181abcd4740229741f1f4db3ab904320fcff1c92cbccf38ddf40e9bf6ea8580d677d1aaa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680389, "uuid": "3ba5c8ad-f232-4052-abee-bc5f8eab39f8", "value": "T1E7833A02F751C6B3D18315B6129B9F110532F9BF1B1AAE06F3AC3CF8AA154847663F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680389, "uuid": "2b9b35a3-5589-4c07-bf71-77f061e858c3", "value": "1536:v/Eo67moXD972+c6tsTngPE56XxCSn98gvjtg0md+wVOz+sXcfW7k:v/EzXz97hc6G7gzXxxeEmMwVOz+ucfWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780680389, "uuid": "2e3f0f22-9c74-4ed4-b60d-5ecb89b8833d", "value": 81479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780680389, "uuid": "e9650b5e-f3cd-4c67-b568-f1644a16f2e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680389, "uuid": "d6df279f-4217-4b81-933c-764b33980410", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6672031e-6119-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780689714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689714, "uuid": "b3ba1b6e-9ea5-4c3a-99bf-7f093c019fbb", "comment": "Malware payload (Mirai)", "value": "4afc140a9fbfff24fa5a8761741460ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689714, "uuid": "cc330a51-0955-47cb-b747-eaf7bac3c179", "comment": "Malware payload (Mirai)", "value": "436ec038deb4cd64a1aa372a7c22e9cf8977929eaed9d052b6c01f76ab532771", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689714, "uuid": "394b886e-f912-4752-8ad1-38847679bbd4", "comment": "Malware payload (Mirai)", "value": "120b9fcc3abb8d4a42970ccdcfe78f8b5a5030b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689714, "uuid": "f1a757e5-4ca2-4bf5-8177-c6f1ebc0af13", "comment": "Malware payload (Mirai)", "value": "94ba990cc3e5e993c1e0fe05d37471e5c7fa7ef39f4866bcc51baf44051c4adb036d56a1f39ba45e52cf5cd322c68007", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689714, "uuid": "26e0fa0a-7288-4a35-a2dc-f93aec22c5b7", "value": "T1F8E31945BC815E17C6D512BBFB9E42CD372A17A8D2EF72038D116F24379A85B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689714, "uuid": "af6912a8-2137-495e-8379-3d7d5e3c4ba7", "value": "1536:om6D1U8Ilbl33uAAgxYrXtuSy9sYqOmT0Wq0NbdC2hLW4VSUO7RMh+6Slz8wywcu:omw1mg0X0ldCd4/O4+C9SAJfHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780689714, "uuid": "35aa5bc1-999f-4dbb-83f4-7d409f8b9024", "value": 145772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780689714, "uuid": "47ff4a4e-2552-46c2-a465-75aa66790022", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689714, "uuid": "68d0a29f-78e9-47be-86dc-24f41052672f", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1d26e5-60ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780657513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657513, "uuid": "fc916a2d-34b4-44d6-af9e-50de195b05a5", "comment": "Malware payload (Mirai)", "value": "7a9527788e29128f7ee6a20aa63d96f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657513, "uuid": "84e25f93-f1dd-477e-ba82-f63e1a6076c1", "comment": "Malware payload (Mirai)", "value": "43bbb6011e1aef28fb6e249ad90b8c9287a0f2fcb735a2afef9ae71a9ab514ae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657513, "uuid": "bbede7cb-7c84-4d61-9203-3a8ae6d2d179", "comment": "Malware payload (Mirai)", "value": "ef234a3a349656445b0764bfd0aec51b73f7a4cb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657513, "uuid": "970a92e7-923a-4772-9a87-54a9d2a53c94", "comment": "Malware payload (Mirai)", "value": "72a70d0eeaa9ed09e102ef3c4f8ab5dea92ddeddb5db0c407c91f312629fce4201c60987bf936448fad1865712b2bc26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657513, "uuid": "005ee0f5-93e3-4ad2-baa9-e7017bf8417b", "value": "T147A34B36B874192BC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657513, "uuid": "b4553e6a-c8c4-406f-8bcb-eb0ce29dc532", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0orj:bbbmPTO930bkbRl886rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657513, "uuid": "97417a65-a5f8-4130-a525-cc173c3ffca1", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657513, "uuid": "86cfe282-3be9-41eb-97bb-04ac52e3a586", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657513, "uuid": "7f7307ed-c630-4964-8573-98f289799129", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5e4e9a-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1780642349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642349, "uuid": "aea32dc0-3095-4a46-9c9f-4b23d2e729ce", "comment": "Malware payload (Smoke Loader)", "value": "06a657cbcaf410b53b440c44025badf6", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642349, "uuid": "395ca4cd-9635-434b-9b7a-a9e3ded0fa69", "comment": "Malware payload (Smoke Loader)", "value": "43f4e7bee2bea185759a60783a18df662f375cb975a31b1fcdcfc0eeefa1133c", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642349, "uuid": "51a0efa2-f750-4d78-bdbb-6ec78632cd5e", "comment": "Malware payload (Smoke Loader)", "value": "b6c46f2853997fcaf7190bfc5d7e0604c6ad86ef", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642349, "uuid": "7fa16319-77df-4e77-b7a9-540c3e2616d7", "comment": "Malware payload (Smoke Loader)", "value": "ae46a85bec544a169041dc4779cb0b41c86330fe102bafd883317c7bc86acc8b7f450121af0e8ab126773b54594da9df", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642349, "uuid": "70203cff-90c4-4515-902f-6c2db6f469b9", "value": "T1FD14386BD25371FCE553C07882667231B732B63907346EF742A2D334AE329D06E78969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642349, "uuid": "a2d3d666-fb79-4169-abca-248e6b5e9be1", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642349, "uuid": "993d26ea-fd4b-4943-ad81-41244c8ba655", "value": "6144:mpFJxVbqzn7nZsdAzjOj2lvF8EIuG6oyqYY:mtxVbqYQlvFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642349, "uuid": "e56ca237-7563-4782-bfee-7145cdf9d360", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642349, "uuid": "30492c8f-7452-4773-af71-55bf5beb37a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642349, "uuid": "bddec34f-0b08-4c1f-b430-f0d5cd005504", "value": "43f4e7bee2bea185759a60783a18df662f375cb975a31b1fcdcfc0eeefa1133c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6800d1e0-60ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780657504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657504, "uuid": "ecc3d013-dfab-4332-8415-9c349d799038", "comment": "Malware payload (Mirai)", "value": "cc22b0c8c54a47693d2ccad2ffa9807c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657504, "uuid": "aaa5292f-a10d-4b00-9628-a35a9db1e9d3", "comment": "Malware payload (Mirai)", "value": "44dca0ac7852590a803d7119795bfdfc15c2ee009c0ca4a4400c3f5befdb26f5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657504, "uuid": "ff609886-54f7-40b7-b7fb-4fa956a38244", "comment": "Malware payload (Mirai)", "value": "ed655b62e21c1de8dc20764e481ffa6363ff2356", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657504, "uuid": "df9d3dbb-17f8-45f7-ac50-af377a42f60c", "comment": "Malware payload (Mirai)", "value": "e3dddb9ab78b3e4d27f777dda5d6fdc3981eef9ecffbbde01de6957f91ea32e91740ccb5050eb2a619ed41dd4a7c82a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657504, "uuid": "b0b9fc3f-b420-483c-ad41-64aa48692574", "value": "T16C110AF44370A0F39595103F7785EE60388100D39C8CF87D6C6A5E21CBA064CB586AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657504, "uuid": "523a0a80-4c64-4c6b-a530-2d2e41ed8b4a", "value": "24:tmxTQJKF1JQ397TQIQJIQA3Q+7qtOek3Q+7qtOfy:toTMG1Ji7T9wIPaGDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657504, "uuid": "9c02ba65-8072-48b8-a4da-95981bb080e4", "value": 910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657504, "uuid": "3a6f9306-b855-465f-a886-81b5c332aa82", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657504, "uuid": "7878a0ff-34a9-46ac-bf6d-e5b6bb5b91e4", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11499e12-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (MasonRAT)", "timestamp": 1780638461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638461, "uuid": "7b4a9472-dadd-452a-a679-96d1ed1d3099", "comment": "Malware payload (MasonRAT)", "value": "a82825a7fed78117622a9282571db365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638461, "uuid": "a23256b9-fe3c-4b76-ab37-f591c75b3e33", "comment": "Malware payload (MasonRAT)", "value": "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638461, "uuid": "95cdd37e-5017-4502-8e72-4617b9cdd099", "comment": "Malware payload (MasonRAT)", "value": "e1e9a6114fdc3cec934ac1df17dfe676cf4839ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638461, "uuid": "699fb7b6-d16b-413b-a33c-2d56c629df69", "comment": "Malware payload (MasonRAT)", "value": "0b948c8525198f0283f5ad69cb233367c08899ebbb90f6443a1410aa788ea41659d41d03fa6642e6d1d17441f87e9484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638461, "uuid": "062fffee-fbc0-4dc9-8dbe-8c38ed32973c", "value": "T15B442906F75360EEC927C17483ABA333B531BC5E5230AE3A9798CB753D52E505A39E18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638461, "uuid": "fd64de0e-f490-4936-8d05-b0b13441b568", "value": "c8a12676a80634473c83e0bfeb54ef67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638461, "uuid": "eb0412c3-fc05-42ab-aa4a-1698ab41ba69", "value": "6144:I6XwtxAjXDN0BQz1wSXgoIOrcCnfUn9XNk:NcxAjXiwwYgoFwCnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638461, "uuid": "8b452355-5989-46c9-b159-208a319b373b", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638461, "uuid": "f88aa649-8bd1-4afb-8f1d-c247cba1b2a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638461, "uuid": "ccaa1cd1-71ac-4f1d-b156-d2e34d2b4c8c", "value": "MasonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6581c4-6102-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780679710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780679710, "uuid": "80027d5e-0673-4263-abac-353f7d61db29", "comment": "Malware payload", "value": "94f87dd3e754d495a8d9955b822d20d2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780679710, "uuid": "09b1b43b-3d7b-420b-9ab3-dfef5538a5a6", "comment": "Malware payload", "value": "4663574a09ef5d8a7e9e4061f68c52c7b6d960924ae93bf611ea5b1c7a20a836", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780679710, "uuid": "121610d6-e9d2-4c48-bdf1-29890fbb0b25", "comment": "Malware payload", "value": "ca980bcd196ff95bdee72a565f9d77538241ad42", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780679710, "uuid": "ae3611fa-f9ec-4d3f-a51c-c1a86c42de72", "comment": "Malware payload", "value": "6c41dd6fd89603ca655e866195da93f6943b4051b429b6c5303c31f91de0c7045cdda803e0d5663d7663887b69e41cbb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780679710, "uuid": "e88d23e2-3896-4011-ab7d-c7c36a45ab64", "value": "T1EE01ABCFC142DA10119AE89E729765907410C3CB6B5A8FF8BF8D483D9FA97887116F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780679710, "uuid": "efe9a0d8-b44d-451d-82a8-c4e13ebee489", "value": "24:kXCKysE2hi0ziQvZohaY1hljzEj56vr27:e9Qp+MsY1hljzEN6D27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780679710, "uuid": "9ee96293-b430-4761-bf36-9e6bb729f4af", "value": 838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780679710, "uuid": "b5c3c1c5-4755-4349-b5fc-bf98513b38fa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780679710, "uuid": "7e8908c8-bcea-4b47-aad0-1933de3aa859", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb09ebb9-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780641860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641860, "uuid": "b7fef138-79c6-4b25-9abb-c704bff5269b", "comment": "Malware payload", "value": "09e129d42bcaf6d7a8b4001fab983ad1", "object_relation": "md5", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641860, "uuid": "0578af39-96f6-4c73-be88-06d3f44a6e31", "comment": "Malware payload", "value": "467d3e3425618f895e5b16e01fdd3e83d781ff3ab0c959eaa8f080d17dbbffcb", "object_relation": "sha256", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641860, "uuid": "d4f0e34f-c2eb-481b-9f7d-701a08aca12f", "comment": "Malware payload", "value": "4116c80d48f21aa17b3ffd2268b98decefdeedda", "object_relation": "sha1", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641860, "uuid": "f33549e9-c0ce-4ea7-b59e-c88b54942d78", "comment": "Malware payload", "value": "4de47af4d685606d0ea29512c0f0c8505fa16d6e0038f72187206618a83004923071da38f96cb3612ee5cdec63498f58", "object_relation": "sha3-384", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641860, "uuid": "8086253b-aaf4-4ccc-b94a-0d9d44932179", "value": "T11327DFC1B324F548E7550570982936A849662A303754D9BABF8B7AC2593C2E6FDF0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641860, "uuid": "6a021b8a-76d6-4bf6-840f-532f1085bdec", "value": "3ecd0513159f9c9478519529fde14fbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641860, "uuid": "b1dbd7e8-4111-4f0c-9769-80c051b59c3b", "value": "393216:Ha+n2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlkN:Ha+K2OGfEhP0JqHOG8qN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641860, "uuid": "4dfabab2-b063-4ee3-a1e7-ac231b024ebf", "value": 20757064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641860, "uuid": "3565af65-62d7-4784-a658-6b2366267b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641860, "uuid": "2ded2703-d4b6-4f42-a9bd-4b88ff541256", "value": "467d3e3425618f895e5b16e01fdd3e83d781ff3ab0c959eaa8f080d17dbbffcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968308a8-609d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780636537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636537, "uuid": "60afe2f5-ad30-4e7d-a468-61df1a911beb", "comment": "Malware payload", "value": "c568b314b96f8564f12a72887f50bbd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636537, "uuid": "c82716b1-5209-49d5-ba9a-28026ca92330", "comment": "Malware payload", "value": "46b6ca6c9ca77e8cee8e519ee6ae891d5313f168f3077a1a10db7a349c108f4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636537, "uuid": "45ce8816-9d01-42bd-beb2-27e6090541e5", "comment": "Malware payload", "value": "4813dd929e3b8b8ca6817746d082448c8f3e6654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636537, "uuid": "bf88dcfc-9141-4b8c-b4fe-5cbb3eb39f5a", "comment": "Malware payload", "value": "30858f34e4ff766dbc2e9264249e1b8cad8ac71f2c2ea4f7101061ff9b8d19e6fb0600a4290e80dbf6d9fb6d408c56c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636537, "uuid": "fbb3d2e7-63cf-4d8a-9f8c-fac2fdaf7cea", "value": "T16B93290A63EA20BAE4B6537858F20253DA3179B15B7B96EF12C4C5BD4F236C0B531B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636537, "uuid": "3f9a66c9-6b7c-421b-9bb7-796d550b3753", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636537, "uuid": "ebc839d1-573b-4818-bfdb-1f3e10f3711f", "value": "1536:1rae78zjORCDGwfdCSog01313ss5gfhNseKyzFuX+kL:bahKyd2n31F5SjAXVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636537, "uuid": "ba21548f-cfca-403c-9410-6588459696cf", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636537, "uuid": "3657510d-c2f2-41cb-87f6-716661ca8269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636537, "uuid": "0af0cdaa-86bc-4b3e-a107-ac3daeae156c", "value": "46b6ca6c9ca77e8cee8e519ee6ae891d5313f168f3077a1a10db7a349c108f4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cce99b-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780642010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642010, "uuid": "1612dec3-90c4-4208-b13f-daf009660c73", "comment": "Malware payload", "value": "839bd1807bb332da56737c25f43bcf91", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Illinois-Precision-Data-LLC", "colour": "#0CE210", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642010, "uuid": "acfe6605-1096-44a6-92da-65f82a9ff760", "comment": "Malware payload", "value": "46d578d2254a41d96db78c662c77e8599f916c4526c466fc3adfc12c0f7e3f1c", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Illinois-Precision-Data-LLC", "colour": "#0CE210", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642010, "uuid": "0054d9de-e442-4bb7-96b8-8fb547f32fb8", "comment": "Malware payload", "value": "be60b1800550e64d1e200c2317b2ee918470a7d8", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Illinois-Precision-Data-LLC", "colour": "#0CE210", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642010, "uuid": "55a454c7-8631-4f72-9750-81a110fa2143", "comment": "Malware payload", "value": "19090682de066ebebafa86d8c371a02de3a339dc63b2d01f36026b0e85fb4c26e9101ca144821cff5617874d1b6a7e2d", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Illinois-Precision-Data-LLC", "colour": "#0CE210", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642010, "uuid": "1ef83072-faa5-4b01-949f-69a3b0b8a3cc", "value": "T10736AED0A266F994F78545701419B7E4865A2A303715C8FABFC72BC228286C1EDF6F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642010, "uuid": "1e6065c9-cca6-43a2-96fe-e9d8fe21db70", "value": "d27218346166befdcdd5a700bf37c2c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642010, "uuid": "da77f560-37a1-4dac-955b-ebc62aa020af", "value": "98304:NdZEMtDjewxWKmf1vojLT3xdSbEOdkWxAuTeu/sTVj3HqhMvLrvM:DZEMtDKmmfKT3Og65Tg53KqzrvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642010, "uuid": "9c7c81a1-2da9-41da-a503-9c5278989fa6", "value": 5062488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642010, "uuid": "665293ba-e92b-4e2a-81e6-3aba6f3109a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642010, "uuid": "3418c4bb-ed22-4204-9470-bc967abc05a4", "value": "46d578d2254a41d96db78c662c77e8599f916c4526c466fc3adfc12c0f7e3f1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03730fd8-60e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780666785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666785, "uuid": "e2074c3e-d6c7-425e-aa50-05db518c54ec", "comment": "Malware payload", "value": "9501d9dd8c28e162ffaef1817c538cda", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666785, "uuid": "b3f9ad36-bbcc-4222-9a86-fd3a999676c7", "comment": "Malware payload", "value": "4779260de4cd7cd23075a9fa70597b8af87ce32b05787cdccecbd0d8848c03dd", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666785, "uuid": "0be13331-74e0-4c58-b092-3f1350d1cc52", "comment": "Malware payload", "value": "249eec1c6cfb2324386f2187f690d3fda64ffd9d", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666785, "uuid": "a0cac1e6-910f-4470-b7b0-0d2edb639452", "comment": "Malware payload", "value": "63381e27323f035a0292f251b2b519b600f8a3871172781df91b133e8316ebd38b859918aac9ded9cdc8b16e239a2bbb", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666785, "uuid": "b7311bfa-5d7f-42a0-bd37-d1c753e2492e", "value": "T14A646C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666785, "uuid": "44e4a59a-3c5d-4939-b2d6-09b31053f336", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666785, "uuid": "564fcab0-74fc-49c0-ba06-615522bd80f3", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666785, "uuid": "700219b7-d6ea-4a96-9ffd-ec2a5bf8f2fe", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666785, "uuid": "c0bb8710-6cff-4356-a907-2022119f8c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666785, "uuid": "40657d02-d2a3-47f3-a9c1-6ec7d338db3a", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325b4c14-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780641523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641523, "uuid": "4ad1d35f-e84d-4f25-9320-a2c96f6d0f2a", "comment": "Malware payload (Mirai)", "value": "58967a737bf98212d8ae6c6be68f565a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641523, "uuid": "3e5cc3d7-f498-432b-ace5-8c70216af0b9", "comment": "Malware payload (Mirai)", "value": "47a4c34aa99f24ac94bc6258fb8cc79714435217ee5925959dcf80560e1f62b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641523, "uuid": "6c948309-a49d-43c7-a35a-544f8cb14fcc", "comment": "Malware payload (Mirai)", "value": "2784fd0913856c29cb3bcc6151ecccaf2873d464", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641523, "uuid": "8516c99c-6307-4a17-a2dc-27d79b4f3742", "comment": "Malware payload (Mirai)", "value": "1d15f9772e1f4334b899329ccf95a298a55d740f016e423d15c11facb0762592bceaefe7b0cf436b7cce94f37e3013ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641523, "uuid": "3035eccc-c627-45c0-aa11-abe3ef8e4e6b", "value": "T19DC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641523, "uuid": "856bb5e2-adc9-4635-9a02-9a1adcbe9dc2", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHofrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIfrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641523, "uuid": "c406f06d-11d4-4cf0-a8bc-6f644d7d7097", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641523, "uuid": "771822a7-0dab-41fe-a69e-4bf092969bbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641523, "uuid": "782d92cb-e05f-409c-9dde-d4fc48ce1e88", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5138b797-6076-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780619671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780619671, "uuid": "1bad0ff0-fe2f-450a-a9cc-01fce741bed0", "comment": "Malware payload (Prometei)", "value": "db5cdc035f4f45a3c7f289cfda7fd973", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780619671, "uuid": "f2a9b012-91c1-44d1-b242-972bf88f008c", "comment": "Malware payload (Prometei)", "value": "4864af3f8263b5108153d3d010fdccfa9e0b152c95b9554d806781bc20ab7a85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780619671, "uuid": "68bc50d9-f001-43f0-92c7-1e60d19cbf74", "comment": "Malware payload (Prometei)", "value": "55d1c9d63bd39a1f8cf143572ba24e3befc20464", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780619671, "uuid": "22e40de7-f386-4e5a-9f96-c6caf6fe5886", "comment": "Malware payload (Prometei)", "value": "2bcec3383daf6b7e9cf79c3232da314cf1148b2e7f9ee465856b02e3757cb01d52c6b8cb3a70a6942b1b003f88f8ddd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780619671, "uuid": "67b5c8a9-55e9-450b-a13b-4e5973e55127", "value": "T1DFA423B4F9219E9F6DD769F91B24831DE182C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780619671, "uuid": "81b7fb45-4c53-45c8-af32-ec6190f2582e", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdES:Fs6pyCC/Ya2hpi6T6N4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780619671, "uuid": "40241df3-92f9-4d2b-9512-da24a9f43ad9", "value": 449082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780619671, "uuid": "edda3a8e-ccdf-4bc9-a88c-ab98496f7594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780619671, "uuid": "1083aa2d-cb95-44f0-858a-7bd120d65ed5", "value": "4864af3f8263b5108153d3d010fdccfa9e0b152c95b9554d806781bc20ab7a85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf7dfa0-6104-11f1-a769-42010a9c0008", "comment": "Malware payload (Koceg)", "timestamp": 1780680895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680895, "uuid": "b41e35c1-3512-4b40-b558-aeb38beb8b3d", "comment": "Malware payload (Koceg)", "value": "5047a95210544662b36f780f384df2a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680895, "uuid": "c01b1b4d-eb2f-4906-99c5-8b96efa81182", "comment": "Malware payload (Koceg)", "value": "48a8f24c8fb4117c63e87865b107c6b40a26d53777161526b19919b84afd7742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680895, "uuid": "0ecde8d7-d156-437a-92b7-d8f666770ba8", "comment": "Malware payload (Koceg)", "value": "2a5cb186c0fd5e685b5c9f9636475cffa9effe81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680895, "uuid": "60641301-e6aa-4f33-9e89-9f79d68f1d9c", "comment": "Malware payload (Koceg)", "value": "7b0d5df8de3bdc3eff4e54a67f9d5524268604498a72ea45c3dfd062d1038f14f30c05e6ae87bf6152fb28b685927447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680895, "uuid": "fca769aa-7be2-4c1a-b55d-e899b9fa1aac", "value": "T1C2B42300138BCFC9F41271B11BC33BB46D36163F89698FAA03EAAAD15BB789D48D5457", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680895, "uuid": "3af7fdf4-97d8-42cc-a562-638a956f788c", "value": "08b656407b8d307979dc72c3fcc683a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680895, "uuid": "e0d90f8c-0994-4c66-ad41-18f04e89b4a6", "value": "6144:ACZlWG0GN7xOz2x23dNs4U1JOhtpWhkPTu8P+6zW:ACCs5xOKx2Nhfpnbu8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780680895, "uuid": "39be36f6-6380-4b63-be08-25b9c1dcf320", "value": 507970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780680895, "uuid": "e7319bd1-d004-42d4-9095-aeae25edda72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680895, "uuid": "c451777c-e146-48c3-9b2e-3671cc9386dd", "value": "autorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688d7a76-60ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780657505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657505, "uuid": "4ac0c744-fb8f-4b79-a7bc-b44959123ae0", "comment": "Malware payload (Mirai)", "value": "d834bc370cf6dbe2a31b5f8d97924dd5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657505, "uuid": "cefd7e6b-e7d5-4333-a329-c24f655dab7c", "comment": "Malware payload (Mirai)", "value": "492bb0ff574bfc664100c06e4268a4a5c1c1d41c700f4a7f97ce18ce66754279", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657505, "uuid": "310dab95-86d4-406e-bd1a-017378b85924", "comment": "Malware payload (Mirai)", "value": "d915e30b3561250b34b4d8230f1812572672e841", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657505, "uuid": "5c127142-4345-41fb-8ddc-b869841aee01", "comment": "Malware payload (Mirai)", "value": "707e8919c4d71543a1901dc28c7d17de300e0ccf43c477bcdcacdd1b56eb2736c4a320411a31d0f51bf754a7712a525b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657505, "uuid": "54a87257-6008-4c5f-880b-b7f43cba036f", "value": "T1D8732B81F54B80F1D847487090BBF33FCE31D6954175D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657505, "uuid": "5d6cbc08-e803-408f-a82e-0e00a4bbea72", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbSSfFWLIk1Q9j+Lxty4AHD:uVFrPNQn+WVQ3EXVUk29jgxOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657505, "uuid": "f8b18588-5e7a-4b53-8cea-75a51ffc30df", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657505, "uuid": "8ed33a30-f1f9-4f5c-89b6-59f8ed1710b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657505, "uuid": "7117e383-b70a-4c05-9bbd-2277cf2c9338", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2e0008-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780648544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648544, "uuid": "6cce416b-fd5b-4c47-add0-5358d430fe14", "comment": "Malware payload (Formbook)", "value": "a49e8d526ae379361ddd2fb8c0fc19f5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648544, "uuid": "089674f7-98c5-45f6-ac4d-101ff665344f", "comment": "Malware payload (Formbook)", "value": "49ddc928da852b656637cc5272964d5b7e6affadc387d1651fe6626c7d643767", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648544, "uuid": "d3eb333f-e6bb-40ef-b0ac-019bca8f1efa", "comment": "Malware payload (Formbook)", "value": "9889780e3a7622b98f071e08d4f93934feecaf4d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648544, "uuid": "0d34fe81-aac2-4640-9501-f9f35cb00af1", "comment": "Malware payload (Formbook)", "value": "4df7d54e803acb819d17e1081a41a6a108953360e17175d71246f71e89eed55405807e1c66892a7aeae89e851d13995d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648544, "uuid": "9d3bf21f-f815-4ce1-8cd8-f698e7e963e7", "value": "T179E55C17C66F9B4D180A3B61106A5D9AFE99CAFCEF726BC4E0CF90B110EE1110B855B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648544, "uuid": "16322363-79e0-4eb0-83fd-9367cfdb82e5", "value": "49152:0AP8hY8rmsKZrsWF52YhnnrjMjhXOmj6JPX2I7epAd3dQp6BZ8enDFm2:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648544, "uuid": "6a6e7ed7-632b-4cc9-8934-874d3284bd51", "value": 3167080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648544, "uuid": "e3e20647-9d5d-4b12-af7d-91251f17d856", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648544, "uuid": "f667f731-5652-4ac5-adf9-f3317fc189f8", "value": "Siparis_teminat VadeUzatimi_9225065_583612.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332c24f4-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681468, "uuid": "df8b4a29-f2cf-4045-b5f2-c351b4f6c7b8", "comment": "Malware payload (Cosmu)", "value": "9dbbea94b6b59644e62df62bd02fb871", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681468, "uuid": "c2b8d862-2f3d-45e4-a53c-9c79d1cf4ee1", "comment": "Malware payload (Cosmu)", "value": "49f94a21a321f2ac9b1027b11153e90ca769df469e8055fbcef2df031c66f1f7", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681468, "uuid": "945c9c97-4972-4a67-9b7b-48155adc1caa", "comment": "Malware payload (Cosmu)", "value": "64475b39e11bea84195aaee6c83c954311f13296", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681468, "uuid": "123af73d-786d-4008-88f6-0638cf61f1d3", "comment": "Malware payload (Cosmu)", "value": "cd3748621234458a9cc3e8e29582ac124038b26b869697f512f1df23e2e1cd05588c08bf4769c5ce26488c3ac98fa4ef", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681468, "uuid": "fec1a293-cfb3-4253-93c4-1a29cb8cb947", "value": "T10154F2457DA3C4B3D0414D3188A68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681468, "uuid": "91bedee9-3189-4c59-a4c8-57d6d17d75bd", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681468, "uuid": "a52af6c0-e463-4947-87a5-9266ff92d9de", "value": "6144:uFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bzl:JfBQGH6SfgoAX+U4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681468, "uuid": "fee70812-9c79-4698-a92b-219eb3887ae0", "value": 290817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681468, "uuid": "a1ef8f1a-73e9-4320-9b8d-e322b270aec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681468, "uuid": "504924d4-4607-4707-bca0-7cd2b2ba9907", "value": "AcrobatInfo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cd5eed-612c-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780697716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780697716, "uuid": "c293544e-e690-4887-99ac-7f333a46838f", "comment": "Malware payload (WannaCry)", "value": "7df43b08fbd90d2173395478f901340e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780697716, "uuid": "1482db40-5fd3-4435-b8b6-b21f98d0e79c", "comment": "Malware payload (WannaCry)", "value": "4a6fa4771380ee3e39cd0b4949e1993acee31f4b83367907b22010841e330789", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780697716, "uuid": "a75392e4-2a37-4f3f-8b7a-6514869562f2", "comment": "Malware payload (WannaCry)", "value": "d9b838ba2513174e7a3e79dd068e1e320d78719b", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780697716, "uuid": "2c009351-0981-4846-b389-cb7f557aa205", "comment": "Malware payload (WannaCry)", "value": "fcc3b92504e16b3ec9afd39e68ba0d3a2966b631aa3102c7a26b7a78e7dc8190adb58e12f50ee424a5268d0a1b86a922", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780697716, "uuid": "59d860ef-f7f0-46b3-a34c-6e8277397060", "value": "T10436126131A8C0B5C117503484F78A21F676BC2A17BA964FBFA04F6E3F73791E625B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780697716, "uuid": "48bb45cb-209f-4e08-bb7f-1449122caa9d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780697716, "uuid": "2b701fb4-08f1-4c59-8a8d-df980c9a34f1", "value": "24576:jbLgBbLguriIfEcQdhirYbcMNgef0SVXmiHkQg6eX6SASk+RdhA:jnsnpEhPbcBVsX1HkQo6SAARdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780697716, "uuid": "ea470f72-963d-4360-a823-80d25d42bc4f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780697716, "uuid": "0b43d9c2-3a2e-47bc-a175-0f4685fede73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780697716, "uuid": "ef5d03d1-74ba-4e8e-bb6d-df358edfa579", "value": "4a6fa4771380ee3e39cd0b4949e1993acee31f4b83367907b22010841e330789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d941efd1-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780624194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780624194, "uuid": "ceaafbd4-1aee-48bd-8e05-89b06a049946", "comment": "Malware payload (Mirai)", "value": "54121bde7c78e9f309af7c566ef5f54c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780624194, "uuid": "84033461-df19-4e28-9d88-05650d6a2b45", "comment": "Malware payload (Mirai)", "value": "4ab96f447a3fe783269b9bebea3c02ced3338ac4948da8b84a29664cfa2c509b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780624194, "uuid": "b9f2d929-1eee-4420-ad6d-9372714bbc48", "comment": "Malware payload (Mirai)", "value": "6e6d12cadbdf94ae96176e6d522068cc9a1c6bc8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780624194, "uuid": "b82b5f9d-ffbc-4908-a3e9-9c3c4dc7184d", "comment": "Malware payload (Mirai)", "value": "6697f3359fbe33de72261ea2a484215fc8f65e9694e313cb6de592b4f6efd855b8f700a436c5bf8659de351b5a92c26a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780624194, "uuid": "96f7a75d-0324-4a3e-8799-f78f8574b356", "value": "T1E711BADE30EF24B55C02BE42B05188D4F549F2DBB9A69F48FC848EB18597BB5302CB85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780624194, "uuid": "638b4018-6856-4213-8441-67437770e566", "value": "12:xpZSFNIstLKuavD9jXWkdM9ISRpK2EduXU:xp8FNImKuAyRpKGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780624194, "uuid": "138c7b45-93d7-46e2-a998-237f2575fd53", "value": 942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780624194, "uuid": "db02cbd1-417b-49a0-9902-2cd980e58a71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780624194, "uuid": "311e1004-71b9-400e-9f13-15b102c9814b", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db32493-6105-11f1-a769-42010a9c0008", "comment": "Malware payload (Koceg)", "timestamp": 1780681109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681109, "uuid": "f51b7252-af3c-478b-bc91-c4bc65cffed1", "comment": "Malware payload (Koceg)", "value": "91739410fc9d4f8c7ff94fd8d5e32014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681109, "uuid": "1f56c27c-781d-4e29-b757-ae83774f2dcc", "comment": "Malware payload (Koceg)", "value": "4cabc750bf79818cf08b1db4dd373a01cd9c041f2327117fb51026531cf38a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681109, "uuid": "e09d3a8e-77b7-4f5c-a92f-2cb0fbbfaf12", "comment": "Malware payload (Koceg)", "value": "06c4f8da6013f6ff2d6bf6737e5fabf6ea9066e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681109, "uuid": "0dbc3bf6-ad7b-4951-82ee-0f2a3cf2ab6e", "comment": "Malware payload (Koceg)", "value": "87594dab8ed6dc891c7f6c8b1c161f166f902453e561e228372016a13a34372ea95d7ea50eec78e92338f24f630b3c01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681109, "uuid": "9a7405b4-0b14-460e-8690-af8645eb3649", "value": "T19BB4228413AADEC6F086327107E31BF12F22357BC5A59F511BB95BE117A758A48C04BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681109, "uuid": "e36e2bbb-8f7b-423d-b8e6-f59c7213301f", "value": "08b656407b8d307979dc72c3fcc683a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681109, "uuid": "c58d8aca-d817-4df4-9eed-37613df48c47", "value": "6144:ACZlWG0GN7xOz2x23dNs4U1JOhtpWhkPWPbGvOJ3:ACCs5xOKx2Nhfpn+jGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681109, "uuid": "d7d1e174-a3fa-450a-8f7e-e7878ea2189c", "value": 539010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681109, "uuid": "97aa1a6e-1b2d-4ad8-af2b-7aebc282e6bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681109, "uuid": "0b6c5a16-31d5-4c66-9260-a06888b16bed", "value": "autorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4c2399-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780642853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642853, "uuid": "8a087cca-47d2-4e7c-af7e-526b9ce0f3a7", "comment": "Malware payload", "value": "2b5ee82548199a49ff06e001cade2ada", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Multiget", "colour": "#B4593A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642853, "uuid": "bb4b87bc-8db5-422c-81a9-7b012b41709c", "comment": "Malware payload", "value": "4cdb1f7ac502289119f7f8256f00baaa994e6ecfb4000dcf5e1c46073508fcb3", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Multiget", "colour": "#B4593A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642853, "uuid": "9f354f4e-7b81-4af8-bbfa-c65870d9ab5d", "comment": "Malware payload", "value": "e507582d95494f35cbc2d4c1198e3e26336cebad", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Multiget", "colour": "#B4593A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642853, "uuid": "cbecd2f5-3e41-4324-bd0d-a7718da5bfe5", "comment": "Malware payload", "value": "ed32761305df884467a4d17d8b49ba0f63abe8495d9120ad5aa2775f96a57a61aea0acae1ab54f257a2dae498b699fef", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Multiget", "colour": "#B4593A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642853, "uuid": "343a2a50-cf11-4468-8ec8-3b615ab06d18", "value": "T16FA611C17351F822D35A12708C26B7B5825A59303710D5EBFF8F3ADA5E685C1EEB0A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642853, "uuid": "a87e2abd-acc7-4852-9a00-4a1e4f425eea", "value": "baae4b65b4c9d53582db6b26f06ee49e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642853, "uuid": "35b88d76-135f-4e69-a664-22e0ef1c842e", "value": "196608:p5TaWxiNF4Qm7K3eu3jeLCueVuV24ZG4mgTVpjQMAcAzL6nZVkbqw:vTaWe+UvSt9G2RpgzL6ZV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642853, "uuid": "8631141f-91f0-466d-9fc9-a20a5e4ba4a3", "value": 10372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642853, "uuid": "59cea857-a205-4fa6-bd37-1d5b37684ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642853, "uuid": "5babe803-6fb9-4732-8250-d6634162879f", "value": "4cdb1f7ac502289119f7f8256f00baaa994e6ecfb4000dcf5e1c46073508fcb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83799c9a-60ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648961, "uuid": "412a837d-0d95-4c91-a4c7-093e95e045ba", "comment": "Malware payload", "value": "11741e4adafd94a45981e4719e6705f9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648961, "uuid": "177d78a8-a9c1-434d-92ee-ddf19ff4a582", "comment": "Malware payload", "value": "4cfbd57289d0d26ce9be0a5c60d1b697e202bf7111d274740112b1edfce25a4d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648961, "uuid": "508eef7d-2b75-447f-a5f7-8b7945ea46dd", "comment": "Malware payload", "value": "961acc931f927f1f197baacf7beb503731c7a9fc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648961, "uuid": "8061fa4e-f414-4f58-bc83-2ffef0967170", "comment": "Malware payload", "value": "1237567dbb3f0877945fb7c949c5fb5e4b20f47d306c1080b2858d507a977530c0a353441e9787649ada80b0379d757a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648961, "uuid": "1c39884a-8dc2-4c60-b63a-f352b637d53d", "value": "T16D016FD98116E7504189E89E22D751907420C3CB65454BB87F9C443DEBB97487169FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648961, "uuid": "45e3b42e-abfc-4836-9da3-8c6b4ff2b3c3", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkauIEFSI4Una9IPFrI9HnSIabpuauD:kXCKysE2hi0ziQvZohauSpwjpbA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648961, "uuid": "0710d744-d495-4e1a-9215-5ac40abdab3c", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648961, "uuid": "b16674e0-5b11-478a-b6ca-432873e775e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648961, "uuid": "a9315e85-6b07-415c-9917-1f6e24c990b7", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdaf21d-6083-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1780625272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780625272, "uuid": "c2a26983-41c9-4a8d-b8c6-a66bc3597475", "comment": "Malware payload (Joker)", "value": "9c9c662e480de8052a2fc85acf86c1a9", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780625272, "uuid": "a7a86dc4-a031-4b08-9180-9f95e0690a05", "comment": "Malware payload (Joker)", "value": "4d182ced3c48ebddd6dd2994509cdf0bb246546db6520b967b941607f6f27978", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780625272, "uuid": "a34dc40b-1699-49e0-9949-bb05add0514c", "comment": "Malware payload (Joker)", "value": "a7cac7b35470eee14a40a1dff81c54052541b9f2", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780625272, "uuid": "99251bab-1bf0-4fe9-8e65-3f8e66827e01", "comment": "Malware payload (Joker)", "value": "b762858f9069632518335984b76ad8dd1159fb5dde0e19805c733aadaf95e16fb8204936439f5c485556371fdf535ebf", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780625272, "uuid": "33ec708c-e396-4e68-bfab-eeb97bb33d0e", "value": "T19367F249FA0DD42BDECAB0BC8D9F0793B56678551614C18B3822820DFE937D49F26BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780625272, "uuid": "d45ffc55-6b88-4a72-81be-d711633e684b", "value": "393216:SHNfW9KBrhWX+bEecoP2F8qYnTMVHqmZnS3ogr1i/ilYyvZeprQxCuKrW701QCFA:aoKBrw9ecURqJKOnSji6F8cFv4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780625272, "uuid": "31a807d1-097e-4c89-a0d6-345c3cf4017d", "value": 31439069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780625272, "uuid": "120c4470-5cf6-4f94-8215-18d2a94461b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780625272, "uuid": "389b32a1-0ed2-443a-b2f9-bd8848ee6d87", "value": "Fashion+Chat+Messages_1.8.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d24fb1-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780623914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623914, "uuid": "b01f4276-ed58-460d-a177-137d7bd5672d", "comment": "Malware payload (QuasarRAT)", "value": "0dfecaf21f024e106f323aa2dd668461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623914, "uuid": "199e92d7-3728-432e-8652-d975e29690ba", "comment": "Malware payload (QuasarRAT)", "value": "4deebf56cf37840df28dcc8fbaaff10223300a0834f564aff2b89d3875abd900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623914, "uuid": "771b0b6e-39a4-49fb-a957-f30acbccc1dd", "comment": "Malware payload (QuasarRAT)", "value": "81ac796b4ff89f3af972645917e296cb13e9a67f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623914, "uuid": "a20a82f3-1ab5-43d0-af2d-22a99aed09ee", "comment": "Malware payload (QuasarRAT)", "value": "469d44c8abaf7a4984746ce4c515e26089501edceab948c3ae2164da716f4e853cbadd9d24abc7e04e3ae0322f5c5192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623914, "uuid": "433ae26a-e28f-465a-8e35-df6c6b446324", "value": "T185E55B143BF85F23E1BBE273D5B0041667F0E82AB3A3EB1B5191677E1C53B5058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623914, "uuid": "0b017145-92ca-4eb9-8fad-768ff98a5cf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623914, "uuid": "4a8cfa8e-59ba-49b3-a596-3f1ec1148351", "value": "49152:avkt62XlaSFNWPjljiFa2RoUYI7x6EMkEk/JKBoGdBTHHB72eh2NT:av462XlaSFNWPjljiFXRoUYI7xzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623914, "uuid": "aca4a166-d65b-4465-b5f0-6a9df482b7df", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623914, "uuid": "9eb9c942-33f3-46ae-a7ab-65c5d83a42ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623914, "uuid": "1bfbfb63-5377-41fb-a189-0385525d6c10", "value": "4deebf56cf37840df28dcc8fbaaff10223300a0834f56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75cc192-60fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780677502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780677502, "uuid": "a496c6c5-af17-4a65-9351-78cd84234ae7", "comment": "Malware payload", "value": "b5f122f3f07f618c0a7678fa40801faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780677502, "uuid": "88e89844-9b6d-4f08-84bb-7506ba479292", "comment": "Malware payload", "value": "4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780677502, "uuid": "a221d71e-738d-421b-ae2d-b01d70845513", "comment": "Malware payload", "value": "7440358c5041eba34e8673100989df756a6426da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780677502, "uuid": "a7c8abdb-4e2a-4a5f-bca6-6d279268101b", "comment": "Malware payload", "value": "76a24bb12e280dac955a80649bad14f8998368702c60dd940cf57231d952270215b8f883d273507432bd8b19c0df69db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780677502, "uuid": "d7c74998-e5ae-48b1-bb3e-03e924e0cb33", "value": "T1CEF37B22A29421E8E56BD5BCC1429727FAF3F4811720C6CF47A089A92F637F1F579391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780677502, "uuid": "7403c4c5-c50a-4de6-ac34-34295780bea3", "value": "7afd4d4bb61395a3cd7d1b040e1cfd9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780677502, "uuid": "b03d33fe-1a4c-4295-a25d-67384fe83ca5", "value": "3072:ez/App7eWoqDigbz8LFbt3qmIONEffrCGtVrYZcrCGgTgdGxOKd0Nz0dChQVNY:ez/83o/hbt3qmIZfMgQV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780677502, "uuid": "1d3774ad-cff3-4829-8df4-3204d1123a16", "value": 167096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780677502, "uuid": "de9619f0-7620-4e17-8864-5274f782d401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780677502, "uuid": "28c702a5-e31a-4374-8b76-25111d6e8aea", "value": "x7992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f57720-60e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667834, "uuid": "92087cdf-8da5-4819-b0ce-f07113aab969", "comment": "Malware payload (Mirai)", "value": "72f0c19369e5b35c70bf57cf31367a76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667834, "uuid": "d8213367-7055-49f6-9d6a-580c3111faa4", "comment": "Malware payload (Mirai)", "value": "4fe5088330fdb8b6e9cd8db5fdd5351724bf53ee301a59de4d42fde2c7a227d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667834, "uuid": "3b4f93bb-657d-4636-8c1e-a1dbcadb9e69", "comment": "Malware payload (Mirai)", "value": "94516e91903418f41d49a3338e95f07179c4e901", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667834, "uuid": "27f5c7b1-303d-4108-a6dd-e7b53c83bff6", "comment": "Malware payload (Mirai)", "value": "45e9a1e0d6c4b9efc10544475fc7f4ce024f09638ebf4b19d36840b696cf0c5e068b3c99f453fb1fee5201638742a889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667834, "uuid": "799a13d2-d2c3-4347-b12c-688ab4d2455f", "value": "T1FFB3C60F6E529F7CF72C82354BB78B399759239233E0C585E66CFA405D6024D286FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667834, "uuid": "54912a8c-eec0-4a04-aee9-4c28a8117971", "value": "1536:NvQ8u369OGUy3H6qZ6qyRq7U0sURpn3NvSSN2IlabOYKXRiCI2qTC0e+cT:Non69D3YCvpNxlt5BfqToD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667834, "uuid": "4348b558-8981-40c4-81b5-9ed8cb8d68fc", "value": 116164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667834, "uuid": "b0436bb7-49d4-4399-bba2-645d1aa9562c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667834, "uuid": "d799ee23-402c-4dbf-b9d4-baf35a5dac34", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ecb428-60f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780673664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673664, "uuid": "00539894-7aaf-4265-a3dc-2e04739f82e3", "comment": "Malware payload", "value": "a3ca57dc3eb1fb3988cc5aceb0d8ff54", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673664, "uuid": "7d007d09-de21-451f-bb1d-f76ebb170360", "comment": "Malware payload", "value": "50b0229169e676da20b47d3586c6606b255ef3a5bcd1544c8286c89b92f218a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673664, "uuid": "623920bc-7365-4f6b-b5c0-c0afc54c7386", "comment": "Malware payload", "value": "8aebbeb34e5c7c3a953e3d4c78453de339413c66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673664, "uuid": "c09c3a04-e9dd-4285-b2f1-3f11a4d0a9d2", "comment": "Malware payload", "value": "6069a2d4ec8a14a30d2fb2f346fed2139095c9872e365595cb8ccf7a1acf42b2f829e2e6a40ec4c6b7d2ae6256b3fb36", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673664, "uuid": "410db7a9-5ddd-4812-899b-33778e5975e2", "value": "T178D2D034C4C82FBDEE9A2A1D06FA6620D7D68B1E9498860737037D9B4F37C80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673664, "uuid": "c3a29d73-29f9-42a9-a012-a8df4f6b4dd9", "value": "768:CumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Cu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780673664, "uuid": "902905b5-3aec-4089-9b28-09a3f8aa36dc", "value": 28658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780673664, "uuid": "37d5ec4c-f3f0-4aca-ba15-be2dca515b32", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673664, "uuid": "dd8441a1-2488-46f3-8fe6-ced44f3de41f", "value": "23.94.110.24_1780673628961978_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5548ca5-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682196, "uuid": "090b0c19-a5b4-46ae-96cf-a46f7a72a262", "comment": "Malware payload (Cosmu)", "value": "9436c5ca0e6e3a01d1ea9a4109b0d8bb", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682196, "uuid": "84a7e234-e74e-41c6-8be5-2b0667da1c55", "comment": "Malware payload (Cosmu)", "value": "52417f4ae808c793de226d661495f8c282145a816a36c117080d8c633f04e942", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682196, "uuid": "289facb4-4205-4739-a1c2-6240c3617fd6", "comment": "Malware payload (Cosmu)", "value": "4b247a188212ec0f12c145935b59d95285dea062", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682196, "uuid": "dcccc7a0-69fc-4350-8bb1-e72663110e75", "comment": "Malware payload (Cosmu)", "value": "9755f51b8815225a1efc5b9702f3d6897d9c90dde00cdd820a3d0548f67e24d2e1e150792340eb0ab26d52b05dc4244b", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682196, "uuid": "4f1f6fc8-43a5-470c-9585-debf3b26f48d", "value": "T11254E1453C539873E0424931C9E9CAD18B7F6D1376E2E16FFFD80E4B1EB12885AA6271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682196, "uuid": "409702fc-ecae-40b9-8eaa-fdfeb2e76b33", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682196, "uuid": "f38caa28-0345-4cd8-ae57-50a4af9a8911", "value": "3072:xZUWlN3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBgQ9:7FAlKgzelZNQSBQGH/CSpWqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682196, "uuid": "c06e5db7-651e-45f1-a488-0b3c8aa3b183", "value": 284361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682196, "uuid": "ee2be8d0-30ac-4b50-9ff4-8ff061a1d544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682196, "uuid": "454c7ce0-7a8e-41eb-bfc4-9e2ecde094f3", "value": "browser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb430c0-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780643124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643124, "uuid": "00c4e8de-7fe1-4efb-bf07-ccb6fcefb3ab", "comment": "Malware payload", "value": "2afd07d8a411318867099a2d0f4b0125", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643124, "uuid": "7c0cfd1f-36fe-4d61-9ec9-1673777e774a", "comment": "Malware payload", "value": "5254dd9a06b67453be3e00719dfc73fc2c5b7c0896695b305807a3c9085a247d", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643124, "uuid": "d10700eb-85f3-449c-aa4f-ddb3188ed1a0", "comment": "Malware payload", "value": "771d82e52eb5a06f97ad2ed32bdeea12049413dc", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643124, "uuid": "c12d86bf-a0f8-494a-9344-49f727e372d5", "comment": "Malware payload", "value": "2c833dbe9bc88f28e187305efbd8a78a34ff10560c83d8843c4dbfa8b8852a8bb1981375e73d35d150040918fb4d50c2", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643124, "uuid": "2d8aac56-c6c0-4548-9cd4-60e052727f9f", "value": "T1C051118D34F3608282F26025413FB49AFA385A95834CDB14863D96BCBD705E96356F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643124, "uuid": "22458d8d-58c2-40dd-ae14-503a432fd6f5", "value": "48:PU5XDlnB7RczcMqbyiGc1n+5+6Fw3Fbl50+14WcC1TmWazLlB8iEVxlBuLUjgOtV:c5XhniyscRY8oWcC1TmJzLlBgVxH9RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643124, "uuid": "c9255a31-2c13-4f84-ad3e-5a17a99b1170", "value": 3054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643124, "uuid": "d0b4163f-baab-426e-b68c-302250d47dc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643124, "uuid": "ef474677-7c9c-4810-afdc-f62f3b2dee2e", "value": "5254dd9a06b67453be3e00719dfc73fc2c5b7c0896695b305807a3c9085a247d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643e7e33-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642036, "uuid": "cf314516-f93c-497c-b8d8-cfefe19eb8f3", "comment": "Malware payload (RemusStealer)", "value": "a963b10852c7aa86e047dccdf1e8c792", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642036, "uuid": "27dc4d7b-be2a-47db-8e9f-fc11221e0172", "comment": "Malware payload (RemusStealer)", "value": "52f6d81aa40d054ff5baa08ce64e8fd186917e9961b46fda2a317e7d48949595", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642036, "uuid": "0cf21b01-fad6-4cba-885a-22aa2dfd6898", "comment": "Malware payload (RemusStealer)", "value": "b1a39544090af587486cb8268e817291f57288ca", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642036, "uuid": "8c565c28-87e9-4f52-aea3-f53270816cdf", "comment": "Malware payload (RemusStealer)", "value": "d7abacc7c50a9f475347f973f11731ed33e5bcf846db7fe7990b64dfdad80573c7ab200babb957101c8e3ceba635ad84", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642036, "uuid": "ae3cd768-3dc9-4bcc-88cd-b7bcbeb73161", "value": "T154B5331FFB8A67D7C521483B0B49B7AB1DA1DE480943B242A908FC7D4171B3C4A757DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642036, "uuid": "e16eba5c-3391-4155-89cf-da0b2926fa65", "value": "49152:tLDZCQde1GC1TYWDicbwBzx+vOEgNpDcL2K9EOk/oM4K4:ZdkGyYW2B8gHgL2aZ/M4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642036, "uuid": "28d0145f-ced1-49b7-9e57-9620fbcc0a11", "value": 2461696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642036, "uuid": "fec35009-8c7b-44fe-8c09-40ca3fc20dbb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642036, "uuid": "1e532e7e-ad95-42c7-afcf-0cc5b3fa6e57", "value": "52f6d81aa40d054ff5baa08ce64e8fd186917e9961b46fda2a317e7d48949595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42dc876-6104-11f1-a769-42010a9c0008", "comment": "Malware payload (Koceg)", "timestamp": 1780680825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680825, "uuid": "2ee927c3-9a60-4cbd-9c43-467ddea0d7f0", "comment": "Malware payload (Koceg)", "value": "094ea647c9746469fd8a802ebb1d1164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680825, "uuid": "3546095e-714f-4a7b-88b8-b41cf9f73028", "comment": "Malware payload (Koceg)", "value": "53c1e5b051c41042cc3c40d51d09dc86c4929f9ea992d978c4dc9f71075942f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680825, "uuid": "ab619ab1-355d-4566-9f4a-b4f7d7f4ac2d", "comment": "Malware payload (Koceg)", "value": "277b4bc05cee443fa4d0f42414882cc2ba8e97a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680825, "uuid": "d6073cbc-a79f-4b97-825c-dd9527baabe6", "comment": "Malware payload (Koceg)", "value": "37f227243e29e59016689364528118ba82bc3c51a162d5710502abd2d1f58bc8c534704618e8a92e0ebb6490e748dd3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680825, "uuid": "c5316d53-7285-47ed-90ba-c90360fd857d", "value": "T173C42340059FCF85E412B2B11BC31FF09D22167EC5B18FEA13B9EA91A7A74DD88D14A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680825, "uuid": "13680dd9-d823-4e36-a2b8-5fdab071f60c", "value": "08b656407b8d307979dc72c3fcc683a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680825, "uuid": "4efd2f10-bd41-46bc-96c5-af6149d0d5ac", "value": "6144:ACZlWG0GN7xOz2x23dNs4U1JOhtpWhkPTu8wz3D+g1F+S+Kr:ACCs5xOKx2Nhfpnbu8wz3DKhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780680825, "uuid": "61bc7a74-7ee1-4c80-af3a-ba31466a7b44", "value": 545978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780680825, "uuid": "d200b9dd-477a-4605-9bab-4ce6750ceedc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680825, "uuid": "1666f1f0-2e64-49d5-afc6-7dfa981c64d4", "value": "autorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147520a2-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642332, "uuid": "8d41a9fd-8948-44de-a760-89d72cc8b4a4", "comment": "Malware payload (RemusStealer)", "value": "939dc9e4baef138da5d12ba86ce620f7", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642332, "uuid": "41842f91-bbde-4f8b-a3e3-6b98d4df1029", "comment": "Malware payload (RemusStealer)", "value": "54a096fefe8c79117990ec0d6dde36531378200da51c6f7d4f75bb294189bc0c", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642332, "uuid": "3024ac1e-3296-4e1c-936f-4f89e1239ee1", "comment": "Malware payload (RemusStealer)", "value": "6d6430e08860ed1e61a941036680a1306a3bbf81", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642332, "uuid": "fec9805c-4593-4cd4-9765-e815a23da18e", "comment": "Malware payload (RemusStealer)", "value": "8fdf0bab2e693226dac57b60f310f616c124271f57a11c87cd8bc45acffaeec844e56c1b81b775e5d044520f71578a98", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642332, "uuid": "656f04e8-89af-429b-bb75-261b8e30fbe8", "value": "T19414386BD25371FCE553C07882667231B732B63907346EF742A2D334AE329D06E78969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642332, "uuid": "aa2a9d43-4ec2-488a-bd72-bd7eca1e2211", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642332, "uuid": "6f3e202e-44b9-4622-a8a6-e817e65e6866", "value": "6144:epFJxVbqzn7nZsdAzjOj2lvF8EIua6oyqYY:etxVbqYQlvFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642332, "uuid": "da99ea75-cb24-425e-b229-a6ae15ffbafa", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642332, "uuid": "2c623369-9732-4c1a-b886-3ef5b454c6b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642332, "uuid": "64d28d19-922b-412a-8e70-1a20ef0ed293", "value": "54a096fefe8c79117990ec0d6dde36531378200da51c6f7d4f75bb294189bc0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280e2d3d-6105-11f1-a769-42010a9c0008", "comment": "Malware payload (Koceg)", "timestamp": 1780681019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681019, "uuid": "687a9379-bb4c-4e23-a2ee-21ee749fab0a", "comment": "Malware payload (Koceg)", "value": "3d533c3b06a5c006ea3bd8aee19a7615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681019, "uuid": "6849fa79-52ac-4a26-be60-9c1c0306440a", "comment": "Malware payload (Koceg)", "value": "54e032c35f14090c4ced7a3a5ba8ea4a0319c281bf2f0916b6de0d82312a018e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681019, "uuid": "9a90dfde-41b8-4360-b242-3dd7cfce5303", "comment": "Malware payload (Koceg)", "value": "1e4080efda38a9b1b022d0836cb4228cf42e75ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681019, "uuid": "ff74fdff-0eb6-4feb-b9bb-13056f205e9d", "comment": "Malware payload (Koceg)", "value": "821fcefdfd1a7712c9d96f096e4f913462d5ac0c8f8b124ef5faadb2472fb8069dd9fe42563c9fd09085165e40a3cf62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681019, "uuid": "d7b707f7-1301-4018-bbd0-0d692ed5aa12", "value": "T1D0C4234156EBCF9DE816B2B12ED317B46E36133B85A5EFC503FADAC1A77348C0889446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681019, "uuid": "a7a97d19-d259-49aa-8989-22a80f39e0d7", "value": "08b656407b8d307979dc72c3fcc683a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681019, "uuid": "c55395fe-1722-4995-810d-fb46356c110d", "value": "6144:ACZlWG0GN7xOz2x23dNs4U1JOhtpWhkPTu8MTi8jbaLqPK:ACCs5xOKx2Nhfpnbu8MDjbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681019, "uuid": "c37ca1e9-3775-4c69-a5b4-ab9c40c79f2f", "value": 550107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681019, "uuid": "d8e6916d-b4ac-497a-ad86-fa6bf677b0f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681019, "uuid": "21e4366c-0a58-4d2b-8399-b818afc15ad3", "value": "autorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67202759-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648484, "uuid": "0b63833a-8a75-4e8e-9c32-cb69f60374a0", "comment": "Malware payload", "value": "fcab34ac430c0167d5448c6df96acddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648484, "uuid": "e469542c-cbce-48af-b80a-21597eb567b8", "comment": "Malware payload", "value": "552d93ad7c138a43436b6b25d8fab1fae07df05db54e1dfead674add33cfe81c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648484, "uuid": "aa6f7015-fb14-4802-a9cf-f7a1860ac305", "comment": "Malware payload", "value": "91fb9760496bcb0715dc00d07d78eaf35aec67a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648484, "uuid": "0da41f61-296a-4272-95d7-d07ce47d29d8", "comment": "Malware payload", "value": "dd062501c2059e5410a7335562b7258e3f9f6a63edae022345f087b049e4cd03470099afc378359b08a22b57cd3b3cf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648484, "uuid": "fcfbd427-e383-4270-beb8-192750072c28", "value": "T10AF4BE2B72574E12C288673BC1C71900A3F5D6863667DB0E7686239A1E073EADD4B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648484, "uuid": "81dfc591-8fa0-453a-a799-8476782d2997", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648484, "uuid": "5e0f9139-03e7-4af8-b9d3-3b66538b3e72", "value": "12288:bd9V3dhxZngbgM5AvLRJFlTFRK0g6oLoihAYaSD9mJI/HlvJM+5:bV3dhznPMGF9WBXiYaow2HrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648484, "uuid": "6817f8d2-4d88-4277-9c13-dd80c41e6857", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648484, "uuid": "e4d14b4f-6816-42a8-895e-fec1ca29f4c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648484, "uuid": "580fac1f-705b-4985-91a3-e04acb090359", "value": "SecuriteInfo.com.Variant.Kryptik.371.21634722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b14536-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780642123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642123, "uuid": "5db5e81a-dfd1-4afa-a34b-2cc3fa1b0edc", "comment": "Malware payload (Vidar)", "value": "2dfacac6a854119e2395fa69bdb55d39", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642123, "uuid": "a565ee28-f583-4082-878e-5ca5aec057c6", "comment": "Malware payload (Vidar)", "value": "559956bcb790d4c964ae662804d2e7241dd2a0c8eb2ce03e995883d8d03b64ae", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642123, "uuid": "b42ed8b0-4ff0-47b8-8576-cbff70af7970", "comment": "Malware payload (Vidar)", "value": "cf07086541decb5bdeb6ae6499795016905a1fb6", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642123, "uuid": "b28f5d60-c468-420d-9fcf-82181d620327", "comment": "Malware payload (Vidar)", "value": "28ee66b3adc3659a4b7b46dc7246df5c89894c029e8a34dfce11d70c2bc79f4e3a50e882a2cfd5a0e1ec2212c88de9a0", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642123, "uuid": "f9b350c8-afff-4ed6-b4df-f2cd933387c8", "value": "T17D956B0B7DA458EAC06EA736D9B722923B30FC190B3223D71E5076782F726D45D7A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642123, "uuid": "c1cdefbe-6f3a-4204-b1dd-de0f518d1c74", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642123, "uuid": "8493a976-c116-471f-82f4-1fc97d3082fb", "value": "24576:hf90A7ZIGn9O9HpH49xqDOrOW1QrrdG7DznNgWtPEL/Z1:hf9DZIGn9O9K9xqDOrOWKr87Dhgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642123, "uuid": "ed3a8611-696e-440e-9ae4-401c2e4d2e59", "value": 1996800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642123, "uuid": "ed5c49d3-c0c3-4745-98ea-9dbb824ea402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642123, "uuid": "793d45d8-0435-49d5-bef6-e1c60e603baf", "value": "559956bcb790d4c964ae662804d2e7241dd2a0c8eb2ce03e995883d8d03b64ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165a6fac-6120-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780692586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692586, "uuid": "5865d5d6-f5b1-4e79-8a56-886ee41f65bb", "comment": "Malware payload (ACRStealer)", "value": "5c92a537f724217c4aad0f9b45e9860d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692586, "uuid": "00d3c261-e1b8-4894-8c50-4a4cf5029394", "comment": "Malware payload (ACRStealer)", "value": "56281fe51ec4549b60f61e4c944b9ea1428e9719c84937b229afd0a83e821016", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692586, "uuid": "9a80b3bc-c1a7-41ae-9eb8-022c4d55e039", "comment": "Malware payload (ACRStealer)", "value": "e238b41d2c153cc136be5beccbc431721b083740", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692586, "uuid": "d69fb935-6c53-4061-b40b-7be0ed6feb6f", "comment": "Malware payload (ACRStealer)", "value": "912a082d8cfc887d0194e57a040d2988ba13fe8ad6611c5e52210635f132872c3b491bdea0cd70b1ca6df4e5996e231c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692586, "uuid": "8445ba06-46fa-4eae-b91c-220aa3e868ad", "value": "T176665A43BCD109EDC09AA33189A26296BB34BC080B3627D72F51B7382E77BD45D76B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692586, "uuid": "333cf60a-3be9-4874-938c-ba2590895e31", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692586, "uuid": "5fb557e8-59ff-4cba-bc46-74edc9b50063", "value": "49152:1xWOrydkY2MxwhStze7lxDyDiTXbmnPH9U:1TRQy7lxyGTXCv9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780692586, "uuid": "f45dcb33-8614-4b8d-ae14-03a5fc2c592e", "value": 6936712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780692586, "uuid": "48bedadb-af66-474f-aa9c-896c00de9b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692586, "uuid": "1bce6bb0-b955-477d-b56f-8ea9e02795db", "value": "hjbk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3041a6e-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649470, "uuid": "69e41847-66e5-4b94-9bde-b93f9e4b0733", "comment": "Malware payload", "value": "8788b194fce427c5592dd9011932f7ca", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649470, "uuid": "5373c994-25d7-4ec9-94dc-2f67efd9340f", "comment": "Malware payload", "value": "5631c5cd76c37d6929b24b4e918c2eab5da80478fe9801fe11bbcf8874ed8900", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649470, "uuid": "508f7c95-6123-44d2-8a85-22628649c18e", "comment": "Malware payload", "value": "2e20b285b8b6b1efb37b9fd90fc702a1e7061d54", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649470, "uuid": "0233a5b2-438e-409c-b6d1-d234979dbfae", "comment": "Malware payload", "value": "187ec67c617b8304b608d764be7d466501a39ab393ef2a19a368e4ee7d1e46173c8f89202b18beb0023e63b9bfe6673e", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649470, "uuid": "f6fc6f0a-de9b-4bbc-80a5-0fa175114952", "value": "T18FF1AEBF791A9462E004227B37B5B65C69070E7445A12F4C888126B2715A0F2C6B7ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649470, "uuid": "f28fb8b2-f12d-464b-9c79-c7641fa0b237", "value": "192:Kx0dAp02ee0CHcAhTE1YZ6mEAbG6emXQAFaA2egnWakW:aKApAedNNZ69uG6emXQhjJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649470, "uuid": "a1c30caa-167a-4b55-b335-5299188ba040", "value": 8094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649470, "uuid": "8c49535b-cfff-4e1a-87d0-4d0c32c85064", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649470, "uuid": "c2661316-7fb3-48e9-8f91-ab3895154a45", "value": "photo-692451196.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a490dc0-60d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780659146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659146, "uuid": "06a4d215-7124-4844-8b9b-2a49dad3891c", "comment": "Malware payload", "value": "336da726f246dd2a042d2925dd66d366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659146, "uuid": "9a817f8a-04b7-4cad-aa01-c023493b1762", "comment": "Malware payload", "value": "56624e466ec099c7f3bd90a5e541e5fd7d7856f57766bf774f3022c126dd9b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659146, "uuid": "0d23c0a3-871e-4a9d-a05e-864e816f977b", "comment": "Malware payload", "value": "74419dacb71f300c5b0b836ad6fe8a391745b896", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659146, "uuid": "36fe5f58-1094-4066-bd5a-6cc7f255e4e3", "comment": "Malware payload", "value": "4b43c80acacbe92a501451f1a5ada251d11b228771556c5e85c0192f8b24eca5dcf1939bec43744fc25aff1d51846813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659146, "uuid": "b64d956c-c3be-4a34-b46c-88a19675d91f", "value": "T1BCB5AE76F55281F6E883C27056395F70A96DBA300325A2D363C84F1A0C75EE19E37B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659146, "uuid": "94039bab-7bf5-49d2-88a1-d58010fea621", "value": "2beaafbf1cdba63ad492e75cd2c7417b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659146, "uuid": "7467467a-af0b-48cd-a44c-416d2c2885af", "value": "24576:aIdKWrgPRZcUffahZXUnnFwtxlvs6U+xuwX+Sa5glk9GtKT5FLKSH24r1+knsrut:5deCZX2nalvsCxKS49GtKDHprQ2EFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780659146, "uuid": "64a990fc-e96d-4104-aae2-de3d7ca6707c", "value": 2481664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780659146, "uuid": "b6f89646-eb8f-4a0b-b24d-c37e95f75fc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659146, "uuid": "4cb95cd4-84ab-417b-a3a7-5d60f9e25d6d", "value": "26529000001026905011_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034e1859-607c-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780622117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780622117, "uuid": "c5dfa536-e33d-4bbb-bace-2a5632d5f23d", "comment": "Malware payload (WannaCry)", "value": "223471af14ed45fe0306718a5dae2c9e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780622117, "uuid": "a10f26b9-27fa-4b53-ad0b-e784ec4b1614", "comment": "Malware payload (WannaCry)", "value": "56b2d9ba09626dcd3e74c89aadae7950f3e7b0e82372818354a609566fa3fe1c", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780622117, "uuid": "329215e7-157a-417f-ac26-ecb1e6536094", "comment": "Malware payload (WannaCry)", "value": "398a768e1387166b531ed2278ddd0fc6c7871a79", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780622117, "uuid": "29106e47-fc69-4374-a563-c7182f69de31", "comment": "Malware payload (WannaCry)", "value": "e585b3a8ab880b52c9c48220bccd1c493faa29e911d56ad57dd50767ac352ccd26635cbb2410b562d3f6dfe8a5eb7ae0", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780622117, "uuid": "1e027a45-1734-4bb9-81cc-04a3d71fcc92", "value": "T15D36238832AC80F8D50A5674A4B38E25F3B37C5922BD870F9B5487661D13781FB78B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780622117, "uuid": "f00c90eb-36a1-49d6-9e1e-abbe9bf1b124", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780622117, "uuid": "c71e9c6c-416b-4e08-9e87-cd90750281ba", "value": "24576:jbLgBbLgurishfdmMSirYbcMNgef0QeQjGuRdhAdmv:jnsntqMSPbcBVQejuRdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780622117, "uuid": "b925b4fd-9138-4b8d-80b3-88b56cede6ac", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780622117, "uuid": "0cd95d36-f03f-4e29-a935-bd86cdd1f2a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780622117, "uuid": "708c5aaf-26da-437f-baf9-fcd5e7492987", "value": "56b2d9ba09626dcd3e74c89aadae7950f3e7b0e82372818354a609566fa3fe1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b8aa73-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780648607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648607, "uuid": "2219d321-b866-42cb-8c28-78b533292b16", "comment": "Malware payload (PhantomStealer)", "value": "55d18c24830a922d01b9b47ad55b3e39", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648607, "uuid": "93e36ae0-c24b-420b-b84a-d47e27890a47", "comment": "Malware payload (PhantomStealer)", "value": "5731bc5e9549be4f4b148bac9ee481ba3660302aff9c9c8650dc21f2ae0d9271", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648607, "uuid": "de782d25-706a-478f-aff0-7b4eec5c091b", "comment": "Malware payload (PhantomStealer)", "value": "df40421556f299c4830878ec49ed4288f3cc3ddd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648607, "uuid": "a231506f-ebb2-4bcc-99f2-02ef6db08813", "comment": "Malware payload (PhantomStealer)", "value": "6295b328d762ef017d663fe8db35e7c7f04a5eb751b216561f409efbea5e731b09fbd4374d16b249e68354b18767b827", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648607, "uuid": "ab6ddbfa-cb9a-49a3-9372-611031279693", "value": "T1E3630D51D11B0C6CF099ED0F88FBE92A2B1E73F2F79CE185A76060E9E04A64574E471B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648607, "uuid": "fc84121e-1ecf-4ef9-b03c-a2bbabd81a1f", "value": "192:QT1o9xz5fDxIoOX+w+rlvt6kka1VINrsnwJu3TeAP3qgL/UFa2EwcVHqaMqpgZBe:DL9RT3+HfpTpDBCBDSvJuvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648607, "uuid": "f0820b1e-d78a-444a-adf8-13c6859537b5", "value": 72442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648607, "uuid": "b1988ead-6744-4bb9-abc0-c32e68250fb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648607, "uuid": "012aa751-a4a4-4474-b934-2704c5424b71", "value": "RFQ_Especificacion del pedido Cantidad_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d904111b-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780648675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648675, "uuid": "130b68fc-c574-4ff8-92c0-6aac320a4674", "comment": "Malware payload (AgentTesla)", "value": "4efcbf0c9653cf88bc66981902c50906", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648675, "uuid": "5ee4995f-d558-44cd-b1dc-18136455bb04", "comment": "Malware payload (AgentTesla)", "value": "57611923cfd0dd7950a80002585ea815799bd3a99d622326b0a0cfccb710e29a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648675, "uuid": "1331cbdf-bf2a-4365-94e5-a3a9b0c6515b", "comment": "Malware payload (AgentTesla)", "value": "8e85c473e62fd0737efc7bffb5417c70e4dc0b85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648675, "uuid": "1a96eb51-3459-4e6f-acd7-20cbd7e49eef", "comment": "Malware payload (AgentTesla)", "value": "7b7150350fcf4df56d82ee806413f1dabf890cb322fff046838ff64e73a1674f5af015ad264221e6bd2240881efbf02e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648675, "uuid": "d3f98cd9-660f-40a9-80ab-4c4c134ee30b", "value": "T13B05C46EC855012EE133D929C4A6009FE893660B633CE90B24CF775BAF638857B9735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648675, "uuid": "2b886d63-d14a-4faf-a1da-bbd163db3451", "value": "3072:dcYljEGHfmyp4Q5HtWOJchFcp4g8kKAUw6M40LaTynIajVa+Ndq6I0Nsjru6X2NU:9Bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648675, "uuid": "65b2642a-5177-43d1-be55-708eec85f43b", "value": 838378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648675, "uuid": "d32bac19-d51d-4090-996c-3172aca49e85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648675, "uuid": "76917ec7-9cb7-475a-a27b-b39644d1ca32", "value": "MT103 - Bank slip.eml.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0a634c-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642236, "uuid": "d5a3cb6d-3e0b-411d-9853-46bf4f1d4942", "comment": "Malware payload (RemusStealer)", "value": "a7bdc77c9ee7fe654e8f95a13b0e71b0", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642236, "uuid": "c28e1d13-63d5-4d75-8809-f984956b26ec", "comment": "Malware payload (RemusStealer)", "value": "584e4672bc284eb2bcfe7fac94713d3a7cf96c8ffc0bee0adb60d03b5cbacd9f", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642236, "uuid": "aa16e7b4-2fa4-4942-a626-8d343d5c5971", "comment": "Malware payload (RemusStealer)", "value": "0742759554416cbc18bd980e8d74c23265ed18a2", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642236, "uuid": "3245e07d-44bb-46d8-b54e-68a798598a10", "comment": "Malware payload (RemusStealer)", "value": "7a86736ff59a792bc26ad0a71404e5c36fcc0f8b4cb2bb2de1f52709302fa5912ed371db2d4bea74e949e9dca467ef84", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642236, "uuid": "2a4cdf4e-addd-4e46-b423-4e7998584cfb", "value": "T1B5956A0BBDD558E9C46E977698B722823B30FC490B3223D31E84BA782E727D55D76708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642236, "uuid": "46d88fdc-540b-431a-96c6-f150df6c839e", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642236, "uuid": "ae3bf728-ca6e-4ff6-a7f3-84a3045b1b12", "value": "49152:suB0YXHCmnWZ/5IH4jFnIdZxrVNtgdhvOlNeTU6:sub3tXtg/2NeTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642236, "uuid": "a838469d-f273-483d-84f4-d95d72e49d36", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642236, "uuid": "a82f9849-b14c-412a-bd83-455d84f0de0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642236, "uuid": "4a4cfad8-0db6-41bf-a081-e3e82e3c9b7f", "value": "584e4672bc284eb2bcfe7fac94713d3a7cf96c8ffc0bee0adb60d03b5cbacd9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f1e9ff-60df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780664720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664720, "uuid": "85ee1105-0a6f-4392-894f-4b58bebd12d1", "comment": "Malware payload (Mirai)", "value": "b67ffa9578573ffbe7fb7ccf3474a7ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664720, "uuid": "e10062e2-e397-4a15-9dac-e472b95ce71f", "comment": "Malware payload (Mirai)", "value": "58a79f89ea3c5d01ba2c13ea46ff72145070263459afb16ca8c3359817c7bf7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664720, "uuid": "2bab027c-a8be-4d7f-9a59-13878cec6c2a", "comment": "Malware payload (Mirai)", "value": "20122ddf19e59e1b329ecf109b1b69c2375b8b9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664720, "uuid": "44ef585c-716b-4352-952f-5fdfb54b9d6b", "comment": "Malware payload (Mirai)", "value": "256fca9bf908e536f309b4881cd8974e934592be95b64e3467f44f446a47bb7bd46ffca1088c973be71d278b0a334a2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664720, "uuid": "90f886fb-4dab-440c-afdf-ad300e445680", "value": "T104634C02731C0953D5A75DB0293F17E193FFA69021E4B289781E9B5A82F2F335586FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664720, "uuid": "bf3bf812-7b59-42bd-a3ef-2d7b5366b17d", "value": "1536:EpTAX5GGKAMUV6nneUjGa31b5G4SRd/9TU84wo1b6iyBnqMCS:EqXQXALV6nn53l5G4OzIb1eiInqXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780664720, "uuid": "0b03e26f-a314-4a94-bb9a-512b73d192de", "value": 72592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780664720, "uuid": "b27eada2-1cde-4aed-ad6f-c4d1af3f869b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664720, "uuid": "aec161e4-6fdd-418c-9fa0-a87375b7f486", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ad9172-60a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780641394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641394, "uuid": "c5923d0a-ef0e-45bc-af07-93436654e4c9", "comment": "Malware payload (Mirai)", "value": "5dd0ac9fc46b9f3763e732b8e868a68d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641394, "uuid": "e8284543-c6a0-48db-9cc6-bf28e866e75b", "comment": "Malware payload (Mirai)", "value": "58bd98253ea3bcd40e3e5562255bf261414073bf44ae97f9c209abe8590300cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641394, "uuid": "5903b254-36b4-4696-b37f-4917984e62c8", "comment": "Malware payload (Mirai)", "value": "446a60d7785c3cc23318991ac81e1937f1e6b6b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641394, "uuid": "7e9d1ddd-4cb3-4472-a627-de1fd89c5bf1", "comment": "Malware payload (Mirai)", "value": "61f39723a6932b41447c014e46e55029ce6171ba7e66a0e78ece7f8e07d1e29492fc869a2ab3007844df832e73c8dab6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641394, "uuid": "31f94898-9041-4024-9efb-54b9cbbaea79", "value": "T17E334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641394, "uuid": "61ce996e-24cc-4130-90a9-d9e206ca3435", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8TwG:ivW3jdQGqt7Y+Z+zN9cGgI6bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641394, "uuid": "0907646e-618c-4539-98ae-45b03deb1eb0", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641394, "uuid": "e8486184-e86d-4b7b-9e7c-c5adef02f500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641394, "uuid": "e5cfe493-5bd7-409f-8662-28c8d9ffaf75", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fec595-60f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780673659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673659, "uuid": "6043f673-1732-4791-8036-ddb2b474cb94", "comment": "Malware payload", "value": "3791454fd00a30dcd4cc8dcf2b4f4bd8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673659, "uuid": "393c5278-f7ac-4e91-9da7-fcf50cc19b3a", "comment": "Malware payload", "value": "58e678a6014f86c76c481322b90caccfdf0bd1202417cf6fa76395c28fce16e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673659, "uuid": "1c068338-4a5f-4757-a759-3a2e3a124aca", "comment": "Malware payload", "value": "246729ffbf8f4f8fad2dac1bfcdc24da1073f79e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673659, "uuid": "55b7b536-e21f-4887-a161-72456bfacd14", "comment": "Malware payload", "value": "64d0ddd55e8b1e99cb855bd914b5151e827d5de9d9a9f9d0f3b92f9eb289c7e9f5fecf1708a43433066915107a854940", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673659, "uuid": "8a0d0b3f-455a-4f2a-825f-39c3e10eb515", "value": "T182D2DF34C4D83FBDEE9A2A1C06FA6620D7D68B1E9494860637477D9B4F37D80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673659, "uuid": "647263f1-a3d6-4804-bdc7-5aded4164da2", "value": "768:8umWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:8u+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780673659, "uuid": "e0c6789f-3d86-4532-8763-68f633cc5c65", "value": 28665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780673659, "uuid": "ebc2445a-6d08-41e2-bee1-e59d52749206", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673659, "uuid": "25b55c9d-8980-4b35-a598-0b0ce7e1bc65", "value": "23.94.110.24_1780673627005789_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ccdfb7-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780623923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623923, "uuid": "40115a12-4c8a-4363-b3f1-55e39edf9c93", "comment": "Malware payload (RemcosRAT)", "value": "4d41677291888d30b96849036a576832", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623923, "uuid": "cab27e28-aec7-401f-8c9c-78e13d0c6080", "comment": "Malware payload (RemcosRAT)", "value": "5921ef6e620da05f3394694044198047cc0305a6d9a49055285757df92ba1afc", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623923, "uuid": "b69e3215-08cf-466a-8e97-ff435f2c4b95", "comment": "Malware payload (RemcosRAT)", "value": "301efc470f0be5c9e08184818b4e1d192a41fb8a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623923, "uuid": "fb95f60a-c6d3-4fbd-b983-5d282bba5257", "comment": "Malware payload (RemcosRAT)", "value": "8ff5653bf249335ce665a2250847bfe91864300241da321d6459b035de8f64cc0463e0dd4d211e5739943e18dd05edef", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623923, "uuid": "6e9191d0-c8bb-4695-b857-8a106b4183cc", "value": "T12574AED7EE74372E1D399B1EC4C408C7B2C50794E14F928A54A863DF1301EEB8BA9997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623923, "uuid": "467e23c0-2319-4bc2-9472-906ca465d538", "value": "192:opvenSOEm6EmCGwCsDAkv68CMEmLenSIaOpcDW8KGwCsDAkv68C3dwfZkq/yk3aH:o10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623923, "uuid": "506e6ca7-2ce3-4199-a958-51fd93182a1c", "value": 369157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623923, "uuid": "c345231b-e97a-4708-9cb4-c2cd970b1c6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623923, "uuid": "127bdf26-ace5-44de-b51c-aeeca63018f0", "value": "goodthingsforbetterperson.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb5c443-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780642888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642888, "uuid": "a3d43566-63fb-4265-95c3-88f6d512e83c", "comment": "Malware payload", "value": "0f05642e9a296b074afe93581600b50c", "object_relation": "md5", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642888, "uuid": "073dcc89-829a-4c5d-ae90-1d58b8deacec", "comment": "Malware payload", "value": "598b023e56c45b19173e8f96c1c88036d732fec305cf6bf1b9cf4dbe304beb7f", "object_relation": "sha256", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642888, "uuid": "19a90fb0-ea87-40cb-896d-9ee008ed6512", "comment": "Malware payload", "value": "316c05d32a1650cca76af08a35057320ecc5b855", "object_relation": "sha1", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642888, "uuid": "0fd425fd-8188-458f-b206-d6f11eaa76d7", "comment": "Malware payload", "value": "118804912117a4aabd1c7cab6f4fd956a1bf12e9b8b83b052b2abb499f58af34c26e0f38338cacc354d52c95bf1a2b8b", "object_relation": "sha3-384", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642888, "uuid": "bfdf6876-bfda-4e31-8fa5-ae5696fab82f", "value": "T1F827DFC1F224F548E7450571982936A849662A303754D9BABF8B7AC2497C2E6FDF0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642888, "uuid": "31fbb55d-4153-4335-ad69-5a2264deced9", "value": "33d21269a280bd2e4ca8b6616d0c081c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642888, "uuid": "5c793f12-0da7-47b7-bf01-b2ff1fe5c8bd", "value": "393216:y1aOn2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlk5:AaOK2OGfEhP0JqHOG8q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642888, "uuid": "22d125c2-8bc9-458f-8a8d-efb60bf10f6f", "value": 20740168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642888, "uuid": "b30f013e-f55d-427b-a0bc-ba8b80944504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642888, "uuid": "d2793a47-43bb-4418-8f8e-a674e6fc2a4c", "value": "598b023e56c45b19173e8f96c1c88036d732fec305cf6bf1b9cf4dbe304beb7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bc8cbb-6113-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1780687106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687106, "uuid": "5afdec4e-42c0-45c6-90b1-e0a6c5df834f", "comment": "Malware payload (CoinMiner)", "value": "9e2e071322b103e57eb28ec0820f4134", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687106, "uuid": "75577002-90bf-4981-9146-61a2a5332d83", "comment": "Malware payload (CoinMiner)", "value": "5afcd3b0cc917d1330c9a927edf5789b74c69261eece1b0d3144b4e67b0bf30a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687106, "uuid": "241b6ae0-b8ca-4dc5-813b-08ba586f3b46", "comment": "Malware payload (CoinMiner)", "value": "b82eb1ee36fad9d90a6449b2938241b099aec975", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687106, "uuid": "26388c87-f697-4b88-94f9-c2055da18c8b", "comment": "Malware payload (CoinMiner)", "value": "bfade7aeca86d19ff891c91dfc20833371cadcbae7a410f4b5aea5324be2aae6d504c94bb5395f2d4d17997c7f95cba5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687106, "uuid": "5f8af6f3-d5db-4429-b821-ab2b6969bd73", "value": "T1F532A01E2E4B4332EE5049B4E475424A117C1EE3B346EBEBE633C1DB4AD5E4044C1A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687106, "uuid": "227828d0-e319-4725-9864-85770d6e13cd", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687106, "uuid": "5e9627f3-e78e-46c3-8a1d-336d3c102d11", "value": "192:4omWVS5BMfwxSHO8e5QmPFJxTEZmFhqacm:4ofwsuj2mPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780687106, "uuid": "894b16e5-ddda-4603-bd40-a62a52f24c3c", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780687106, "uuid": "b64b300c-199b-4290-997c-3dd326b46bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687106, "uuid": "4aaa0360-2902-4d62-bdf7-b8c9e9e27619", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb652ee-609f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780637190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637190, "uuid": "aa7a34fb-b9f9-4405-a0b9-360180f85b42", "comment": "Malware payload (Mirai)", "value": "c2a13e4201e6eb92e6224d4f8bd82ef1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637190, "uuid": "b2f6e01c-9f5e-4672-8267-c9052bebbdf8", "comment": "Malware payload (Mirai)", "value": "5ba1f8e403c81c479fb098384ea24c99cd2171827982552ca854e79ea713aefc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637190, "uuid": "3f2d12d0-4e2f-49fb-8bbc-d86a09827f98", "comment": "Malware payload (Mirai)", "value": "0f78e7d9968fdcf92211318bad7b656d23eb1cdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637190, "uuid": "e215e8be-b007-4e50-b9a0-86ed22d595e2", "comment": "Malware payload (Mirai)", "value": "1d4ffeaae59398c6ff386cdf979303e24bc56ce6e9f2add0e9c60902277cff48c8bb70e6e421bac52ad0cf2b37ed649a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637190, "uuid": "2d2e98a1-69d3-40c6-9ac3-6b37a0a0d5a1", "value": "T15FE32973D81D9F76C022E0F061B99E310F116DD70E1B1AD96636F6A0457B8CAB14AFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637190, "uuid": "1f43e2f4-ff2f-4c3d-b2f6-d067991eebc2", "value": "3072:fQYkVms6abTkleF/lPJWBqXNnyDuTrSVAbtW7PAynI/:fQYQn6abTkleF/lPJWon0uXRY7PJnI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637190, "uuid": "cc6f3c6f-c89a-4ae9-b313-8b72110d7ec0", "value": 155672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637190, "uuid": "722cb149-05b3-417e-8c35-1d5e77019799", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637190, "uuid": "ff995f93-b2a9-4edd-86f5-9d44f84eccb8", "value": "5ba1f8e403c81c479fb098384ea24c99cd2171827982552ca854e79ea713aefc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac1ab49-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780643094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643094, "uuid": "1fcccb4f-50cc-4ffb-86ff-92c5bcbebe36", "comment": "Malware payload", "value": "3b2f611db298bbee6791a06a8944e3e9", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643094, "uuid": "a13dd162-f26a-48b7-81b3-168a9848e0dc", "comment": "Malware payload", "value": "5bbc08a414644356c7052273cfb3ae419dd487247388b673133e8de7ad26934c", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643094, "uuid": "5c5e7a2c-86f4-4cd2-995b-1dce0008f0f3", "comment": "Malware payload", "value": "2706d556dd6b57ffcc281d17739b604ee2e459c6", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643094, "uuid": "0e7888c9-8f11-4fd1-a3c9-8a769af29475", "comment": "Malware payload", "value": "43e3fe68544e166fc86b909601e812ee21d578ba975fe308c810a5f30b19d71ca5148422f92965a90afc3af2fb3d4221", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643094, "uuid": "b8ec5140-0cba-4cc4-a7be-f80eae4219fd", "value": "T10351018D30F3608182B26025443FB49AFA388EA5834CDA14863D96BCBC715ED736BF4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643094, "uuid": "4df07066-4694-4922-a460-d90e68ebe58b", "value": "48:j17sA+Cjl3SKkZUomc1n+5+6Fw3Fbl50+14WcC1TmWazLlB8WKVxlBuLUjgOt3ZP:FsBil3gZZmcRY8oWcC1TmJzLlB4VxH9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643094, "uuid": "a8ef159e-307b-443f-87bb-5ce7e22ba7cd", "value": 3050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643094, "uuid": "43127672-dd45-41c1-b9de-4e56b1e1e837", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643094, "uuid": "3f09261a-6d2b-414d-988e-3e0ef41bde8b", "value": "5bbc08a414644356c7052273cfb3ae419dd487247388b673133e8de7ad26934c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b266582c-6109-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682970, "uuid": "ef5b64ea-e4f7-4134-b62f-8a52ec893233", "comment": "Malware payload (Cosmu)", "value": "2238e681d14fbc03ec1111d3a9841654", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682970, "uuid": "55b2d977-e18b-4a2b-a8be-11a076c01710", "comment": "Malware payload (Cosmu)", "value": "5e1e787e90929f8f82593b332bbb471b3329f2a8f53316daf672ce4dac73b6d6", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682970, "uuid": "6a76ba7e-a846-4d17-a6bf-2e7280537b94", "comment": "Malware payload (Cosmu)", "value": "54a868f7ba2437a03e49d2d88719b51d819210c5", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682970, "uuid": "984d1f1a-6b27-457b-948b-235cdf29defa", "comment": "Malware payload (Cosmu)", "value": "3db3470d00f83ba41ef14f9c9300b84472c30d2b27cbc6b64fa7da047012ed2bd6bf7da5e96c629a8b3cf974da9460c7", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682970, "uuid": "629987cf-42b1-485b-8af8-768929f60662", "value": "T15B657B2166E9CFE1C09F2475DC96B1F44627EE01DC109FDB7E88BE0A38B12A5A97114F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682970, "uuid": "950f4a26-9953-404f-9c7a-b5f3656d5ba1", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682970, "uuid": "df2d38e8-8a8d-4808-8358-7be63c704701", "value": "3072:BQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBF5FPEv:A9lKgzelZNQSBQGH/CSpWqTJFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682970, "uuid": "3a5d9dca-0e01-4e99-83b8-953c584ee165", "value": 1545211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682970, "uuid": "1fb02923-6160-49b6-aa64-e3047a98846b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682970, "uuid": "ea4b83f5-a447-44eb-b73e-07480a6366b5", "value": "Acrobat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee9d2b7-60d5-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1780660684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660684, "uuid": "9fc230b5-3bfb-4f7d-b395-84f0de2d37db", "comment": "Malware payload (NetSupport)", "value": "08c94e7b15ac1ed2b701213d9542fbb1", "object_relation": "md5", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tiqwtkmma-com", "colour": "#2EDB57", "exportable": true, "hide_tag": false }, { "name": "zbxcgtqt-com", "colour": "#31D944", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660684, "uuid": "d6df4151-9a93-41bd-b6ce-422d2425f674", "comment": "Malware payload (NetSupport)", "value": "5e42893317fe50565601fdc371b58e2cc4ac320fad67612a2fa4434551d025c9", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tiqwtkmma-com", "colour": "#2EDB57", "exportable": true, "hide_tag": false }, { "name": "zbxcgtqt-com", "colour": "#31D944", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660684, "uuid": "cc203ad2-5898-4f54-96fb-29f324847c58", "comment": "Malware payload (NetSupport)", "value": "9ba52552e9e9c3dcdcc7a952f9fc9dc102c0c415", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tiqwtkmma-com", "colour": "#2EDB57", "exportable": true, "hide_tag": false }, { "name": "zbxcgtqt-com", "colour": "#31D944", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660684, "uuid": "df9f20ba-b9fc-4b9a-9608-294f2aa41c55", "comment": "Malware payload (NetSupport)", "value": "9e1d4984d619d06487e44a8bbfd58bf5f92759c6b1d57d9cf61adee420be356125f2b90071ab345a30c89c0223306be5", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tiqwtkmma-com", "colour": "#2EDB57", "exportable": true, "hide_tag": false }, { "name": "zbxcgtqt-com", "colour": "#31D944", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660684, "uuid": "d0af9c48-29d2-4627-a528-e403f44d4b74", "value": "T1F612AF0DC7C88D82F1EFF2BA1AD04189C966DAC547D7000816F923C96B81EF76231779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660684, "uuid": "083b9abd-ef5f-4d95-b985-5d1090898788", "value": "192:kRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+ukNsI:kRm/wksuQJ/g6dI+ukNsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780660684, "uuid": "f33580f5-51f5-4e2c-92e5-8e4172ef775b", "value": 9272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780660684, "uuid": "24cd58f1-43cc-4f56-8b15-cbd760c15425", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660684, "uuid": "0a8f7fb0-861b-4b36-ad08-628bcec594dc", "value": "Nuova cartella (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbc6bc5-60e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780665510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780665510, "uuid": "62f9cdb4-f77d-4f7e-8d22-f6b964a75b15", "comment": "Malware payload", "value": "18986145b0fb4d9cad65e68b7d44f28f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780665510, "uuid": "5e81f27c-5fcd-466f-87ff-0b0e34af3238", "comment": "Malware payload", "value": "5f978dc2da60813e03e46fd628ef1990a0053ed2329270ef31711436e39fd67b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780665510, "uuid": "7dda186d-5262-4350-9ad9-9edc59acda57", "comment": "Malware payload", "value": "2759ef5f0e16172f0addb6e20dcf41491e93f27a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780665510, "uuid": "df6165b5-f7ed-4d60-a7ac-dc4233bf9b40", "comment": "Malware payload", "value": "5af5d4d83713b4ebc346ba4cbaa3a4ff73b2c2fe163ccf8d96a9284ead482025d3739f4fc6c89312821bc66c2d2821b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780665510, "uuid": "b0296dfe-8330-467d-b72c-104a3f7e8ac8", "value": "T150476C51F68781F0D42B08B04057F3BF56347E05AC20CE26EE88BB56FBBBE255A15B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780665510, "uuid": "1e1e8378-d0da-4ce5-8115-2f71a6170250", "value": "bc6308092ebfbde61a1cb94c13f50efe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780665510, "uuid": "b8426fb2-5019-4992-9280-f31496160832", "value": "393216:t5cJYwSC4vi60Mhmpu6M6Y2gnTveZrW+GJIH52q:3cJYwSCq0MhmVY2gnT+W+GCZ2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780665510, "uuid": "ae043797-30f8-479e-a39f-a880e903b255", "value": 26345437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780665510, "uuid": "c37f8897-e38e-4d31-80df-26e098153c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780665510, "uuid": "76d55df9-26a3-4cd0-b848-a3b7e4c03e14", "value": "5f978dc2da60813e03e46fd628ef1990a0053ed2329270ef31711436e39fd67b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bc89b6-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642030, "uuid": "baed9546-745d-4015-afa3-656988acbfdf", "comment": "Malware payload (RemusStealer)", "value": "c57ba76104e42b8903cd9abf2a0e7701", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642030, "uuid": "df1c598f-ba4d-4f54-a421-8383b6445a1e", "comment": "Malware payload (RemusStealer)", "value": "6110e10f635d269ff04ff06d22a334c2afae9f29b5591b0d0cba5904747efce3", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642030, "uuid": "a785de67-bb13-496a-af51-63c19ad943ca", "comment": "Malware payload (RemusStealer)", "value": "329fd62d6790fc9e44ccfffd674010aafa6e5027", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642030, "uuid": "cb9eee37-df58-4524-9cf7-12013ffbba84", "comment": "Malware payload (RemusStealer)", "value": "454ada8e3393c1dea22fe465de378b412546913163b7013a678e34f4ec74ab36f83b30f3dea8238c6251c60337a3b544", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642030, "uuid": "2309979a-b49b-41eb-a0cf-3f8b7b353249", "value": "T1B1D53B13AD90C8E4D0DAF335E867A196B624BC0C073177D72FA16EB55E763C0693AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642030, "uuid": "bdda42db-8f21-40a7-804e-5e54f4929d84", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642030, "uuid": "f0a10d7a-df97-4de5-a3c6-b36cc1e5db12", "value": "24576:CYEieITfYYuDUZ/GYvHKjpUYs3pSAchelet29mqn2EtgAbbi:CYEnsfmUZ/bH/3FNJgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642030, "uuid": "0203311a-2fe6-43e7-9563-48c842de773e", "value": 2833408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642030, "uuid": "3d7a3f10-82fc-49cd-be2d-5994013c285b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642030, "uuid": "129917fe-8c67-460f-8ebc-922008223c17", "value": "6110e10f635d269ff04ff06d22a334c2afae9f29b5591b0d0cba5904747efce3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af161ca3-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667502, "uuid": "fab2ee7b-6cd5-4389-bb31-d07ae1c7c291", "comment": "Malware payload (Mirai)", "value": "aa3b4dfd541447d470e15bcf93e7a4da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667502, "uuid": "a5416bb6-32d1-4a19-8b43-4badbed709c7", "comment": "Malware payload (Mirai)", "value": "61de5390812e7cdda02306c44ce5c5e308285a50a29820cc600ee0ca816b92a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667502, "uuid": "4e3163ca-7f1b-4c69-b7b8-d72af8824a26", "comment": "Malware payload (Mirai)", "value": "e53820132fa79315d5dd0d9e272ef7190c1d7404", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667502, "uuid": "f001a07c-cb67-4cf4-ad60-f5f364d3860f", "comment": "Malware payload (Mirai)", "value": "5e343d9e36bf6c207419458861b75aa0a520472f432506332ac1b39ea19c959deb30913a1cc2f2bf7fe49e209ee8e5e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667502, "uuid": "6bea4d2b-01d0-4168-925f-23aaecf0b68c", "value": "T145E30741F98780F5DA078C705067B33FCB319A254036DAAAEF65EF35D963B82612638D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667502, "uuid": "c61a204a-db19-4233-8c77-504de5a588c9", "value": "3072:2n2faF7l42lb7W8CsWtR5yrtIoQ4xMTCGAeVan4AbtMv:22yF7l4eboyrtpZMu5xtMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667502, "uuid": "3a532137-8220-44bf-a836-baf475379142", "value": 148788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667502, "uuid": "4c8aa4fd-839e-454a-a39c-ab0a7e2111da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667502, "uuid": "c9945b49-7e1c-42bc-b2c9-c9a1af206862", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f88914c-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667315, "uuid": "3ae94f91-a434-4571-9ae6-272549043918", "comment": "Malware payload (Mirai)", "value": "5bcfbf51ff68336f78b2f702fca294e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667315, "uuid": "cc0bb5ff-d898-40d9-8865-b1712afc0c98", "comment": "Malware payload (Mirai)", "value": "62b8f235d180a9c18460459f8116d4ee14f7d1fb54e6454a04b8742a479cca06", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667315, "uuid": "abb22476-b4b0-4d04-9470-9a770ffab0af", "comment": "Malware payload (Mirai)", "value": "4c032d1f560095f4ff38302b0bef8f802879b305", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667315, "uuid": "390648fe-6930-4f47-bd40-dcecc0804a78", "comment": "Malware payload (Mirai)", "value": "a4e6c79a1b3cc3f1b186d8aa1b83d61794cf2082fcf210122c03dc8ebb0cc95ace14aa52cf2ce6b07a01520f8d7a4599", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667315, "uuid": "28a2e434-62e1-475d-b61e-0070a83ac9fd", "value": "T158F35C22B87A191BC9C4B57E21E34332F1F6574A24BC8A0D7DB10D8DBF2578026577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667315, "uuid": "e7aad72c-46e3-4d90-a87c-4a90ee642907", "value": "3072:XUWBI9/IBLuSnYLQfpHk4FATplMowoQ/Bjx6fZK:XUd9/IE8YYHc2L/Bt6fZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667315, "uuid": "ee03e543-9178-41dc-8b87-a682e45361bb", "value": 158624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667315, "uuid": "b3cc9eae-5a6e-45bf-92d6-3c2e5724d3b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667315, "uuid": "8fb115f3-a638-43bb-a9a5-f2da800c01ec", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a30d530-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780638691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638691, "uuid": "a1c00371-b651-4647-bf09-2a5984ef096e", "comment": "Malware payload (Mirai)", "value": "8dd607aea1f22631d2eef0c76415f7d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638691, "uuid": "894d837d-1176-4aaf-9f97-53d26e89282c", "comment": "Malware payload (Mirai)", "value": "62eb9e723d53a1b836bfe87e2af0c38b94ddd6a65e14bd2a89b41dca9b2b96d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638691, "uuid": "49df2ebf-2011-4d02-af02-add9b1adabcc", "comment": "Malware payload (Mirai)", "value": "8bb0eff10df716aaf5eaacf09fafd96d521c8e40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638691, "uuid": "dd365cdd-1f51-41ab-8acb-50b3ec7440f8", "comment": "Malware payload (Mirai)", "value": "2efc8451f5fbd473d8c66f76bac10d5b0bb197984dc09466c05d9f5ef1e116b605273130d62da47f04744f07c6c0ac80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638691, "uuid": "82df3b74-a3b5-491b-a2e6-35eef3316d13", "value": "T1C2D3E672A64ADE73D50300F211A6DF224D32FDFB5826D596E778BC70D9320C29A51EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638691, "uuid": "e091accb-ae69-4eeb-b0dc-ebe3b70f046b", "value": "1536:QrMPNdYOJcUvaXpZIi4kkKrBtPWuNQm9OhYo0JsbdqHL1kdiR:QrMjQUvafFJltPlq6KvRqOdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638691, "uuid": "59076fff-4af5-47ae-8a16-1c54a088a27c", "value": 141116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638691, "uuid": "338dbe2d-687e-4379-8425-cd39a77038ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638691, "uuid": "000df6e8-a7f7-40f9-9fa2-d7553a8f0892", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d076655-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642024, "uuid": "dc9fd120-40fa-46ac-8102-955bc30790e0", "comment": "Malware payload (RemusStealer)", "value": "cf127c6348873f510b802f9a31289f23", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642024, "uuid": "6cf43531-0848-42d4-89e6-f6706893d45f", "comment": "Malware payload (RemusStealer)", "value": "636aaf7ca40f9e0afc947f9a0f380a1457402afa9f7c968a9a70661b2b489231", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642024, "uuid": "231a0455-0db1-46fc-9c01-517b25fab166", "comment": "Malware payload (RemusStealer)", "value": "4d2c86698fc7875c595ff9c8bae4de880624bd79", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642024, "uuid": "377808e2-92e5-404c-b4ca-e4927a6251ea", "comment": "Malware payload (RemusStealer)", "value": "a0cc3ea7c0962d1684ac296923e78a47549f58c5fe477d8d8aa7a2d8eba7c6b385d783adb480754b5a53f6261ecd7fe1", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642024, "uuid": "3db0db4b-8cb2-4dee-adfd-ec58bfc9b788", "value": "T14FD5E00A528762E5E1694EB6C97F61C6D738ECEE5E7CA30EE9C439360E325840F32715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642024, "uuid": "a4fe5b7c-1d08-41cc-9cfc-cb3c484cb000", "value": "49152:k8KODSRQ8APiuF0g3c5s5HB30l5OufNuTclghDaN8ygMcgR:B2Si1g3aNZfowlgpcuMcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642024, "uuid": "3294f915-d166-49e8-9c2a-b753381c60c1", "value": 2745344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642024, "uuid": "a40c62a7-bf4e-4572-b418-4928d3bab1b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642024, "uuid": "b7311e02-b81c-4ee5-a3f3-74093b9266a2", "value": "636aaf7ca40f9e0afc947f9a0f380a1457402afa9f7c968a9a70661b2b489231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c79ea49-6105-11f1-a769-42010a9c0008", "comment": "Malware payload (Koceg)", "timestamp": 1780681134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681134, "uuid": "76e710e7-741a-422f-9a62-9cf5a1ea565c", "comment": "Malware payload (Koceg)", "value": "d3c781c97122014176f340dc94908ee0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681134, "uuid": "b6dba279-2a70-4614-ab82-e4a131deaf6c", "comment": "Malware payload (Koceg)", "value": "63b3d2aaa4c100d27877aa9fc2da5876dfbe8e77c657ca6a8e48d209b7b888eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681134, "uuid": "d2ac7a29-6f4a-476d-a386-e2442ece7117", "comment": "Malware payload (Koceg)", "value": "1e0db70471fb892a77be4ded7431f01ac5c73ce2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681134, "uuid": "0a987e5d-2aa0-4f01-b6f4-29238f8a39d3", "comment": "Malware payload (Koceg)", "value": "acc52bd5bc6a205f9c624c21fdd2118b4ea6ccf3decf4c9c0131f53081168936afa2ca34804878d06a78b022a3ee2151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681134, "uuid": "aa5379ab-6d1d-4afb-9a75-e775bd56a845", "value": "T10EC4231821CB8B82E4A2757027D61FA9BDB409740C5F1E6F57B96DEE934B1CE4CC6C06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681134, "uuid": "bde6a5b4-2cd0-45e7-b70a-af751a3764ea", "value": "08b656407b8d307979dc72c3fcc683a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681134, "uuid": "42b3fa18-6963-4372-b1a0-df4848f6ecac", "value": "12288:ACCs5xOKx2Nht6igCFR17fA9avjLgKCqiadCrd:AU5xOuiPXVAgjLgKBiHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681134, "uuid": "81da66b7-826c-40e4-a5ea-4222a9a6c445", "value": 592900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681134, "uuid": "cb496c73-facf-4bb8-a2b6-76ebcc332156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681134, "uuid": "f14bb91d-79f5-4323-a660-997cbc98f8d8", "value": "autorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8491b063-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642520, "uuid": "e0ad0fd7-2198-446c-b124-f5550e111a9d", "comment": "Malware payload (RemusStealer)", "value": "8ac68b43bb471fb676c76e999d38501f", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642520, "uuid": "e27bd4b8-396d-4611-8a73-403aad1c896c", "comment": "Malware payload (RemusStealer)", "value": "64fdaf28d2f52ed847fa32d016e20e06d6a5728319000ade61363a5b291a9031", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642520, "uuid": "925dc6ac-78d2-44e9-8676-74038fc63c7d", "comment": "Malware payload (RemusStealer)", "value": "9909133066b011119bd2c8be5dacfb16d55e09fd", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642520, "uuid": "cc88214f-1a6d-467f-837a-0c7358bc87fb", "comment": "Malware payload (RemusStealer)", "value": "1fc5d65a336cd26087bf4d8a3864216ab5cff7beb2ca6532b1b016ba41a55da5c1a164ddb90e6ff3d7130fda6f9f0b10", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642520, "uuid": "11df2388-5de3-40f9-ad6f-5654c90add78", "value": "T11C34296BC16331FCE553C07883666232BB32B63C47745EBB02A2D7309E619D05F7A969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642520, "uuid": "e1101491-debe-4925-abfb-c45e417b3b62", "value": "20c08c2c4fbe56b4d08586185a84e7e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642520, "uuid": "4020cdbc-daa8-49fd-88a8-34dbf5757dbd", "value": "3072:puasQyBVshtd+fOUIA1qwMpfUkwMU86O6iy5JuRw1pdvbU:pSDs7BlDUkwmn6iy5JTdvbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642520, "uuid": "adb3fd22-f9e6-40f2-bd2c-a30941515d18", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642520, "uuid": "09160af2-0409-4c2f-be65-3fc20ab9ce0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642520, "uuid": "4b693d9e-ead5-4568-af56-2a82e2f00a89", "value": "64fdaf28d2f52ed847fa32d016e20e06d6a5728319000ade61363a5b291a9031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10daa16c-6136-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780702026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780702026, "uuid": "c7163fd8-f2d7-4d46-bc47-1b8f0c348980", "comment": "Malware payload", "value": "127d49fa9f5d1eda53002760a4339d0f", "object_relation": "md5", "Tag": [ { "name": "181-214-48-111", "colour": "#F5B72A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780702026, "uuid": "cc9b6727-a023-4f6c-8153-13433175fc54", "comment": "Malware payload", "value": "65e1f57be4a1efe7b1193da12707795493ea98a34d4813be912baf1df8d701d1", "object_relation": "sha256", "Tag": [ { "name": "181-214-48-111", "colour": "#F5B72A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780702026, "uuid": "3a6efc88-b455-4497-8f8c-41937e6029f2", "comment": "Malware payload", "value": "f119d2d2bc7321da2aca8a2a3652a71ecb3e1001", "object_relation": "sha1", "Tag": [ { "name": "181-214-48-111", "colour": "#F5B72A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780702026, "uuid": "b83f33c8-3541-4c01-a081-bad45223f33a", "comment": "Malware payload", "value": "1d9b95ccb20c804568ebd254eac4747fea467c6dd859e1e06a83ced58ec2eee93bdcc51513b98fee08dab5d0d94f73da", "object_relation": "sha3-384", "Tag": [ { "name": "181-214-48-111", "colour": "#F5B72A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780702026, "uuid": "62eeb4d2-6e4f-4219-b7f1-de8b8754d2f4", "value": "T12277236C87B8A05BE5E7E73111B4AB44564EF812449BF77C4029A48C76B2E8D4E83F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780702026, "uuid": "3e0d20df-b8c9-4cd1-999c-8432f3c634fa", "value": "e328ec38bc72daf16e6ce1f966acc48e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780702026, "uuid": "f9f82be8-65d5-4500-8d9d-bfff505b65b3", "value": "393216:9qRn6zEdhRhyFygSLFwWhawzHW/nJJCTXXOOz0:9qRDdhR8FygEFwhUW/nb6XOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780702026, "uuid": "3604e601-ec4e-4005-94e3-a751b0a6d742", "value": 33079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780702026, "uuid": "cb6544a1-21ba-4d29-9802-de2eedabaa72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780702026, "uuid": "35298fbc-b1d0-407a-8ad6-9e0720dfd866", "value": "avutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f32e856-6109-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682776, "uuid": "da57e0ba-d217-4540-9a4e-ed8d984ed3a4", "comment": "Malware payload (Cosmu)", "value": "a7da853600f32cf79333bc4079ee5d8c", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682776, "uuid": "3fc543b4-cb7a-42d4-a893-523fa2fff25c", "comment": "Malware payload (Cosmu)", "value": "664dbc36d07b249023d5e462666a730c99cd1e629e2799c477a5e0e420519639", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682776, "uuid": "7d3bb772-cc73-4887-b33b-397bd6689f1b", "comment": "Malware payload (Cosmu)", "value": "f945947b9f82daa336c2506d22f3cd25eea80e11", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682776, "uuid": "cd3febf8-6df2-4187-8dd0-a4669d10602c", "comment": "Malware payload (Cosmu)", "value": "fe2b1ad39a2efaa9c384c7d3d2380bb39c7a10b60d9f11d4fcd1d266b5360b594c2607260924d3762d6f7eac31a6418a", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682776, "uuid": "6d4b4f09-dc4b-46f0-bf1b-55a5b191580f", "value": "T19224AF553C53C073E041497689E98BD08BBF6D03BAE7D01BFB990E4B4EE12944BB72A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682776, "uuid": "8732477a-1a90-4346-b0ec-786153772c95", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682776, "uuid": "a423252a-0d43-46bc-aa74-61c016e3f329", "value": "1536:vxbG6XWMuAPzu91nLsemkTOCJ0gPnh3tG+hckUemjxkNrovgjcxgkaqTBQPw:vxv/y9LJ3tGXRvjxu4aqTBiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682776, "uuid": "168a5f0a-4966-4faa-8a0e-7646ddc79218", "value": 229378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682776, "uuid": "208e23c1-bc68-4d2f-b1f9-6a239d6c8bb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682776, "uuid": "245a2784-9e75-4ed0-bc63-25107a2561eb", "value": "jaccessinspector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193c99ae-6117-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780688726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688726, "uuid": "b936ef24-ed4f-44b3-a352-6151ce140e3b", "comment": "Malware payload", "value": "85853508a4cda69f3e2812ffdf107243", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "pmpo-cloudvector-cc", "colour": "#275F21", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688726, "uuid": "51cf49bc-9259-4104-8b69-991457fb5527", "comment": "Malware payload", "value": "664f2e71b527adadbe24f929057edf5a270800162dc18dca28ef49ffea5bc00d", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "pmpo-cloudvector-cc", "colour": "#275F21", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688726, "uuid": "029421bb-cbf4-484c-ad48-be2b3c13e838", "comment": "Malware payload", "value": "05a55071a0c1cb07c8f45ecd313b2f5ae8f5b04e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "pmpo-cloudvector-cc", "colour": "#275F21", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688726, "uuid": "82d161ec-0df0-422c-ad5e-1d1d81331fb9", "comment": "Malware payload", "value": "8b02c2bb4547b40f1f0b2c7f601973e817f0d6e4182a2c6c3fba7b3a03b7aa113e39985c2b06e3dd0f582595e732f7a0", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "pmpo-cloudvector-cc", "colour": "#275F21", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688726, "uuid": "a14cc13b-0090-43e3-a6b2-f143bd60c062", "value": "T15817339CB4BAB90AF4D54377C5C62CB6DB2CA440E3DD398F8E640156BD8311E4F6B862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688726, "uuid": "de8220de-43e5-4fde-91d6-227ecb3e8575", "value": "393216:0WdJC0cK7WnToawhJVWMJGSBduogH9gVF4:0GhPWToaBordK9gVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780688726, "uuid": "c8746650-9d18-4e44-a9f4-b6cf0b43279b", "value": 18653007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780688726, "uuid": "a99378f0-f473-4b2c-92b8-506b911082bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688726, "uuid": "624bacef-91e0-44d4-885c-4d7660d1a342", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f21b0c-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780648619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648619, "uuid": "acee69bf-a1f1-4e5c-8ac9-f8400bc26a7f", "comment": "Malware payload (MassLogger)", "value": "f94f2b5381351541048644480c77790b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648619, "uuid": "95c46837-a65a-4cef-8efa-3013d1c32571", "comment": "Malware payload (MassLogger)", "value": "66db625b80c4fd0725ac10e8d59fccf81b747dfa330041196fab74261a8aeb66", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648619, "uuid": "f0bb5f69-f368-45ee-a3ac-a5d41c273399", "comment": "Malware payload (MassLogger)", "value": "b0cec3c5fd422806978e47dab6cbcdff9b0e9a86", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648619, "uuid": "c5084f4b-9ecc-4f19-bfa9-63cec6ae0c5b", "comment": "Malware payload (MassLogger)", "value": "a0067b990053fee08b8072a04b2c3333a019c76ffc32b3288d7142e7f98b9068be2bb0950a1d8c4919a064cbbd73f136", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648619, "uuid": "166e608e-337f-4128-be0d-978cc2a60c4f", "value": "T189E50EF7E9E9DF294C891393CDEA2FC65CD6D9AE59B29069B80CC7C13D870291432C61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648619, "uuid": "58a5b125-0b7d-4130-9cb8-089c2e57c54d", "value": "768:gWc2BLpoh8ekdvbb44irfSvPO04pt932FiYWAeoxxTwpfpuWirOxYTmmc296nX6a:dBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648619, "uuid": "ef3283f1-01de-4453-b82d-b009bca19141", "value": 3246120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648619, "uuid": "cffab40c-55fd-4a53-b608-86b9c264f07d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648619, "uuid": "b2502e2f-f4c8-4df5-952f-82c91129ce14", "value": "PO-2606-01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76dc846-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642230, "uuid": "57d48350-0677-43dd-9636-f18f4f69c1e7", "comment": "Malware payload (RemusStealer)", "value": "a23c9dc7ffe63c6eea07b6e112ae89e8", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642230, "uuid": "b2c37201-57b1-4d50-855a-c5add2d5424f", "comment": "Malware payload (RemusStealer)", "value": "67cde450e21161cf879c084d05c4cc147058f6f8d750bda8bd605e127d59b716", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642230, "uuid": "aaffb6dd-a5a2-4ced-b3ab-a0f96cd9ed5d", "comment": "Malware payload (RemusStealer)", "value": "2347d5a7b56fd36f76da4be45f86a1c8308ef421", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642230, "uuid": "ddc74ae6-83b9-42bb-b452-ed9358381f38", "comment": "Malware payload (RemusStealer)", "value": "1cdce5ad502bffaec5dfff0ef121bc073e9cebe731cdefbc156737c231cfa711bf26996ac0c7d10c3b95d8a910e5df2b", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642230, "uuid": "8826f179-76a7-4b5d-a6fd-c2d33f856377", "value": "T17B243A67D29371ECE553C07852667232FB32BA3C47649EE702D2D334DE61AC06E79928", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642230, "uuid": "4b7c7c07-d126-46d6-b636-351e800a5b56", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642230, "uuid": "3555969e-9735-4db9-b16d-56fa361386bb", "value": "3072:2P2Up7/iiOrVA6GX4apRs/kBMjV9SDpKHr2zcViQQ:RUp7qbrVLQ7pRP8VQD1QQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642230, "uuid": "5b52a061-b24e-4602-bbd0-58c430389114", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642230, "uuid": "dbc0c774-ce61-426a-87eb-34bf9c58361e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642230, "uuid": "99f40e58-06ba-464a-a23f-e2a33102ad5d", "value": "67cde450e21161cf879c084d05c4cc147058f6f8d750bda8bd605e127d59b716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7fd6bf-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780667575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667575, "uuid": "5ec42747-8ee4-47e0-9e89-d1b4e5e12214", "comment": "Malware payload", "value": "34949ecd38a1d532fa22cb88fa55be98", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667575, "uuid": "e0e1ddf4-cf0f-4480-80e4-5c59c5c517e9", "comment": "Malware payload", "value": "67e55b73e07b3cb11d3f5bc1490cb585fb185c0267a7827cf801c9f6bb3abe7e", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667575, "uuid": "1ca59a3c-5431-4a20-90b6-0e6b8c9cbf43", "comment": "Malware payload", "value": "a4eb77b3d8f3cc506629294f9e8e00b078192dfa", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667575, "uuid": "3e25ef76-f79d-4ad0-827d-b63a9f6a3b47", "comment": "Malware payload", "value": "29ff0ebc64d15a7266084e7c3f3090c804bef76874b1ce1e4323413e3904aa8364d19660d59226feef29a887797e1112", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667575, "uuid": "3a70166e-3f20-46e2-a145-98bf05dde0a2", "value": "T13774B45AFBF620E4F5B6C13895A2312AFD7138A44738E7DB9681560A1B30FE4E93D740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667575, "uuid": "2899e91c-d67e-4ac9-8427-a7b88ca8e725", "value": "c0d0bbef748fdd997faf483a125e720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667575, "uuid": "b2448131-96c5-4345-af3a-ee800be32d15", "value": "6144:4SbKOZ98iXhLwUs+IEz2koH8cw3Tz9Gv3N6IgVVK:4SeOZ98iXhLwUsf+zHbVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667575, "uuid": "7eae6a5e-671e-4116-a77d-f42fd7b105cc", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667575, "uuid": "c9f71c80-272b-49a3-a4b0-8472cc8697c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667575, "uuid": "762d3fb3-e6eb-46c8-98b1-39c9ace47bff", "value": "payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a802c8-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780648672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648672, "uuid": "f1f1116d-2140-4844-a91e-82f479b26a46", "comment": "Malware payload (Formbook)", "value": "74b94dded04dfaffe409d7055913b0a2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648672, "uuid": "cbb0e01b-f320-4a7b-a48a-0687a21bbe65", "comment": "Malware payload (Formbook)", "value": "68635eff1d9df4d550a87a6a6942c1233fdaf4498dc8724e7683ed48f92dca05", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648672, "uuid": "18d1fac8-c90b-4a7d-b472-685cb6e724b8", "comment": "Malware payload (Formbook)", "value": "0aad4edec1960713ee83f5c1ff20b80d360c0648", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648672, "uuid": "da0259fc-2804-44d7-a2e3-9900cb9e7e50", "comment": "Malware payload (Formbook)", "value": "f7fff63cbdd800ba0902e8048724eea4aec2b2930f2e0773458b33e5953a983ead607a9240a304b35d4004a67749bbd9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648672, "uuid": "2d90712b-8006-4692-80ca-ed81fcfbc0e8", "value": "T15DE55B17D66F974E18093B61106A5D9AFE89CEFCEF726BC4E0CF90B110EA1110B856B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648672, "uuid": "2eb5e207-c668-4c0d-ac2c-1054d138b3b0", "value": "49152:lmEXiwjuKKlLC4i9/SjR85IIEifq56JspvBvgWZhkV9r9bNx72UP1qtAWbBz5HjD:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648672, "uuid": "0dab23d9-4984-4aa0-806d-5369af957834", "value": 3135956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648672, "uuid": "3f293992-4bdb-4473-a1fc-01bebbd89f10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648672, "uuid": "ea1ab238-1b17-4777-aa29-401cf12fb675", "value": "RFQ-SUPYHDKX 09-2026_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4922660f-60e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780669049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669049, "uuid": "1fb49836-d350-4609-9608-a819f92f8bae", "comment": "Malware payload (Mirai)", "value": "a0b8cb1ec4db338ea7fbceb961aceaab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669049, "uuid": "55811a07-df35-49af-8b0a-88dcdf84f1d7", "comment": "Malware payload (Mirai)", "value": "692c07a775dc0f0d29433adf155fe5b024f494b4e2f98c9ef8a2c25bd7534a3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669049, "uuid": "298f62c2-9bac-4d0a-9f1b-286b4bf5faa1", "comment": "Malware payload (Mirai)", "value": "1bf7188a86bade5e4549e940dbe881eda5674f36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669049, "uuid": "20382890-f20e-4771-8a96-5162f867fd1f", "comment": "Malware payload (Mirai)", "value": "30d37edefc883ac6f24df598c7dabc7f0acb91bcf91d9878594c4b04ab22e054f0ab7383eeb09a708382808f74980549", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669049, "uuid": "d00d84f5-12b7-4b00-a093-3ab388f52ed5", "value": "T1B7933AA2B400CC3EF81BE6B780474B16F624A3E55F522F27B626FD63DA7D074185AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669049, "uuid": "21fdba0b-9310-4992-b82a-38c97edc280a", "value": "1536:UHO/aZIzH3L22yXZgsdlL2VxafcmUAXGykb30+OOf151F2l80NDj:g7ZIr3nyXZgsGxafc8GfkTOd51F2n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780669049, "uuid": "1c210a4e-3f38-498f-9f4a-194e8f6962a1", "value": 93956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780669049, "uuid": "cfdd17d8-9c49-41a1-8e9a-fd2e4387b01e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669049, "uuid": "c5a91070-4d86-439b-ae2b-d7cd19ad4478", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd10231b-611f-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780692436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692436, "uuid": "b110b96d-19ae-4e63-99b2-1b7235f18cdd", "comment": "Malware payload (ACRStealer)", "value": "34978f641bcce63b3a43d2865a7611cc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692436, "uuid": "c176965f-152e-4ed4-864b-c336e95aeb89", "comment": "Malware payload (ACRStealer)", "value": "696420e2d8f3d36081022d71db11ae48b5bb17b5c4f46db590745044f706d7f9", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692436, "uuid": "675fe51b-9a0f-42a2-a1a0-21df755210fb", "comment": "Malware payload (ACRStealer)", "value": "ee45e2b8797e43fa306dc0b72d7899481f1baa2e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692436, "uuid": "3a2fe781-5a4a-4b2b-9dd7-98b9b9c5a8cf", "comment": "Malware payload (ACRStealer)", "value": "6761ad6467a0eff1708630b91f81365b0cc38b7f8b15e1b03a10988b20a19c4d3c0fdcc05c5ed89d04bf4f111cea1bd2", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692436, "uuid": "f6272529-d13d-4e98-a993-90de77cd4ad0", "value": "T12E667C0BACE408EAC56AA33289B35192BB75FC490F3263D72E51B6382F727D45D35718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692436, "uuid": "3a0a53ad-0f88-473f-89c5-23cd4c118eae", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692436, "uuid": "ccb142f0-46f6-47ff-990c-5404c88f1164", "value": "24576:HJPVHaX0RWmdwIkAeCCVzLKLDR7+R4R31IKYkOgDg83cjFAWvFz/nBele7tKDyio:HJdHaERix3CCVz4DpNIh8mXrngm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780692436, "uuid": "69649a16-6441-4b41-a096-43f33ff6385b", "value": 6669960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780692436, "uuid": "ebb6c620-3147-4f6a-a942-684c846c063e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692436, "uuid": "f499bfc6-3eba-4bb4-8737-bf3fee73dae4", "value": "bjbh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112e2ca5-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1780642326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642326, "uuid": "a890d254-df97-4ff0-8784-91182cd9636e", "comment": "Malware payload (Smoke Loader)", "value": "2401209d23cbbdb7b5807387d5164f11", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642326, "uuid": "ee15fc25-247d-479f-907e-5ef6840f68e0", "comment": "Malware payload (Smoke Loader)", "value": "699f7c3e2525531850a98f32d2cd60050d5d8b98a00173b45cdcdde5384484b4", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642326, "uuid": "077a64b0-d0b1-4eab-b493-bc629de45629", "comment": "Malware payload (Smoke Loader)", "value": "854ccbb2257e25cf279762c320ea88a7feacbfe7", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642326, "uuid": "41e7f6b5-4676-4f08-9b8b-98ee0a580bcd", "comment": "Malware payload (Smoke Loader)", "value": "5d9240acf5ae992779e88c461bdfedf8d78a8aa9ca9ce4c275a6a99e52bc8a6c492a51d4fb6867fa9a62ee6f609849fc", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642326, "uuid": "f3592e59-707e-44bf-b85e-a78a63f2f264", "value": "T154D5DF0271BDFAC5F1F4617529A0AD37273CAFF0895C819AE2C8F537AEF16050E15A29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642326, "uuid": "798d08eb-83bf-4370-9087-5b8ed8984189", "value": "49152:hqyQRjpmsWjP+mizeNSGJHWDSEFdS6Ed5ELUsg0VjAeP0ERuukvwoOU7OX:wyw4sWjIEJHKFE6w5EO0VjA7E9u1/7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642326, "uuid": "2c050f98-f423-4991-a16e-6cf4ec28ee25", "value": 2816512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642326, "uuid": "545ccce6-c6d4-444a-b603-01b50b214af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642326, "uuid": "81a4bcd6-616b-4825-a50a-c610dd4c47c9", "value": "699f7c3e2525531850a98f32d2cd60050d5d8b98a00173b45cdcdde5384484b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9fe7cd-60f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780673650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673650, "uuid": "c7b09b27-c900-4dbe-b3e9-99d00ef6a202", "comment": "Malware payload", "value": "70c7b465c26dc467d6636b46e210363b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673650, "uuid": "882a9231-9876-487c-bfde-59de6055f898", "comment": "Malware payload", "value": "6a3992813818d72b49a756c84c9b622fb0c03f16c8a7521851650a1af164a355", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673650, "uuid": "1d842b24-a17a-4513-9ae2-fdecc62ab4de", "comment": "Malware payload", "value": "5970bd0b65750586fb4690fd736bb8309476a26b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673650, "uuid": "9ff05573-0b50-4f59-8f27-f2d05f353fae", "comment": "Malware payload", "value": "51328f6363213118a7103e93432fcb26780dc86c497e81a8f1b3b2bb8b5ed47d63a80c4eb8209e2a821484d2c5f0af51", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673650, "uuid": "0b6d72ee-5ffa-4c91-a4a1-b4d63f04321b", "value": "T1D0D2D034C4C82FBDEE9A2A1C06FA6620D7D68B1E9494860737437D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673650, "uuid": "2809d92d-d436-41e2-90b8-ad0344220b43", "value": "768:AumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Au+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780673650, "uuid": "6e5a8ec6-ecc9-4d2e-965c-0360bc16d754", "value": 28653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780673650, "uuid": "ac0fb8e6-c0d3-4691-9970-dd36cd2ee1f0", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673650, "uuid": "be8959d7-477f-4819-9b16-2f8b298eb46b", "value": "23.94.110.24_1780673622822482_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc016a6-6120-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780692758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692758, "uuid": "77d101a5-d21e-4985-a890-75fd65b85da1", "comment": "Malware payload (ACRStealer)", "value": "f4238710be544ddfaf1e2bc0c2bca73d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692758, "uuid": "2e82eeaf-6636-4def-9155-3cbf8d2a53ef", "comment": "Malware payload (ACRStealer)", "value": "6b9dd9562c04297552e8888d34517bf89c8739b4a1897961204145271ba86830", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692758, "uuid": "08e47e20-6c2a-4543-9949-242dfcbff2aa", "comment": "Malware payload (ACRStealer)", "value": "ff9e40db33d14427c4b42b1383500a5d536a1bfd", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692758, "uuid": "9387e69d-66d7-4b10-ba73-c552ba550868", "comment": "Malware payload (ACRStealer)", "value": "d6a1852d89224989349da4aeccea02e6f2151c270ed6298f24a66583a83086402d3bcbfbfd77f670a8b1936fe5108e75", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692758, "uuid": "9c30206c-79c8-41ba-9365-bd445b2e80dc", "value": "T183665A06BDD109EDC49AA33189B66292BB35BC490B3623C72F51B7382F72BD05D7A744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692758, "uuid": "9d1a4561-3254-4795-9d38-ca7646e8bfba", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692758, "uuid": "c89f2b6c-1848-45e3-bf39-d32f3dc9472b", "value": "49152:wGJ1IGxk59I1fV5ls2bvYA2u3H0DmCnfM3:wr8gA2dmCU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780692758, "uuid": "da7642ed-6a76-4693-a8cd-ce77eb2f8dcd", "value": 6845064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780692758, "uuid": "81c75b32-4689-423f-8d37-5ca45707ca76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692758, "uuid": "d7e19424-5846-4d56-8a44-4f626844d3f4", "value": "kliulij.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9cef78-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681990, "uuid": "ae9431e8-5b2c-4832-872e-216de25ef839", "comment": "Malware payload (Cosmu)", "value": "3f1c1b572c24df278119b512bedcd07e", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681990, "uuid": "9d9de1f4-3445-42f1-bacc-823c22e29471", "comment": "Malware payload (Cosmu)", "value": "6cb2c566b78299791393eb8e5131c27a336e18d4a12ca1c5d41fbd28f1a38258", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681990, "uuid": "943e8ec6-4a7d-4be2-a596-0d0e655ee910", "comment": "Malware payload (Cosmu)", "value": "aa46f5695f1d07e6d768f3ae947fd17bc4a87957", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681990, "uuid": "5dedded5-f7ce-42ce-9b95-5b566e5650cf", "comment": "Malware payload (Cosmu)", "value": "2da5e9032261960f1ff38d6d80cb9c7f68ed734a108125579b6143a9522264514d70c6c2afed659255385551c53f3f48", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681990, "uuid": "eae5f45f-df24-416d-8b8a-d664ce6ffa45", "value": "T1AB24E1593C53C4B3E0414D72CAE58AD18BBF5D0376E2E15FFF990A474EB029C4AA72A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681990, "uuid": "5630678f-458f-447a-b5cd-e4bb5fe626b7", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681990, "uuid": "4c4cc17e-3302-4112-9ac7-fd38647e7559", "value": "3072:PQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB:K9lKgzelZNQSBQGH/CSpWqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681990, "uuid": "3f7055d9-7365-4702-8c68-742c2b098de8", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681990, "uuid": "d4158b79-cfa2-46c9-a188-a4c5f8c78f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681990, "uuid": "bbb72f44-201e-4c5b-99a6-ca11169a9860", "value": "cleaner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b912842-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780636895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636895, "uuid": "d1a19581-fac0-4ea9-a09d-1c4df87181b6", "comment": "Malware payload (Mirai)", "value": "b4f70d69fd5689cadf46500b954c1106", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636895, "uuid": "b130b1d8-0c28-46d0-9abd-f1d7eb78bdb3", "comment": "Malware payload (Mirai)", "value": "6d8fdf8f5886c594e4705cc207f70c979293c28a59d3fd27fac7ae617e469038", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636895, "uuid": "e7b6bad0-675e-4043-9caa-69f825112b9f", "comment": "Malware payload (Mirai)", "value": "2ed7f5042ce5baaed1ec34ac5c33674f7a6bf746", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636895, "uuid": "eadc8cc3-288e-4d7d-ba06-01db067842af", "comment": "Malware payload (Mirai)", "value": "378eefa4c5701608e14e05b0fb1a117a6ba467cb3779279d56b91e119d130d3da7009a3d687e8ec94553b981ce793710", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636895, "uuid": "cf324abe-886c-47fa-8145-c15992693a6b", "value": "T10AE47D9CFE4E3D42E2C7E3789A4D87E1721B71E0D72391A37982034CD5DA9D9CBA1A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636895, "uuid": "d0281f19-9f52-4d15-9014-6cb34056f316", "value": "12288:NC22jleuGvFN0MZj7kahsvBOy/g7ltfXp1WRn2uRGWS+raw5X4t08m:Nn2jl4vFN91sZOy/g7ltR2nRAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636895, "uuid": "8ec7db54-4385-4820-9293-91f4866795ee", "value": 697040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636895, "uuid": "c7e5a142-9154-4350-b238-0ff18276ad4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636895, "uuid": "9f51f776-8b0f-421a-aef3-7be57af5066d", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdecb415-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780642616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642616, "uuid": "86ed4f21-ae4a-4aac-be36-59afa55dfe09", "comment": "Malware payload (Expiro)", "value": "94f3c10fa8d4d09285c5c8b07a2759b6", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642616, "uuid": "079fac13-4a61-4590-ab19-5bfb86c2c07a", "comment": "Malware payload (Expiro)", "value": "6e15ec62ac3dccfef05cd7fe8bcbfaff4973043334e984bfb70247869130f53d", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642616, "uuid": "bf1100e6-2c4f-41d7-ac6a-e51613445cf9", "comment": "Malware payload (Expiro)", "value": "26a84cb5a697f55b0b5a61a0ca7cdbe9ae0e2199", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642616, "uuid": "10174bbd-cc7c-4ccc-9878-79cc495c3f7b", "comment": "Malware payload (Expiro)", "value": "46ffcb6dff04b833f90fa2d0e2cf0c0668d2babe9bfafdda1f8eabb39a2a91626ad1072092241da2b34499912bdaeb8f", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642616, "uuid": "020e1c66-d332-4328-b752-22140b84756e", "value": "T17AA5235A725972FBE83743B6A89745534F307CA4AB2193AF32D8927D09733E00276F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642616, "uuid": "068b2970-e392-459b-aaf7-17404e29cb9f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642616, "uuid": "5abf058a-1ee1-4f49-8788-3752fb5d2e69", "value": "49152:72xmH0xTYdqOTyJPJnZPdwc8Inn5mJihQ/lFTjN4:72gq8dqOuJPJNF5+Lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642616, "uuid": "e114ecdc-b409-4119-84ba-3c4e535b0ec2", "value": 2230272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642616, "uuid": "f5360a8a-1c57-431d-ac6f-5cfca76cd61e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642616, "uuid": "28485cc7-74cd-4fc4-9f86-97d0f951d166", "value": "6e15ec62ac3dccfef05cd7fe8bcbfaff4973043334e984bfb70247869130f53d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d31c11-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780642759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642759, "uuid": "2c250b28-23c6-4da9-a892-27ec59d646aa", "comment": "Malware payload", "value": "d118c619d8ee8e4c18f78876118665bc", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642759, "uuid": "0de2dc46-3ba9-4cfd-be7c-878736669518", "comment": "Malware payload", "value": "6e2c185409672fe33b4832dd29f3062cb368391fd23fa35910cfef22fe65113f", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642759, "uuid": "cd5056a1-6bfe-4ff9-83ce-544d1aecaadc", "comment": "Malware payload", "value": "2e24debb00bb5032394049c8f42b0686c4ce7287", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642759, "uuid": "63ca4713-0017-4299-b878-e351b9eab7bf", "comment": "Malware payload", "value": "ab944aef60fbf51a9559cc7a4082c77bb979fa366241bb456b01feb45d972595bc5014fe080457faa6e3a95e5f4135af", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642759, "uuid": "a409fe5c-39dc-4005-80c9-88b76e0b1fca", "value": "T1C43422792D49A054DD8875A38DD62C7A41EA30065888F929C813EBFB5BE3C77E4B1F07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642759, "uuid": "979db4d7-7535-404b-8e4e-e860f10cc21f", "value": "6144:lcEZGNXlqtZCR6YCYl3HUxpDTTclHhC2a447T7xwBrMNgPmvQTR4qU:fwXE87l2YlHhCX4M76y9vQTjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642759, "uuid": "f8b4fadd-8a8d-4707-902e-22c5e8c6f4f2", "value": 249492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642759, "uuid": "f61e495e-33ce-42b0-8fc1-d7710ad3a8a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642759, "uuid": "f9c22281-e3f5-4b33-b947-2adbdcde5607", "value": "91c3ff9ec7cee3f3460620ee79851263f1099abb63e55b0946eb24245cbb3ff4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e05598-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780643079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643079, "uuid": "fd03f61d-e7c9-4ee0-aaa7-06cb59598bda", "comment": "Malware payload", "value": "b330bf49367136cc6aaeeb72a6eb69db", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643079, "uuid": "919c70e5-a800-4fb8-9356-015138f95058", "comment": "Malware payload", "value": "6e2d46d348bf54c5a311723add1ef60248699218efe59dbebeaebb0d5e193d21", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643079, "uuid": "1696e5ca-91d0-4e10-99cb-6493421312a5", "comment": "Malware payload", "value": "97cf8a129c14440c7cc074e62b2cf2155b54f2d0", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643079, "uuid": "6a6675eb-0ce0-46fe-9e72-a0dbc2fddf99", "comment": "Malware payload", "value": "70f25c6c5113308d5d87d40763e15753e71667afa16fd9e3bf903fbaa5862b4b5bca889603e4ff93ac434fa667746a0c", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643079, "uuid": "906d9de2-9e6a-4991-9929-c6bde5f3a117", "value": "T18D51F18D34F360C282B2A064413BB59AFA285A95C74CCA14863D86BCBD704ED7357F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643079, "uuid": "fa8b8397-7ea8-4017-ad30-a64c2d1a6289", "value": "48:NE0tWhnYcc1n+5+6Fw3Fbl50+14WcC1TmWazLlB8mQVxlBuLUjgOt3ZfuT2ACB:NE6ZccRY8oWcC1TmJzLlBnQVxH9RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643079, "uuid": "59ce185d-0432-4604-a5d7-c045b6354772", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643079, "uuid": "73b8737d-0924-4baa-a7aa-1c08cf899335", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643079, "uuid": "807a0268-8ea9-4c77-9ae2-3995075a77d5", "value": "6e2d46d348bf54c5a311723add1ef60248699218efe59dbebeaebb0d5e193d21.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d762d52-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780641515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641515, "uuid": "a9d30e31-5a59-4f4f-bd9a-691dcf8dd088", "comment": "Malware payload (Mirai)", "value": "e0689912dce9eea06e17de5ad773bdd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641515, "uuid": "75650cc2-bffe-4608-a245-7dde38748c31", "comment": "Malware payload (Mirai)", "value": "6e3400f65148af68a294a37747ed723617389fb7f3b01389cadffa892d9804be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641515, "uuid": "baf91ca5-33fd-4fb9-9201-3bfad19ed827", "comment": "Malware payload (Mirai)", "value": "1a62973cd9ef328eb5a50fae0d60b7f259a6b65d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641515, "uuid": "250a5c2a-808c-4ebc-bee5-f98c6adb7748", "comment": "Malware payload (Mirai)", "value": "0edd9cd8f2b12802782c672aa98d322a702c5910c9ad101901d3dc22d0d26e9483ff08d343df4513b65cc1ec05827e06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641515, "uuid": "9e5240ce-d4a1-4458-909b-31d49b89ae4f", "value": "T11D431891BC819A23C5D4137AF56E56CD372033E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641515, "uuid": "856c33f3-87cf-47cb-a47f-19d1542ae44b", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641515, "uuid": "edb91a88-7f55-43bc-8a8f-c670ce15c566", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641515, "uuid": "735d2155-a594-4671-95a1-33777fb17c08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641515, "uuid": "c03eaaa7-55ba-42f6-a0f4-5f056f51e662", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc526b38-60d6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780661109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780661109, "uuid": "ace8fa9b-5f7c-41dd-b56e-aa96a63ba862", "comment": "Malware payload (NanoCore)", "value": "35c839d0b28982dba50f8931857dfee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780661109, "uuid": "440cc927-ebc7-44b9-bdcf-63284aa58b06", "comment": "Malware payload (NanoCore)", "value": "6e3b544864d8a79ae528b6acd91bbbfc1c90bf7af52174a4c05c464ca32da82e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780661109, "uuid": "c82f5470-c6c0-4814-9c59-fdcc65015dd6", "comment": "Malware payload (NanoCore)", "value": "f7d876017d9676fe8ac35484fd56e627b34a73c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780661109, "uuid": "b668bb46-660f-44db-b6ee-438407da2d28", "comment": "Malware payload (NanoCore)", "value": "a50d5cbbc67bdefb767229b5d5d5a413f676b16fccd5bfb32cecd0653a9fb75b9b15186eb99e46527faef3a4064b1f3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780661109, "uuid": "b9e8eb89-e41a-4762-b76d-fc9392cb39a2", "value": "T17B14CE5677A88A2FE2DF8979712242129379C2E3A8D3F7DE18D854B35F123E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780661109, "uuid": "2651b097-c0fc-4c9c-8033-898e30a0a198", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780661109, "uuid": "3df55651-a511-44a9-98d4-68fdd344ed1a", "value": "6144:MLV6Bta6dtJmakIM5LDr7rb2Wdkytz9sz:MLV6BtpmkumWltC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780661109, "uuid": "231f679a-e2ae-4c7d-b06a-c0d5fab2c717", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780661109, "uuid": "55be9d58-9b98-4dd7-9f61-2bf735916354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780661109, "uuid": "1ff13013-9519-4f79-b7a8-d232f7c05e74", "value": "www.verkeersschoolsociety.nl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5da0006-60f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780676130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780676130, "uuid": "ec258419-aeac-4ea2-b75e-0ef1f34618c8", "comment": "Malware payload", "value": "e0c169baff4848e77f701c3ceb77ce2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780676130, "uuid": "c172df07-2f77-4370-9af1-9b68d4bca6d1", "comment": "Malware payload", "value": "6e64e31fdc5e3bd10aa4265602510267e5db31a7d1cc1c1014a1d3b22c8582e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780676130, "uuid": "abe34887-06d3-4c36-b2c0-86524cad230d", "comment": "Malware payload", "value": "1e5690b39eeb791cb61a1d68f74b132517eefe55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780676130, "uuid": "d77ad898-8905-49ba-a0a0-f90b75597e5b", "comment": "Malware payload", "value": "c3cd5927c5a660e40ff59923625c5d5be4434cc7fdfe0d6f74b367626447309ca31d29fb5972f290141eedf82633da83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780676130, "uuid": "fbd1142d-d21b-4067-a8c5-967af338135e", "value": "T1F3C34B097B988517DA1F4F7DD991132896B8D6036B03E60BBCC563EC1D423EB9F0B9A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780676130, "uuid": "94e42af1-4491-469c-bf40-5acc11257fb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780676130, "uuid": "31ddb96b-f971-480f-9875-c744d96326ca", "value": "3072:G4Kx2kqD81zNjL3Deoe+afaiUX8SPjqY:G4KHNbApidj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780676130, "uuid": "8efdef53-e4c3-4205-a756-74ee4abd360c", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780676130, "uuid": "eaabecb6-9749-4a10-8221-7bcffa57fb43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780676130, "uuid": "3f275a6b-7be3-4c70-b1df-38edeb87cba6", "value": "OneDriveRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f010cb01-611f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780692522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692522, "uuid": "2b7830cf-142b-44f9-be9d-ea6e975ee956", "comment": "Malware payload (RemusStealer)", "value": "eb40f0d1a09e4766d92eec7bf012748d", "object_relation": "md5", "Tag": [ { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pickad-shop", "colour": "#23E551", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692522, "uuid": "a491c088-4bd9-4722-a238-a567300a163a", "comment": "Malware payload (RemusStealer)", "value": "6ee0b32f1b70db0fa15c28bdc771f359b06b86083ed416293c07a9f8692fb06f", "object_relation": "sha256", "Tag": [ { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pickad-shop", "colour": "#23E551", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692522, "uuid": "733bda44-9378-45e9-ad4c-3d4e3e0afc41", "comment": "Malware payload (RemusStealer)", "value": "c490a131ffbce1ac0e198663f5705d42a950a3fb", "object_relation": "sha1", "Tag": [ { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pickad-shop", "colour": "#23E551", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692522, "uuid": "6dd0aca9-d42f-4961-bd87-d7f479957178", "comment": "Malware payload (RemusStealer)", "value": "6f77a68523d2c5ab451578a50cee7cfb6f6be06d0b91757c6dc91ecb075f480bb6e87287ba2e83305f63e56c49da0a59", "object_relation": "sha3-384", "Tag": [ { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pickad-shop", "colour": "#23E551", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692522, "uuid": "b42da4d7-2eb6-480d-ba4f-b5ed7a6214cc", "value": "T193066C02B89064B9C5EAE13189B5A291B7317C480F3127C73F91BBBA1E377D45E3A758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692522, "uuid": "5ac9edb5-7ca9-4a6b-b8cf-3643f3926cc2", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692522, "uuid": "d2a93a4e-dc2a-4e93-a0f8-2872b769bcf2", "value": "49152:EfO3arb/TRvO90dL3BmAFd4A64nsfJL/EwtmKgLDA1UaD1tab:d3mSVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780692522, "uuid": "85a62387-b8c7-411f-8d0f-0f8986b97199", "value": 4010112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780692522, "uuid": "97858180-0a97-44b4-8b4e-4814610f9c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692522, "uuid": "68dc5d9c-4665-4f7f-86d7-852a6e3692dc", "value": "crz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eff57f2-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1780648443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648443, "uuid": "e76104b7-4dbb-43ea-964c-9743dc022ac9", "comment": "Malware payload (STRRAT)", "value": "cd1fae91ad937447ef8a2f887b033e74", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648443, "uuid": "edd81253-ebdd-45ef-9558-10963947f4dc", "comment": "Malware payload (STRRAT)", "value": "6f180d7e2a11a922965006a39fe7522e8e9d8bb40aa4491e55482a5b045eb6c8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648443, "uuid": "0beaa27b-37bf-41a5-8aaa-9343e6014e93", "comment": "Malware payload (STRRAT)", "value": "42a03f5d9a7c7cf5d44f668a875c610687fc770f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648443, "uuid": "32fb4986-cc69-4100-b15f-c8c2f6a60701", "comment": "Malware payload (STRRAT)", "value": "2cf14fe1c219feae5bcce3de0da6ab582e4495a18aaf5645699f3227840d9f41b18af27be82eea082a16294b2eae89c9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648443, "uuid": "ecd102ff-1dc6-481b-9b2a-580cdb67ed40", "value": "T1B4051F55B36A098B1B0BAF34341A1D6377B80B60EFDC49C49257EE998C5EFC70259E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648443, "uuid": "5b9ce9cb-21a8-4aba-bb5c-0fc6385bb7f7", "value": "3072:OJEYDy29SnR6GXF0nUQLRbBDOEgE3tIEMFGBM4aem/cOxTN2nscgk294a5F7YVzx:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648443, "uuid": "fe03c1b3-9955-47ba-8943-cb220d1d3dc4", "value": 849452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648443, "uuid": "a6d9e891-ddcb-4b64-a79a-f65c71b13b7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648443, "uuid": "d6584bce-56c1-4bea-8194-5494b44dd016", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd12f27-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1780642401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642401, "uuid": "fe939e34-0c78-406b-b4b6-0617dafc3835", "comment": "Malware payload (Smoke Loader)", "value": "1c81d39894f42da6e2852cb33c92ae96", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642401, "uuid": "c74c7c48-25f2-40a5-a763-65e678d7bf56", "comment": "Malware payload (Smoke Loader)", "value": "6f565b65b07cfcf058b59a9b1aecb7a4eb70a08c08001cd436ee30513d5dce8a", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642401, "uuid": "94c4068c-6cf8-4321-aa92-1536f39bcf1e", "comment": "Malware payload (Smoke Loader)", "value": "027a3ab24639f8193423c3bf7da5f625425ed3cd", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642401, "uuid": "38f67c7c-9d60-436c-91b9-82ee2765bb58", "comment": "Malware payload (Smoke Loader)", "value": "8f7eec69fb8e2055d00aa839fe999b9dbc2433ca5a22598f0bb0b9ed136f3a11d40bba97a7a1e648a24ad6810bffd964", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642401, "uuid": "4ad2ebb1-81bf-4fe9-9f3e-fbabb7efd237", "value": "T1BA24086BC25371FCE652C07892663235AB72B53C47349EFB02A2D7309D61AD05F7A938", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642401, "uuid": "0f704baa-1479-4105-bb38-352cbc016e1c", "value": "d5a847c34533678aed49adc081077cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642401, "uuid": "4f984779-6ca9-4ba1-92b5-c6b9917e008e", "value": "3072:tnixR0siS3NSMEN6mKmGli2do7TH/nUKQb7GGGNQ1Hafy9:IxJ9EN6mXKBKuGGG6Qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642401, "uuid": "ad688da2-e1a3-4a87-b118-a29711ac3346", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642401, "uuid": "a8348297-67c9-49a5-b44c-b4c8fad8080d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642401, "uuid": "d3543524-b98c-4570-825a-893209f545e2", "value": "6f565b65b07cfcf058b59a9b1aecb7a4eb70a08c08001cd436ee30513d5dce8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dd6fac-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1780642682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642682, "uuid": "a71ecfc6-3206-4c94-8988-35e7a44e415d", "comment": "Malware payload (AmateraStealer)", "value": "a9fe5f4ea0fe71e4d5b97450f42bd7ab", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642682, "uuid": "9eb5435e-e064-4e65-921d-276a76fddc61", "comment": "Malware payload (AmateraStealer)", "value": "6fc9374fe5f1c972e20b02e7ae3098fa8d94c0a615d3fd19268ce654b5f58610", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642682, "uuid": "d7a18d2d-ed3e-4410-bed5-659392eafeea", "comment": "Malware payload (AmateraStealer)", "value": "a0ef19ab96ad91145620bfed6551add244a652bb", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642682, "uuid": "ee6438b0-d683-41c8-8dfd-d7b4656d7317", "comment": "Malware payload (AmateraStealer)", "value": "6a9fb3b57404f99e7ecdf3f3f2253d9a4308fa5b5ad9fce39ba65bf04a344b2c9fd8dae4507291c67cad9482a1ccbff1", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642682, "uuid": "b096f173-5ef2-4628-bca9-856c9b7496ae", "value": "T1C1262902A3E95109F9F3B7707F748142AA75BD466B38D58E328C148C0B79A78D5B27B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642682, "uuid": "c211215c-a61a-4bb1-b271-ae24876d113a", "value": "62848721a0fe32270ffbda7abe4e1f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642682, "uuid": "fea41170-8eb3-4565-afa4-e0184075be43", "value": "49152:r1beL/xJTc6M5AhmGpLSAzqx9lBt/KrkZ3XGCziPs75xF7kwl75FZ5ShCxFP+j1A:rNeNJdY6l6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642682, "uuid": "2943ff65-7ce7-422c-a709-61d226ea05a1", "value": 4723260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642682, "uuid": "4f1332ef-1dae-4dd9-ab1c-786ec6b4a163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642682, "uuid": "80d7f9b9-5dcd-4ee2-a722-35fae7166c1d", "value": "6fc9374fe5f1c972e20b02e7ae3098fa8d94c0a615d3fd19268ce654b5f58610(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59118d5d-6113-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780687115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687115, "uuid": "87fe4aa8-8092-4743-9175-f84e0061ba0a", "comment": "Malware payload", "value": "d5746e26b6913d5aae044c8ec4c52ee1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687115, "uuid": "8973337f-80c6-402f-bff4-c7e82647255f", "comment": "Malware payload", "value": "707b997b9b93cb164942aac4c044dcc55c7b013e9c0791fe2decea850044bdd9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687115, "uuid": "3402df8a-d458-48a3-9c86-bf5be9c198e0", "comment": "Malware payload", "value": "cf7caba49156ff31a585c7b81d4f53e5115fceb9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687115, "uuid": "7ebb51b7-d0e7-4305-94c1-fc627d9a8a30", "comment": "Malware payload", "value": "b2aeae7d31f1f56aac0bb60568ed7bcfc235d80f51842e82412bf5ce3d9de8765d22d607ede628dd6b6f0234c5c9fcd2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687115, "uuid": "d653b14e-fe18-47c6-adb2-a75608af4e34", "value": "T1F7A42343529D235C6024BAC0DE30E8EA5A53C11D096676EFAF3A4E4B343B5F478EB188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687115, "uuid": "514e5650-edbd-415b-9be7-e9fb6b3f9bd8", "value": "12288:HpOHzByYEc8QhjZZ0XS2qojC/JBIYizznHDBEM/+97CRlUyqI1:JOHtyY9ZeXnw/gznjBEM/+92z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780687115, "uuid": "2dce8159-6590-4a8d-a574-03a9dbd48b86", "value": 490478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780687115, "uuid": "ab77726e-2d4c-488b-ad79-efa4da39483f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687115, "uuid": "150c2a05-04b7-4e0e-96c2-5b334fb70ecc", "value": "Booking#032675pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f2f9c8-6105-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780681306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681306, "uuid": "8d49444b-ccf7-4f1c-af23-d6763ab76d91", "comment": "Malware payload (Snojan)", "value": "41e7719e212d1f04ec60a93b5c6422cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681306, "uuid": "62932f10-41f9-4cb9-bb9d-5795eeddb31a", "comment": "Malware payload (Snojan)", "value": "70c45dfcbc9ceb8806cd0a382a1496c8d783cb19c2088e0a704173964ccee763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681306, "uuid": "4ebb17dd-5f43-4b31-be18-0247945ef0f3", "comment": "Malware payload (Snojan)", "value": "7207cfa003fb2706054216d51bf6cc43d047c795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681306, "uuid": "f0cb2c36-c36a-4d64-b3e3-561eee9c8a51", "comment": "Malware payload (Snojan)", "value": "619e2ab7157e9d3db77a897fb20311b7a79825bba6bb46f6e69dc22b1a57dc9bd0b652d2966773640b877c2e350160e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681306, "uuid": "38ab8669-90a4-46ca-beaf-744d8b1aeb98", "value": "T1EF15222471C0C4B7D46B413544C9CA72AA36707247BE99DBBBED63B9AF203E163352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681306, "uuid": "c1d0ab69-4f3b-47cf-9efb-7f4c44c860e0", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681306, "uuid": "e2992b80-5110-4a21-9fd3-df75552d2f1a", "value": "24576:/Y+4k70Trc18BSnLW2CRBKViu99LK1Rad6yZcTA:GkQTAKYS/v6h3+1uhZcTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681306, "uuid": "1ffd9eaa-9436-4309-b822-958adc2572fc", "value": 921704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681306, "uuid": "10a4cc61-e35b-4c0d-af5a-960a7afd04c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681306, "uuid": "0b7f40c0-7c85-4c2e-8f1c-9e7097575438", "value": "rifaien2-NMZMbjgvJ2JEIc3U.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b951218d-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649480, "uuid": "8da08160-faca-4779-8f41-d0bd74f46590", "comment": "Malware payload", "value": "7c1741beb01324078aa6c4f954ee3f14", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649480, "uuid": "7ab24075-7388-4b54-ae66-40114b8c2304", "comment": "Malware payload", "value": "736a845aa0f2e6e0294bfe5b244737d8997836371c72f6e75429704bf654a4db", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649480, "uuid": "fed98f9e-258b-455f-8275-73f6dbf1ae3c", "comment": "Malware payload", "value": "4562eaac29b4619c8d43c3abde7b97d16db53496", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649480, "uuid": "696ec6cd-9a80-4f40-80c3-7dff043573c8", "comment": "Malware payload", "value": "b68885df51a14477a1aca5e4dc94e8f1bbf7e68147b8d0619bdac4396caee7b9515fc2ffeaf3592994b743c19b5aef5b", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649480, "uuid": "05710d37-eb5e-4d47-a36b-f027e13ba8de", "value": "T16E42BFF4341ADFB98A7985B8F088C5152A4A71B68E706D0E4996622ECFD15703BC7B28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649480, "uuid": "d88659b0-2cb8-4bfb-831c-5ec105b0d9c1", "value": "192:oosW5BZehLr6dDaB/GQ2tl2mxgDG7449fHPDO+zj4b3iGYNzHjFA1oYtHvTtE7:obW5BAhLr+KuQ2ymiDS4yLj4ebK+YpZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649480, "uuid": "fc9caaa5-48fc-4daa-86ff-3fbad6b24051", "value": 12811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649480, "uuid": "c7173b03-c458-4d5c-8340-6510e4519695", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649480, "uuid": "2e09146e-9377-4b39-997a-cad984a15262", "value": "photo-914777277.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3302da5-6120-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostPulse)", "timestamp": 1780692930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692930, "uuid": "1f25fbc0-a363-432a-9a1e-9f9ad0c0f2c0", "comment": "Malware payload (GhostPulse)", "value": "c9554a55f9189eaf082f98385cc4330f", "object_relation": "md5", "Tag": [ { "name": "65-21-96-128", "colour": "#4061A0", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692930, "uuid": "ab20bf99-dd1c-4d9a-bf37-d5b227abab8c", "comment": "Malware payload (GhostPulse)", "value": "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e", "object_relation": "sha256", "Tag": [ { "name": "65-21-96-128", "colour": "#4061A0", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692930, "uuid": "1cb5bcf7-511a-40f9-ae50-672bbe4ef34a", "comment": "Malware payload (GhostPulse)", "value": "d9b9f80a8688764c8f97c6a57ee0ac307658cecb", "object_relation": "sha1", "Tag": [ { "name": "65-21-96-128", "colour": "#4061A0", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692930, "uuid": "41f8f49b-f8d5-4933-9136-85f45658bb20", "comment": "Malware payload (GhostPulse)", "value": "ab67295292791a2f8abb7b269d35d4f78017f7ddc32d9b166af67cd8b90360ccb7761b53494240696f4f70c5cb0ac492", "object_relation": "sha3-384", "Tag": [ { "name": "65-21-96-128", "colour": "#4061A0", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692930, "uuid": "df4b129c-81b8-4b92-99fc-dbdb67dbe292", "value": "T1F2B6334077942876CD648830AF8F177150BAC32929360E5F8ACE6E156F875E15B8F3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692930, "uuid": "fd132e72-d484-42ec-a10b-2b8bc26df30d", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692930, "uuid": "a1ad22bc-6557-451e-a936-72e16e1c9735", "value": "196608:+pt9n7OHyp8a1eFOlZiN6mLaCQMGvuezqksFsSjLRLOfF38+nxbX:+pt9n7OSpWFOl4La3E5kcjFc8SxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780692930, "uuid": "979ae7cd-0182-4747-a2b7-ab3b40f2b49b", "value": 10841677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780692930, "uuid": "64b9b251-4bab-4494-afa0-c1e42a216734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692930, "uuid": "8a5352b6-d99e-475a-9096-fc880bc625a2", "value": "kythy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3460f35e-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642385, "uuid": "89100fd0-cf4b-4c7e-828e-15ea8c238a99", "comment": "Malware payload (RemusStealer)", "value": "5826212251e6f7d83974e47fe64fd083", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642385, "uuid": "d85b7671-4a40-4fd1-b44a-23c38c1db841", "comment": "Malware payload (RemusStealer)", "value": "73e1980b7e00c71f36d5f974971eb471845248a8b7b44ad3eebf84fdce1e7125", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642385, "uuid": "c255b1e2-757b-4cda-8cdc-77f3d10f2c71", "comment": "Malware payload (RemusStealer)", "value": "ae95cbc2f008efcee780cc1a08dbe3117e8224c4", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642385, "uuid": "64538ece-6e69-4341-97b7-c9fa76ea423c", "comment": "Malware payload (RemusStealer)", "value": "498b55dae52c364ad305a32b176eb02f5543b1cc74d9f1f577026c0b3bc11ffdfcfba53cc5f1b5851ac4800d5188248f", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642385, "uuid": "7afa311c-2de6-46fc-a047-f2ab28385ba8", "value": "T1A834296BC25330FCD553C07892662332AB73BA3847754EE70692D7358E61EC06E7BA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642385, "uuid": "ccb15e67-aafc-4481-b853-e43cd6018668", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642385, "uuid": "43f191b2-f40c-48ea-8950-bdd3be10ff6c", "value": "3072:PMkiQ0Ti78ZGAttez2m7sKNqQNmTVm9he0xoyW3kOGnLwBsYC:BsG78sATmZbNmhQa34nsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642385, "uuid": "705ebcce-7efd-49ad-a550-9e530f8eb6b8", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642385, "uuid": "48cb700d-05ff-44f2-a273-d16c6cf07d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642385, "uuid": "edb7a7c7-542c-46e1-b453-8a1f4cf7be97", "value": "73e1980b7e00c71f36d5f974971eb471845248a8b7b44ad3eebf84fdce1e7125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b38ec95-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780642880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642880, "uuid": "4bab2e0d-ba99-42ef-bf32-8712715a9af3", "comment": "Malware payload", "value": "f48bf08687948ead049686cdee0e92dd", "object_relation": "md5", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642880, "uuid": "38872a71-0085-4bd5-a106-e016c1bb508d", "comment": "Malware payload", "value": "74091f5a8746a1c68d73e1fc1e4e1ff514632ee3f632a8b306f35dabae2d2b64", "object_relation": "sha256", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642880, "uuid": "1e8c5b25-3849-4566-8a6e-e2c26ede226e", "comment": "Malware payload", "value": "606966a9ec33765baedf63331595d1168f2a596f", "object_relation": "sha1", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642880, "uuid": "d18a6a48-2709-4044-96fe-7ab204c54807", "comment": "Malware payload", "value": "e3c73d77c2be6f547c80b71824e0d008a3812d44088e6ac11ef1650e1e72a1c64bbcbd25b896e6b617c4a3bbe28c70eb", "object_relation": "sha3-384", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642880, "uuid": "18a61440-547e-4b99-bc1f-263a5595a9e6", "value": "T15027DFC4F224F548E7550570982936A849662A303794D8BABF8B76C2597C2E6FDF0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642880, "uuid": "99bf9bb6-dcef-447d-9c1d-fd14c6b1794e", "value": "b06b004562ff14c148c6fdb85e9eb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642880, "uuid": "68c66862-423e-4ab5-85d7-0b58407fe11a", "value": "393216:WJFXmhjx1n2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlku:WJF2hjzK2OGfEhP0JqHOG8qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642880, "uuid": "a4b16b38-3759-4980-ade3-df97f8cd17d0", "value": 20865096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642880, "uuid": "7071f143-543b-493d-83a3-158a343949b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642880, "uuid": "edffcaad-e892-4776-a1db-5ffe796856cc", "value": "74091f5a8746a1c68d73e1fc1e4e1ff514632ee3f632a8b306f35dabae2d2b64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c023b30e-611a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780690294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690294, "uuid": "4b380420-25e6-4a22-ab87-e6839cc37126", "comment": "Malware payload (Mirai)", "value": "01bce96d32a7c9a4d061f0d2d9691108", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690294, "uuid": "c930430c-ca38-46cd-ad52-b88b2c3ef905", "comment": "Malware payload (Mirai)", "value": "75246c19b14573b45e3fe55268f270049baa0c5fe6ec60b91f5c8c38d913ba1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690294, "uuid": "2176ba20-57e4-4e07-a685-6f5dc62dd663", "comment": "Malware payload (Mirai)", "value": "4bf4f61a71a5fe7bea5b7162594c3c8755d5d084", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690294, "uuid": "baa5e790-247a-4ca3-be5d-472afeaef953", "comment": "Malware payload (Mirai)", "value": "5dba1fdaad14676a34d521e95ed3f74b68bf84a57366a6e9e010562561441c4dbd406da0e56c477bf28e5e1a088db100", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690294, "uuid": "58f293bd-ce6d-4d72-9ac5-8d90bec002e4", "value": "T1F814B81A6F228F6EF269867047F34E30975837D726E1D684E2ACD5101F202DE645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690294, "uuid": "76778605-7f40-4b31-805b-13be9792ca9c", "value": "3072:FybodFwUF3CfP7/idav+oMLfZLeKeNudvwI+4:Fybqyow70xLO6vXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780690294, "uuid": "8b5f4157-5712-4e65-bf0d-967036239108", "value": 200176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780690294, "uuid": "0b3511bf-865a-4888-82ac-816c16df3406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690294, "uuid": "44f3ca41-b91a-4999-8cfe-8b7dc838e48e", "value": "nova.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1c8b7e-612e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780698772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698772, "uuid": "686b576d-9e90-4e0b-9841-debe4c9af45e", "comment": "Malware payload", "value": "aa4d0981c9c725603df937b33dd832ee", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698772, "uuid": "9410b850-b932-4388-932b-f18c093063bc", "comment": "Malware payload", "value": "75a0c9bfe6df8f6f1830d99fdc9edb7e6d1fef39fa7264758f591c32e17a3ef5", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698772, "uuid": "a50a4c82-e088-4535-82d3-195aba1490c4", "comment": "Malware payload", "value": "0bb4da015b24f043b36b740cefd327fd91379f00", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698772, "uuid": "274cb656-f369-4ba0-a63a-91184fab5597", "comment": "Malware payload", "value": "36994aa6c450eab0a9676402beb2be51d10c0f8b47dc0bc6f39a5c99a1cf574b33716ef6ba4652f1125639a5ae0f7adb", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780698772, "uuid": "ea091a49-41ca-43e8-8483-f91f847e9105", "value": "T12037339083628F12F59EB53F54A790A1F172F8506773598F5FA802653EAF0E04D3EBA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780698772, "uuid": "e86ee8c1-3ad7-4502-b894-467b0ecb2535", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780698772, "uuid": "b55e3c07-3ec7-4c72-a16e-4dc299e58ec0", "value": "393216:LvuzPOH9uE0pvcu1MUdq1B7GRuRxOggdHsnOTqiqJ0piWpQw4adw4:wPHJFp1MUg1wmxUgO2iy0pFmw4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780698772, "uuid": "82521997-8f6e-4217-9754-3b3c4ec134c0", "value": 22851931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780698772, "uuid": "48b343a7-6815-47ff-9027-6590c0349288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780698772, "uuid": "5140ce6e-820d-42c8-b98a-bfabb1efa62c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e502f2-6119-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780689925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689925, "uuid": "987f6553-4950-46d4-b703-4152935639a5", "comment": "Malware payload", "value": "33795b3f11921b018406a643971bf7d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689925, "uuid": "71b6c470-cf4e-443a-b770-7c25d8e6fe4a", "comment": "Malware payload", "value": "75b4ad0d28327c63a52c94ea6f67b5da3f843840f8259055f280bdf3fdc07ef7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689925, "uuid": "3bd92f5d-49f8-4c32-8dd1-d86815f46e3a", "comment": "Malware payload", "value": "7f5d96777f2299aca34caa746fe6ec70e250df52", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689925, "uuid": "5edfef91-38e6-4faf-af77-e16fe36d4fb7", "comment": "Malware payload", "value": "63467b771b8ee0bb4c060870f5631aa1be3d02363bfdd01d7ab10d1018b27e6accf784ed761381d46c0029a40ed60319", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689925, "uuid": "5115ffb6-9a46-42c1-a94a-cca82c2fe60a", "value": "T17601A3DDC025DBA051D5F45D21975045F421C3CB25858BA4BF9C583D9BB4E18705AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689925, "uuid": "de06c6d4-abe8-49d6-b9d4-258002b6d497", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaTICfWYIFoFFzI7n1fFI64qFIbQJuX:kXCKysE2hi0ziQvZohaT9yozCfRlFluX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780689925, "uuid": "ac8ef199-2562-4269-b277-f3d7a91c08be", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780689925, "uuid": "1fb35ce2-8a14-4a22-ac01-e6d45958e9e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689925, "uuid": "bfc48097-aa20-490a-b1be-a5d366b42246", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09189bdb-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780641883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641883, "uuid": "a03efa55-e9e9-4630-a952-75024033dfcd", "comment": "Malware payload", "value": "9a6732edf3d444224231dd2f94740f7b", "object_relation": "md5", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641883, "uuid": "686b1dbc-2973-48f0-89f6-1afcd7865346", "comment": "Malware payload", "value": "75b4c04ae5632b0a9b24c6ce035a5041137a0f5b6592ae5e6a603ac89974dfea", "object_relation": "sha256", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641883, "uuid": "bf3a0d04-8731-4bad-90a2-f94292bba718", "comment": "Malware payload", "value": "607caa3977d789b3dae2e9c9de9b513db7b4e269", "object_relation": "sha1", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641883, "uuid": "94e145d3-09f5-427d-9329-3c09508b50d1", "comment": "Malware payload", "value": "15a1dfcb252e23726206a8fab14d81f3ea53f77cf9b99f946b651ea4012a2a59d0fa1d5cbdb28bee0098bc74e0cf07f4", "object_relation": "sha3-384", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641883, "uuid": "2cf78c9d-4162-4b4a-831d-f17314196988", "value": "T1229638C4F324F548E75505B0582936A849662A303794D97ABE8B76C2593C2EAFDF0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641883, "uuid": "a271061d-c075-4d71-9a5f-6c6139c5f7f3", "value": "a2289c671ebf1aec4f3036675e42bace", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641883, "uuid": "164e12c8-14e6-43a2-8048-08c26d0fa292", "value": "196608:j4ftJryn86bLI7HpLCNYWAqj1XbeEH9O4fP069L06tl1Z:jAyn27HpLCcA9IY069BtDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641883, "uuid": "15c8f06b-86d7-4c74-a0ba-eabc7b9d8def", "value": 8866632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641883, "uuid": "baa638e1-8f81-471c-b434-3726772f70a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641883, "uuid": "8e990e21-6c6c-49f2-8b9c-efd456b29740", "value": "75b4c04ae5632b0a9b24c6ce035a5041137a0f5b6592ae5e6a603ac89974dfea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd020b32-6109-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780683014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683014, "uuid": "f3b29fc8-79fd-4115-9526-64a2fdff9d50", "comment": "Malware payload", "value": "b018977e6b6f2c76c110d95bd26fa4bc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683014, "uuid": "ac2bc313-ca0f-4219-a3c7-95bcbf3d4eff", "comment": "Malware payload", "value": "75b4e72c6378aeabd984f5c059142e61a5d09acdeef83c2baeb23f402e736bfe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683014, "uuid": "03d5b755-824e-4204-a026-87631995caf3", "comment": "Malware payload", "value": "1ff57822b45206223b7d386361f5d4e092f4a6e4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683014, "uuid": "cf70aa28-798e-4a94-9af4-260dac7a7c69", "comment": "Malware payload", "value": "9e94e0abff22446d2585e6adcaf7cb1548bd0961566f85a9e9589b3f157fe47907ab5ff12cd1fb00e515565722c8c1be", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780683014, "uuid": "1eaa06f7-1fad-41be-9bf3-e326a665a624", "value": "T16B137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C09B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780683014, "uuid": "1948b358-de01-43e0-b063-345855dc0cec", "value": "768:7++9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:7+rco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780683014, "uuid": "097fea8b-650b-4957-bfc9-db9fd152d660", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780683014, "uuid": "b19696e1-f337-4f2e-92d2-1614f8fa80d3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780683014, "uuid": "63562c7a-d488-4a60-8d61-1d2ca225edef", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b758d52c-6109-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682978, "uuid": "76b0c20c-3ab9-4644-a532-0db5c853b906", "comment": "Malware payload (Cosmu)", "value": "801bef9dfc800f976dfe8730bc9acfea", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682978, "uuid": "a8c5bd1b-33a9-4c3c-889a-9e0ab00c2c3f", "comment": "Malware payload (Cosmu)", "value": "75f671d4633f8fd55cacc0cbac9af4ead61a4697f8e6b221073e2343f2dd1ffc", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682978, "uuid": "e449ea16-bfe6-41e3-86a3-01e685b4a5d0", "comment": "Malware payload (Cosmu)", "value": "7838cb0832d84740d38229a1d1c9b578cd9b02b1", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682978, "uuid": "64d4349b-f338-43eb-aa38-f47d809b8ea0", "comment": "Malware payload (Cosmu)", "value": "76a78a2712acdba61cdb4ee8a0230d3830b1c054c0f3241d57ee04d2b0d4ce55816f3996d7a9ee5eb9b9266d87bb6d29", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682978, "uuid": "2c36e630-caaf-49a3-92cf-a0ed1a4fc466", "value": "T1A965282E745F83F2C349867D4865CB61C236FF02D965B5037BC93B4BDA721D38A26292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682978, "uuid": "5396c1c7-765a-4ade-b8d0-291a672c6919", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682978, "uuid": "7913826a-a2b2-43e1-af24-6ef61cd0a69a", "value": "1536:LxbG6XWMuAPzu91nLsemkTOCJ0gPnh3tG+hckUemjxkNrovgjcxgkaqTBQw4:Lxv/y9LJ3tGXRvjxu4aqTB54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682978, "uuid": "e95acbe5-f559-45df-bb98-ab7ee4703635", "value": 1543976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682978, "uuid": "74193151-c4f6-43e6-8624-d3681c74321a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682978, "uuid": "de865019-9cd5-48a9-8318-505f4f05d3a5", "value": "AcroCEF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad881904-611d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780691551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691551, "uuid": "8c42bb77-31c3-4fdc-a4d9-5469ea24a476", "comment": "Malware payload", "value": "325c69a21fef3c7307ab2599e2427968", "object_relation": "md5", "Tag": [ { "name": "212-34-155-18", "colour": "#734DD0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mdprzinwo-xyz", "colour": "#A158F0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691551, "uuid": "7a941358-3cbc-4ec2-b20d-1c77aa2cc077", "comment": "Malware payload", "value": "766bcde5ddd3ae6e2758c749539c5c5d83a1f8a642caeb0bc1bc2c76b5004e7a", "object_relation": "sha256", "Tag": [ { "name": "212-34-155-18", "colour": "#734DD0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mdprzinwo-xyz", "colour": "#A158F0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691551, "uuid": "51297dd0-2f27-45bc-9c75-d8e639c7ff99", "comment": "Malware payload", "value": "e866eab46c1213abcd2a79d0a5c2028e17aa9804", "object_relation": "sha1", "Tag": [ { "name": "212-34-155-18", "colour": "#734DD0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mdprzinwo-xyz", "colour": "#A158F0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691551, "uuid": "29161def-c972-4609-9c37-2b911462b795", "comment": "Malware payload", "value": "d6725ae61c3c8091b219ebc76a22b6adca2bef66fbf2ace0a68b5c9bf91332b86aadf2b4ff2afadcfce47a73f8e149a6", "object_relation": "sha3-384", "Tag": [ { "name": "212-34-155-18", "colour": "#734DD0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mdprzinwo-xyz", "colour": "#A158F0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691551, "uuid": "e093faeb-85ee-44b5-bc0b-b8c1278cc83b", "value": "T1A80691D87AC457E0A929E7EC8247B4CD1744B13E5FFB580D02E548BC3D1AA1766E0CAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691551, "uuid": "0c931195-369e-49e3-9505-2adbf2104fda", "value": "49152:2cKBmBNKAsKGrqSSuKhTGLVJhKIiK1Rp7XpW1SKbWKzzHkXKf1CpK8vb:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780691551, "uuid": "8bc7dbb6-ecd5-4691-9aa6-6d4d4cf84f6d", "value": 4013269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780691551, "uuid": "cb5edff8-8f08-4460-a02b-b2e81e1c736c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691551, "uuid": "b358df48-fd00-4ea6-ad32-44bf6631f107", "value": "019e9484-10e0-7114-b2bc-cc3efc8135dd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96509712-60d5-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1780660589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660589, "uuid": "4c6c6ea0-55c9-4fcd-a396-4e40fd174453", "comment": "Malware payload (NetSupport)", "value": "12cdcebe0165e260ab82c3073b0b1d96", "object_relation": "md5", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "dkilkamajsiot-com", "colour": "#30A32E", "exportable": true, "hide_tag": false }, { "name": "lopstmisot-com", "colour": "#DF5056", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660589, "uuid": "8d1385db-4057-4e0b-9cc2-624939d332aa", "comment": "Malware payload (NetSupport)", "value": "7934a3bcd665ab71969c1ff17d197038c0c316fd18466ffd7009278aa07da6cd", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "dkilkamajsiot-com", "colour": "#30A32E", "exportable": true, "hide_tag": false }, { "name": "lopstmisot-com", "colour": "#DF5056", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660589, "uuid": "013efbab-8db4-46c7-9656-341158f65cf0", "comment": "Malware payload (NetSupport)", "value": "110e18dce8f4f3585f1f4505a322478a689e0786", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "dkilkamajsiot-com", "colour": "#30A32E", "exportable": true, "hide_tag": false }, { "name": "lopstmisot-com", "colour": "#DF5056", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660589, "uuid": "b9b4fb6d-4284-48ea-b69e-397ac8a1610b", "comment": "Malware payload (NetSupport)", "value": "e48b1e0d3d006eaa4459c5e106b5fb96597af96679e41ab171d96a0afb473ebfb6bc51cbd4d194e23a7697ca67566123", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "dkilkamajsiot-com", "colour": "#30A32E", "exportable": true, "hide_tag": false }, { "name": "lopstmisot-com", "colour": "#DF5056", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660589, "uuid": "82ba4340-f2a3-4821-9026-c6d0b07e6376", "value": "T11612AF1EDBD88D81F0BFF6B96EC08196C966D9C406D7044446F842C67B85EF76221B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660589, "uuid": "bd10945f-b6a2-4cb8-9435-6aa7615f77aa", "value": "192:jRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+Gkl/n:jRm/wksuQJ/g6dI+Gktn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780660589, "uuid": "defb2902-cd9f-4877-9a49-efa20fc2ac92", "value": 9270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780660589, "uuid": "a95a5cda-9d82-4819-876e-5d7a476fa758", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660589, "uuid": "18397e72-0d34-453d-bb3f-f2b84d355f78", "value": "Nuova cartella.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a056515f-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780648580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648580, "uuid": "f6615800-7209-4d80-950d-8465e7413de3", "comment": "Malware payload (AsyncRAT)", "value": "8506ae03525a7ba5e09e56f4e7ff524c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648580, "uuid": "893a4844-7bba-4b99-ad6d-0eda2bbdbd5d", "comment": "Malware payload (AsyncRAT)", "value": "79597ed6dc9177290ed9f9b4b9126223247c901123dca8d604cf4f0655cb8729", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648580, "uuid": "064ec4ce-3b10-4ecb-a39a-21be4a8cb815", "comment": "Malware payload (AsyncRAT)", "value": "6ced202afd7e7eff6f7314c58a9f5f389b590f66", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648580, "uuid": "54fb283c-135c-4db9-ac35-cbcb7f3a5423", "comment": "Malware payload (AsyncRAT)", "value": "33c641e76f37b44b7b74fc007ce08796d86f96f0e7e3455383673773fb132bdb2047a8c3c54753420fd49729e905b371", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648580, "uuid": "056eee95-b31d-4239-9d29-a1a2fed53ade", "value": "T192C537A36CBD5B5C31DCD294CD62FE6DF959E31AA41B3E8B5C3228005E883899FC4E15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648580, "uuid": "efe34698-1366-4f64-9465-3749889c59da", "value": "192:6forTj8z5jyEzbmKwydTsGbKbKbKb+G1EgbXR/wYnDaCefga3c7lXmOKbKbKbKbD:679qxfu9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648580, "uuid": "313eb679-9f57-49f3-9391-2a3917006b5b", "value": 2690566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648580, "uuid": "4618712c-d2bd-4f31-9b9e-23bf788a3d56", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648580, "uuid": "6b8e2537-8cb4-47b8-8b64-bd401762d85a", "value": "PO_NKH00866SG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccab08e-6105-11f1-a769-42010a9c0008", "comment": "Malware payload (Koceg)", "timestamp": 1780681001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681001, "uuid": "ab090bb8-738d-4cc0-b5e7-d811985d8d3b", "comment": "Malware payload (Koceg)", "value": "cef66673cd6c42035a6e131dc190b283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681001, "uuid": "1d405468-33da-47eb-8a60-3c560f5e5086", "comment": "Malware payload (Koceg)", "value": "799b0849c112797a82a164dc880e8ab2199494699daac33db0bc9cae6dc0a4e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681001, "uuid": "43e8993d-9b02-4513-b2ff-75c0dfb7516b", "comment": "Malware payload (Koceg)", "value": "240e77ef9b4320b94203a86885d6eb86316295da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681001, "uuid": "fe123309-1ae8-499e-8b16-bea7b5f8bb7d", "comment": "Malware payload (Koceg)", "value": "a32756439f1479b5c079ce6669e361685c1b27fb026491649b96bfcb60737797fbdd37081c37771faa3da95f0f4cd212", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681001, "uuid": "d68694cc-ad56-450e-a625-2f615dfbde71", "value": "T14BB4234403A6DFC9E09232B107D31BF03F622A7785A99FD617EC9F9217A658948C14BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681001, "uuid": "609c976e-f070-4690-ab3e-973334a1be6f", "value": "08b656407b8d307979dc72c3fcc683a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681001, "uuid": "f2be23f9-06fd-47ec-99b5-f0214088f75b", "value": "6144:ACZlWG0GN7xOz2x23dNs4U1JOhtpWhkPWPbGv0sbu:ACCs5xOKx2Nhfpn+jGBbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681001, "uuid": "b58ccf81-4e17-4f70-93bf-b0e1e5b34b27", "value": 533298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681001, "uuid": "7f3c1474-75d7-4708-a78f-baee07aec11d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681001, "uuid": "35d57a5b-f51a-4956-a944-f2643d528be8", "value": "autorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564a0aea-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648455, "uuid": "bcc47564-a531-412a-a933-e5aed87969d4", "comment": "Malware payload", "value": "6a915dfeef845659e30a30b24e271b31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648455, "uuid": "b25b4d57-e6ea-4f4a-a05f-5ffc94a1a122", "comment": "Malware payload", "value": "7a4a7f8549db2f6f0dc5c561c2c92a0efbd22adc5eea2db9a4ec6bab5f3cbe77", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648455, "uuid": "b0464430-6561-45c1-b7c2-e42691cbb4ea", "comment": "Malware payload", "value": "5d25d3d6d06ff6907506dc19811e3d95df868e35", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648455, "uuid": "78f7b9d8-0e20-45b5-a4b1-195e8c4f4bd5", "comment": "Malware payload", "value": "fa7beb3ec067b9a47aa9a89758257a399c83a785c278ac8f510567e7fece85e711df9238c0e5a225c1db9c5551ea05b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648455, "uuid": "1da01406-cb0f-484b-9a33-d59dc48ac476", "value": "T1CCD2DF34C4D82FBDEEAA2A1C06FA6620D7D68B1E9498860737477D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648455, "uuid": "12e3f456-96e9-45d2-bb91-6fa3c29e12cb", "value": "768:gumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:gu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648455, "uuid": "8a3b17db-34ec-496c-81bb-b11be2f29880", "value": 28656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648455, "uuid": "a7798bd7-6b04-4a4c-8fb8-ba523d7d4bc3", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648455, "uuid": "cefbf3bf-88ea-4eab-bfd7-7d1b680e65b1", "value": "23.94.110.24_1780648380330265_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a04b59-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1780642223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642223, "uuid": "ca7a46a9-2272-456a-a224-1ea5b6cc0739", "comment": "Malware payload (Smoke Loader)", "value": "157c11069abe1d374dca749d464d48eb", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642223, "uuid": "da1bc707-b03c-49c7-bfd2-7d53da297b25", "comment": "Malware payload (Smoke Loader)", "value": "7a7146972b76ffe7e2c22bcf91a5197e2efd0fe28a574bd5e6b04a5ba69fdcf9", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642223, "uuid": "e3ed2587-b189-46bc-9c41-a7c96478bfe9", "comment": "Malware payload (Smoke Loader)", "value": "11bda9027962b2ad3fdb39c237e824a6aef607a6", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642223, "uuid": "4be5fa67-ef18-4cab-91e2-5ce98648aa62", "comment": "Malware payload (Smoke Loader)", "value": "5b3e95abb027817e78d4ec7ce38f6f5be47c50728eb5d6e08ae878f727276d4aeb22fe8a8f4217430c210f845e40af51", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642223, "uuid": "701a7890-93e2-4a6f-82dc-237a9bc095c9", "value": "T173D51219D7F805F9E1B7D578CE924906EB36B84943A1E6CF03E469A51F372908E3DB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642223, "uuid": "7f8e472c-acff-47cc-8f94-71cdac21d925", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642223, "uuid": "b80785d5-c612-4bc5-a736-f8b7bbb53a3f", "value": "49152:L2hvRhHukNuXSHOqyNijHeK/OkFoSYgMZ4YYowSc2FtE4elY4EUNjQFOAlMxP7vz:MvONLqyNlKfIJZ4YFpW4e5/Nj42TvaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642223, "uuid": "f1adb854-4d24-4ae3-b487-960c753c8cb3", "value": 2787664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642223, "uuid": "8328cad6-9cb8-44f8-8e5d-38cf9d219db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642223, "uuid": "e5d8c713-dac4-4c51-8021-56b013ae45b9", "value": "7a7146972b76ffe7e2c22bcf91a5197e2efd0fe28a574bd5e6b04a5ba69fdcf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b12f57-60e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667835, "uuid": "994bc6a2-cc1a-4442-a2d8-f4108ca95fab", "comment": "Malware payload (Mirai)", "value": "b6ac64f55b9fddcca02be3a3879ea426", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667835, "uuid": "9c3f3abb-52ac-4f17-b9c8-e3d804aff0f0", "comment": "Malware payload (Mirai)", "value": "7aa2519f51bb1ef1bc72cd962990120899066480169e459a8be6267b1acca3e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667835, "uuid": "cde14599-de35-4a33-a15a-3e81aa152bfb", "comment": "Malware payload (Mirai)", "value": "70480d833236b5e9dc19740eaecd1ddf63bfeef8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667835, "uuid": "19c7483c-db01-44b5-9655-f6a9c9f2ee9f", "comment": "Malware payload (Mirai)", "value": "5d4b9deb91848758f28e269ee07e4e5d426217ec8668094cd924e0bdafe646848f7d6699c2b6dffe16bb0a0942a0b8cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667835, "uuid": "305f7913-fe45-4de2-a6f4-7575a1b843ae", "value": "T171C3070ABF710FBBD46FCD3345A90709299D560621B93B357AB4D818B25B28F1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667835, "uuid": "49c3618c-2c6f-47a8-a5c0-3eacc9b5a487", "value": "1536:Yo02lYMBlxAN9bwBmShx5bg8x+wQS9oj4dDb8HgZ5fMoO95aqyhAexxU7J+Fuf9f:YbUnhx5bgbUQfAKKGECO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667835, "uuid": "65613d3c-beb4-4985-adec-8d5d9d48062e", "value": 118884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667835, "uuid": "608da7cb-0ce3-404b-9142-61e4d7e8ae5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667835, "uuid": "fff3fa18-fdc0-4f8c-ab89-0896f5b5c5a2", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37cb78d-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649498, "uuid": "1f93593d-317e-4218-904c-b69791d89360", "comment": "Malware payload", "value": "3038c8f8e74f355e088f7a5f5ad4244c", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649498, "uuid": "689505c3-3a99-4cef-b9d7-fb1e3abe1632", "comment": "Malware payload", "value": "7ad21aadc32ff96b77792e46baafadfb1b408d91cda32829da238bccdb03ee9a", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649498, "uuid": "f74606e5-bf34-4b1a-a40a-253a2c3080ef", "comment": "Malware payload", "value": "e552a553b52c02c36069b69190cae6f955b177c1", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649498, "uuid": "427dca81-fbaa-4fe5-8d00-71e13ade8377", "comment": "Malware payload", "value": "6162bd06e1d43efaabb4e7415cc21151f8292551e7673d8a45a0b8b31e6a76de08449e897a8d28946690ca14c05c09a1", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649498, "uuid": "d04e66cf-af80-4785-bde5-a1745d17772f", "value": "T1D042C0879D93CC51DB39D1B384566F4F12E7B604D4B24C93D8F5848BA64EB308B219B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649498, "uuid": "9f58dded-f3cf-4a00-a98b-ee8d17213025", "value": "384:+frcoLvcTdfi71xZTJVHFto43Q0dXS1nr/SD:+zdAd671x1HHo4g0JIrqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649498, "uuid": "ec403fae-2453-4e81-a978-cbd365188aba", "value": 13182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649498, "uuid": "3b3c7f05-8e25-4b76-88f1-1dd3a50b7fae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649498, "uuid": "8a5906a3-237c-4c5c-bde7-7edc4c9c2c6b", "value": "photo-648456642.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634c9a4b-60df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780664798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664798, "uuid": "08101665-ef1f-4248-834b-70a7b43332e4", "comment": "Malware payload (Mirai)", "value": "adadff26a7dd4dceb05bb487358eb16b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664798, "uuid": "4e6e746a-b45d-4b9e-8736-f4b93eba5a22", "comment": "Malware payload (Mirai)", "value": "7b0130dde4457ecd14c0545dfa386852914501b333fb9c9658df7e7aaed88e64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664798, "uuid": "0c48b4d1-e341-4bf5-ab8d-5bf4ad932c1e", "comment": "Malware payload (Mirai)", "value": "64c5641e7e91c958c1c044f11954315c05f42e54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664798, "uuid": "87ea1e7c-057d-4e55-b63c-6f56e8366480", "comment": "Malware payload (Mirai)", "value": "6e24dc05a18d78508beb790b814038570f60443cd016392bb8e1ca8d06cc2fd4e3312e1f0cd96fb303a59ed9a8fd7c34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664798, "uuid": "a700f481-3e34-4706-a908-e6d1c3b8c389", "value": "T1B0A3194AB9919F12C4D621FEFA9F418D33136BB8D3EA7101CD20AF54378699B0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664798, "uuid": "13744757-b079-471a-9e25-7f8752d543d1", "value": "3072:tKhExWOfLf0bnUEmd+araqoiuHFSfBEcanBQgG:tKhEhfjSUEw+araqoiull8gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780664798, "uuid": "0a927b41-5a1e-49e0-97ac-6b9ff9586834", "value": 100144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780664798, "uuid": "798cea5c-d3f5-4075-aaf5-526c367b9029", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664798, "uuid": "8874070a-3d06-4d0b-b5ac-a42efafdd3e0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81e72e0-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780643117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643117, "uuid": "541d75e9-2d85-4147-9663-6dec7f75ea9b", "comment": "Malware payload", "value": "221861ae88e8737169bb775a2a45f5c9", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643117, "uuid": "d13dbe73-7d36-438b-8cd8-72977530b887", "comment": "Malware payload", "value": "7b81ce8b9b21c80cb288169e3d883b321e6530b7a65ffe95f01fb88febc3f2ed", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643117, "uuid": "35ceeac7-4934-4259-b003-e6b6c02a6505", "comment": "Malware payload", "value": "28133d7145243edca38c11dcb6b04f2e2d2826f8", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643117, "uuid": "09dee0fc-03d6-42e1-baba-c14b3af355b3", "comment": "Malware payload", "value": "4851d5305eed5a0facf8fd4f213830a1806f15dee641023abc9637a1abf4487f8373cd3616cfc5511c491d8b6752303e", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643117, "uuid": "7e143303-b965-45df-964f-222778a6ee4e", "value": "T1F051FE8D34F3608282F26065542BB896FA389A91834CDF14863D96BDBC715ED6367F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643117, "uuid": "f8feb398-cd01-4dee-b64f-589a7dd3faf7", "value": "48:14PGFQec1n+5+6Fw3Fbl50+14WcC1TmWazLlB8bVxlBuLUjgOt3ZfuT2ACB:iIhcRY8oWcC1TmJzLlBmVxH9RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643117, "uuid": "0234ad8c-1280-47ca-bc97-4249a0847af7", "value": 3028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643117, "uuid": "a5f0131e-ec0e-42c6-b56c-8bcd244288b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643117, "uuid": "301358e6-f75f-403e-8607-0386c271f635", "value": "7b81ce8b9b21c80cb288169e3d883b321e6530b7a65ffe95f01fb88febc3f2ed.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744994ee-60e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780669121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669121, "uuid": "a98b9396-c216-424a-9e7c-d6f1f9a10fb7", "comment": "Malware payload (Mirai)", "value": "628fe74d9a0757e4e2688fd9ee321797", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669121, "uuid": "475ba787-c41b-4523-a0c3-a93326c4217f", "comment": "Malware payload (Mirai)", "value": "7c3bb1dcc57e17b4aa241edf3f924b211fc36d7f4c0afae2530eda0890835ce5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669121, "uuid": "dcc3b2ea-6846-417a-b584-850474e5a914", "comment": "Malware payload (Mirai)", "value": "1db5476fe7dd46c4b66c4db502792fbed2a02723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669121, "uuid": "6c62acde-f53e-468f-9832-31c5cbc81519", "comment": "Malware payload (Mirai)", "value": "44b12e13a4a146cb0873d307df63a24e0c29a8e947c2856031b2f4712b3914819f8b2fb7902b706a46fae32f71320e0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669121, "uuid": "62d669a4-c20a-43a9-9afe-78d0b65ee7a9", "value": "T1E4934A0233694807F3E70EB12C3F6BF197EFD5A122A0A185695E9B4F8171E322546FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669121, "uuid": "259994bf-6e38-498f-a8ea-df16f7ddb11e", "value": "1536:y1Ok2OC8U8EtkrLYIHiv250etFcuy+EmZ0d62MMxdlrqPC9DLOtCMHWKA:oOsCto0e9EDrJ9HrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780669121, "uuid": "5538cddb-d07f-4d4d-90c3-598cdd7f575f", "value": 95088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780669121, "uuid": "3035ab69-7a45-4134-b120-7bdaeaf55462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669121, "uuid": "f5615bf2-2a72-45e1-9ece-f178e20c51de", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa65407-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780642216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642216, "uuid": "4dd21744-64e3-4227-9c35-bb100805543d", "comment": "Malware payload (Expiro)", "value": "340f0fe128205d241fb501e3f9005873", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642216, "uuid": "3fcbfde1-9460-40c9-a68f-cc3f173fba24", "comment": "Malware payload (Expiro)", "value": "7c6b1ada87ce069a8f6bda16baf5872c010c8b88d0c6f98cccc7744882edc913", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642216, "uuid": "e51624a2-3c44-4c4b-91d3-abaa7f463adf", "comment": "Malware payload (Expiro)", "value": "2c40b0a01a9674d1a7be6246707c3bc8ed12b338", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642216, "uuid": "72afb8e5-c4bc-4569-a4f2-f5bf825bbefe", "comment": "Malware payload (Expiro)", "value": "d68597a8ef96936caee7c2ddcc998e94d890a2c1622ae83ecc209333e391aba75f32c2969325fedc12a65019623121cb", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642216, "uuid": "97b34210-5753-4249-b315-3b7d388eb0ad", "value": "T175D51219E7E408F9E0B7D174CE964D06EB767C4D03B1E68F13A069A61F276908E3DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642216, "uuid": "424c691c-e9da-4e4a-8d8b-ca5c73986dd8", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642216, "uuid": "aeb5289a-7463-4965-a338-24cf9abfc56c", "value": "49152:L2hvRhHukNJi3O5CdP8TjQkGJFT/OgvfQZkkGFYvN+2F54y5lkEyg6lQu0/Rrw/:MvOCi+AdPuQk0Tj+AFGx54yzkEl6q5/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642216, "uuid": "98fb8c20-4ad4-42dc-995b-4ca3ebcc6a55", "value": 2785956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642216, "uuid": "87534598-36be-4667-b054-e27dbf4c0ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642216, "uuid": "d4570f1f-87ca-4a91-83a5-063d1c3f873f", "value": "7c6b1ada87ce069a8f6bda16baf5872c010c8b88d0c6f98cccc7744882edc913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da106a1-60e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780666050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666050, "uuid": "708560a5-828b-495d-8a0d-aa19bb1a690e", "comment": "Malware payload (Mirai)", "value": "d6866fddd72b53331ab15b65a9be2d89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666050, "uuid": "8e37048e-7cd6-4cfd-b4bc-0effa04964cf", "comment": "Malware payload (Mirai)", "value": "7cb4cc858c84bc56246879655be872f228f3d1afbd980e64e22c3c2616dc2d60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666050, "uuid": "13d0f75a-02d8-4ba5-8652-66300121b15d", "comment": "Malware payload (Mirai)", "value": "7105eeac502121cbe030af2b443d071d6e57101b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666050, "uuid": "08b3ba2b-012f-439b-8693-b943e02024a6", "comment": "Malware payload (Mirai)", "value": "4856315d665b77b312f416b3da184912aa59d0bab17620ceb582e7aa6d4adfaa9ed95a93cad62268600177cc728b6662", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666050, "uuid": "9804592c-9a15-4189-9d4f-12ed412ddb76", "value": "T17093F90B6E318FADFB79823587B78E21979833D227E1C545E16CF9005E6034D646FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666050, "uuid": "63231366-bde0-4a48-8119-9a5325214d08", "value": "1536:x86gmVjM1SZYiLUhnoDQJa6ga6VC6Qjy8vsXxe33/nqM4y7:xgmi1SP9ka8vsXK/nqZy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666050, "uuid": "a1311d6a-9188-4b8d-8f54-e47fa1e65dbd", "value": 93404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666050, "uuid": "4fce6f07-7fed-43bd-9d8b-30a2f393ebbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666050, "uuid": "c0d8a45a-d13b-456b-bd1c-421a135c7ba6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927c82c7-612a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780697089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780697089, "uuid": "3a4adaa6-3e41-487d-86f5-b79ece6fbb94", "comment": "Malware payload", "value": "9de8688f33c20b0b34b4169756b8d26d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780697089, "uuid": "53fb6641-7448-4394-ac0f-7dbddb0de86b", "comment": "Malware payload", "value": "7d9d6366038421ae6cabec5c4ae45aff754c5df53b0f5052e71c981a32d1719e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780697089, "uuid": "9c64aced-2eb4-4857-afdf-674edafb32b0", "comment": "Malware payload", "value": "0d545c3700e21f0e9d44806b4ea82504bdd889c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780697089, "uuid": "ef6873ef-63fd-49b3-aec9-73ca2b12a3f2", "comment": "Malware payload", "value": "a57ba646dfd8e7ef040219f4e91935d0465f2ddd5acce388193d8df44026f9dd73b7b3f6ca68d442034a246ab7bc8689", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780697089, "uuid": "82186865-0a3d-4f12-9dfb-57f6fc02a0a3", "value": "T15E37CF77814338E9E5A98DB4D41025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780697089, "uuid": "60bf257a-bbcc-4e36-8144-ba2512c30964", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQe:cqYUQuVDt0TZEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780697089, "uuid": "4f76b808-7c78-4b55-a18f-fb24c03dd715", "value": 22577152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780697089, "uuid": "557ddca9-c70a-4cbe-9c3e-80223c5ef1c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780697089, "uuid": "e33e18e6-7eb4-4285-ba59-69f9b3e61ed6", "value": "7d9d6366038421ae6cabec5c4ae45aff754c5df53b0f5052e71c981a32d1719e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4afff03-6119-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780689926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689926, "uuid": "aa6c80da-eca2-4cdf-a1b2-ee9998bdeb2d", "comment": "Malware payload", "value": "78a16f957d69f7e53ed7b6806265b46f", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689926, "uuid": "cc63c5a9-429f-4361-838f-de69a8721b29", "comment": "Malware payload", "value": "7dd48c0b0d885936ae1b45e7f08b3304c17a51d422b8e6d0a5253e4433736ce2", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689926, "uuid": "1fea7924-1cd7-4576-9d19-3834755fd1e1", "comment": "Malware payload", "value": "64224eb94a0ddc779bbe12076c062bdefe67c693", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689926, "uuid": "1cf5c46d-fb6f-4a80-ada0-06a52fe4c261", "comment": "Malware payload", "value": "473142c27d73d9e2ab0095f63045f6995b64e8739aaf8e2427e7fc0738d5f681f21eac88f887af203d50fa332ad1966f", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689926, "uuid": "f7f46393-099e-49fd-9c3e-55ad28787268", "value": "T156D02B598786C0DEE39270822154BD407859B84558C7DC0D62E5C98B58E64D2C6595A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689926, "uuid": "7f07451f-8cac-47f8-bfeb-ffa2b17fa3ac", "value": "6:HRYFVmVSRXtccS9fyU3z6ATD5W9sFGIf5oeTckmu54vVG/4xHy:HRYFVmVSRXt69/z6WRzwRVW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780689926, "uuid": "6819cffa-66cc-45c0-8653-7ceca89be87e", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780689926, "uuid": "bb23d80d-bbfb-490d-b718-37c748a5f65e", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689926, "uuid": "13654571-b17a-42a9-af8c-a5a8bd10c040", "value": "List of Required items and services.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9224109e-60cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780657146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657146, "uuid": "010f3adc-498a-4e53-8cf2-0e7023eed4a1", "comment": "Malware payload", "value": "2b005707cc345fff84a6185862f13bd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657146, "uuid": "a173e69a-e799-467d-a210-a8a3462a0039", "comment": "Malware payload", "value": "7def9fa3896e910b68eab85501694ca10a9fd6373c699e76baa0658453dbaa5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657146, "uuid": "bd4d2505-d896-4852-b6d7-e80811bbd06d", "comment": "Malware payload", "value": "ab4592f5d5968fa76874a39e32813b1814e6ed71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657146, "uuid": "9a81d44a-2e95-475c-ac4f-08bb674c7d7d", "comment": "Malware payload", "value": "bc8ef3ad318f4fd78238c456c96f7d98c819a780bea481e2b50394fbc9c904f9a9a3865402ef265821f8bc24a01c91f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657146, "uuid": "68642c3d-548c-4365-b0ed-bc318bb2cfd3", "value": "T1CC054C3524D500DCF0ABE2356E16E9C6E8B3B89357F479FF12904A591F6E2A40AF7321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657146, "uuid": "5ea9eb72-da94-4710-a0b3-f2ed1bbb35d6", "value": "f4780d8df71ab6340b467c634e4ae263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657146, "uuid": "262c9db7-c595-457f-8f56-7796b63b0e67", "value": "12288:Wcsvv20fWAfYbYhyeW3zWAkpqsaZaouimJr02WoVc15a72:xsv+9AfYMhs3z7kpc0ouior01Ec15e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657146, "uuid": "98a891a3-ca56-4f9e-a3d4-283d87d332f5", "value": 837904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657146, "uuid": "6902972b-32a1-461e-9d9a-21a828242414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657146, "uuid": "3d222d29-5a70-4552-af2d-27fe81e99174", "value": "userenv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5daa1e43-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642455, "uuid": "b84fc313-a1dd-4624-81ec-43ed96acaa46", "comment": "Malware payload (RemusStealer)", "value": "33342b6731b2f162cd196b77347433ce", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642455, "uuid": "69875695-af7a-4832-af3b-6f5e60a0cb7b", "comment": "Malware payload (RemusStealer)", "value": "7e7e53a2dc5a386a08eb7b0716ff32280be9b94b728d6a358788c62080288e27", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642455, "uuid": "4e36a0aa-91ce-4958-a2f5-508f1228be4c", "comment": "Malware payload (RemusStealer)", "value": "7bc5df93004b8206c0bbe234e7e680bbcf408d07", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642455, "uuid": "1eeccc59-07c1-46fa-b1a9-8c89aa8cbd8d", "comment": "Malware payload (RemusStealer)", "value": "44caabfa0778daffa962fdf95c26b1f67c33e47a0f333a465b649d3f2f3a1d5348f68477b392dc98aa736435bece0e90", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642455, "uuid": "cb03ab06-254c-4fd8-bdce-b9d547e300a0", "value": "T17E26D0933F9E517BFE8A22B98014B66E989CFF6E46F50020E4D8D84B5C070D7361E95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642455, "uuid": "532e8ce1-b97e-4335-8691-72dd998978e9", "value": "ae25b895c4627a172cd21c19ce29dcaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642455, "uuid": "44dba1b3-4354-43f4-8170-5d7153cb4911", "value": "98304:/gNDqaezr4Tqe7SaeO1ACFwkaZ9YuScU0dJPOhyh:1zu7SDHOnKfEho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642455, "uuid": "a6ff4f1f-9c83-486c-9e4d-f6c8d14507b2", "value": 4829184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642455, "uuid": "2764d295-7da1-4387-b1e7-cb8f984835e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642455, "uuid": "a8157e1f-9a40-45e6-9bb7-8b51d615ade3", "value": "7e7e53a2dc5a386a08eb7b0716ff32280be9b94b728d6a358788c62080288e27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c07c98b-60f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780672893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780672893, "uuid": "1ff63125-2a93-4f20-8069-afd253546027", "comment": "Malware payload", "value": "eae8bcbd1d9dd016762c91bc0794d43b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780672893, "uuid": "a8acf4ed-8f09-4f7e-8fde-7d252eb86cd6", "comment": "Malware payload", "value": "7ee1fe35c3cc781465ce54acf9c4d54d9d409900701357b300847fb61f9372b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780672893, "uuid": "c9dddf52-9dfb-4cbd-8650-aa52ab1f7aff", "comment": "Malware payload", "value": "4b284d86b0a37d6d54bca650c14b19d7816300ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780672893, "uuid": "e0ff5882-cb9b-4c70-826f-eb481d0b7b79", "comment": "Malware payload", "value": "ff7affa481ce9d4503b4a8ddcb3f3bb7e47990185b36014f957573047e7732dbe0a9f9dfe252020ba5be60c4b4ce62f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780672893, "uuid": "ee823c66-736d-4905-b396-89320bedb723", "value": "T1AAE633535970ACA3E573407E81A286C1AA267C1683F06AFB46F476BB5DB3681377D303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780672893, "uuid": "1a535fe2-524c-4cf7-9d4c-f600b8dd4224", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780672893, "uuid": "35776fa3-9ee3-411c-adc3-4d56b3454204", "value": "393216:yCg2x5fx6U560to1WiPKcMXMCHWUjYfGwoF+2AO3:lx6U5I1WKKcMXMb8YfZoU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780672893, "uuid": "8fb12e37-f80d-494e-b7ce-f7ec87ec5dff", "value": 14695933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780672893, "uuid": "61e3436e-5b5a-41d3-8c13-6c8ea201fe51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780672893, "uuid": "dc89716f-5a75-435d-b709-8b29f4c605d6", "value": "2026\u9ad8\u8003\u00b7\u8f6f\u4ef6\u56ed\u5458\u5de5\u901a\u884c\u8bc1\u53ca\u7ed5\u884c\u65b9\u6848.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f6283b-6100-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780678847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678847, "uuid": "ee69b65f-44ac-4430-8e9c-2429a9664d9b", "comment": "Malware payload", "value": "f1da1aa91be714e1aa491db66fb523c9", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678847, "uuid": "b627eb58-ed69-42e8-b416-bec40579d81a", "comment": "Malware payload", "value": "7ef255e94933f871003d27bc4cb063eedbb91d413f515f7daa61bad779f11d26", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678847, "uuid": "26bd9410-fbad-4fc1-b300-b1b551237a2a", "comment": "Malware payload", "value": "a181c8e090d60766d6571f5e34ccbfd189a6e327", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678847, "uuid": "4da601f5-1d98-4f19-a69d-fc3a1485f273", "comment": "Malware payload", "value": "e4887f3fdffc900f49fb567b377e8e8918eac5d49a19d1540c3761670fba436e8fa206afee0e75e3c99a2086b0687cac", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678847, "uuid": "7cb0b509-8f64-4c6c-b3e9-eaf46acad620", "value": "T12ED47B8FE8DF0DB2D83D11F829613999ABC90B24DB941F25736BD1338DED4684B90D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678847, "uuid": "0c8f094d-bb29-419e-a75c-4a2ce0de1934", "value": "12288:x6lDnxd+Om/d94mKCd2y+u9Qe7ncZalvKE3Oc4:xobxiKCYyD9jngEJH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780678847, "uuid": "c035020f-7812-44a6-9a76-cc695ce703f7", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780678847, "uuid": "983bceaf-61f8-41d0-b803-ad0873acd50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678847, "uuid": "bf6d7545-1b3f-423e-b469-13b799d028da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b94c64-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648453, "uuid": "76bcc39c-7e69-47ee-aefd-5bda1441e09d", "comment": "Malware payload", "value": "d5b272ca926dde09b5bf60d3ea0f4321", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648453, "uuid": "b3790003-4f6d-47dc-aa17-ef8d8a43e85a", "comment": "Malware payload", "value": "81275ed4d696f0240d639df3714ca6fcc4979a6d8d0ab7b6ccf1ceab4d55a8d6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648453, "uuid": "8c8733fb-ce50-4b59-890c-aebafa7eeb4f", "comment": "Malware payload", "value": "aaca6bc21fea4aa1fa38b8aa99a7f7986f4edcc8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648453, "uuid": "5dfc4cdf-bb69-4899-8d70-aaa041b646e4", "comment": "Malware payload", "value": "0437279750088e2c07d4f6472ecd4ae880be0272403126879d8dd33515c7b18759c9666e3e15ace88b4ba544a4b6650f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648453, "uuid": "79aeadc2-d5e0-433d-b004-c4afe5ba31a0", "value": "T15BD2DF34C4C82FBDEEAA2A1C06FA6620D7D68B1E9498860737437D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648453, "uuid": "c7046320-bedc-4ed0-8dfd-64829c58261c", "value": "768:JumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Ju+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648453, "uuid": "bbd1725b-fb02-43d5-bcea-3ebbe8e1cd76", "value": 28653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648453, "uuid": "3735a334-d40d-40ae-aa60-535edb16b71a", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648453, "uuid": "70955931-b5b3-4302-9185-e6e4b0e0c929", "value": "23.94.110.24_1780648379613162_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd54202-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780648601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648601, "uuid": "6707f221-25fb-419b-a3e2-89ee187ec856", "comment": "Malware payload (PhantomStealer)", "value": "5ea1bcf4586f761fabc812be14f8bf92", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648601, "uuid": "0f469d54-ba1c-4dc2-9775-12ee20c53b7b", "comment": "Malware payload (PhantomStealer)", "value": "812f832c3036faa5f3f2289422631f5585deb688ae6b3428e33cd90e6feca6f1", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648601, "uuid": "47201ad4-f1f3-431d-ba1d-015c63d34938", "comment": "Malware payload (PhantomStealer)", "value": "a35ae6841c0b3953c9acc7e879296487135a4c24", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648601, "uuid": "0767a181-6296-4af8-89cd-709857d1869c", "comment": "Malware payload (PhantomStealer)", "value": "b763fa2ddf439065061a482bcbddaf15ef6203403c2b38d123aab2f146f2ff5ebfc00922ce185a1ab3e8e1582694c8a7", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648601, "uuid": "9191d080-179d-4420-bafd-f34d2ed1233e", "value": "T154D2943EC980AFF44B6E61E2298F7E134A1503127674365DB9CEC44D2B7A321CAF45E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648601, "uuid": "09589c69-a09c-4ffc-84db-03ed3cc2eaad", "value": "384:KeSFhffz58XSl1gRiGcJKGhoiOmRRV2guDoTxABlcSh5lYAGUwvX3tUTawc7IRL2:KeqhlWogRI+IXTEPh8ABwvX3uTvAFQ7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648601, "uuid": "ca7c034b-daaa-4891-b49a-e5460e810ac8", "value": 28321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648601, "uuid": "56339826-5daf-4c4d-9d35-f4fd34ce8abc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648601, "uuid": "7a893ccf-9ed3-4fa2-977e-e5bb9cc739d2", "value": "SWIFT - FT240416JM1FT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53784aa6-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1780642438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642438, "uuid": "0e28ce5c-615b-4986-9570-21be9d822dfa", "comment": "Malware payload (Smoke Loader)", "value": "045b9ae335dd71e561676906697846f2", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642438, "uuid": "7511e440-3b28-4dc9-aec0-05649fac7c41", "comment": "Malware payload (Smoke Loader)", "value": "81678485f2e5d8b395d310196c0086d7e495c4e0eb9d4e649b03eb6934360d53", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642438, "uuid": "6820b2c7-ac1c-46a0-bd06-dcc88467a7f0", "comment": "Malware payload (Smoke Loader)", "value": "2793bfac63b19b11ffcd18b4519f10a5fb952512", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642438, "uuid": "3b079f37-17ae-4416-87b1-c058c781c79c", "comment": "Malware payload (Smoke Loader)", "value": "9b6a2e1fd30e5c1a23ef1105c4e54afa951fa1bf6ead3e061cb7a4af8ab3ee769e8ee3e0544eee5c771643b77bfe56b1", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642438, "uuid": "283add56-5ddc-4ccf-bc60-453efa813626", "value": "T1A886D0B12A2E78E2F46E31F15148783D38BCFA744F9544A4A948E84B4DA56513E3FC2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642438, "uuid": "717058c4-06c1-4157-bd56-136d590972af", "value": "a3a50dc87b7ed376f697a82dac2da087", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642438, "uuid": "b291d017-c8e2-4a89-934e-b486e0a48ddc", "value": "196608:2KDnfpAuaem5DE/Wxu2uaI1KbexsOOQx:2KjfpTSQ/WqTie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642438, "uuid": "44c7fc91-43dc-4770-96ea-ebc8f5d6dde0", "value": 8015872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642438, "uuid": "22fa2457-5829-454e-89c1-4d70b72ed414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642438, "uuid": "093db433-0416-4974-bee3-0ce1a2967417", "value": "81678485f2e5d8b395d310196c0086d7e495c4e0eb9d4e649b03eb6934360d53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ddc0ea-60e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780666124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666124, "uuid": "7f86c165-f951-4a6d-93bc-9cf3923e6a89", "comment": "Malware payload (Mirai)", "value": "c763fefc99cd236d76c09a69599f2be4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666124, "uuid": "c979d230-8cfc-4f48-bee4-29b467b1f51c", "comment": "Malware payload (Mirai)", "value": "81755282bb9bd9bf3fa1028531dff49a7d5b2c6535e800e24b727411492dd34e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666124, "uuid": "bb06d356-ec78-4ef5-8538-b881f7572277", "comment": "Malware payload (Mirai)", "value": "967217885a25debb1f84cc3c817fbf252d7e736d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666124, "uuid": "7b54b7d0-132e-4b27-9611-ebaf36c030d3", "comment": "Malware payload (Mirai)", "value": "1093b80e503367aa5048b53065f6c87954ae3c7677cd06315e3568daeccef083f0445e9f70eb2ec37e9999a9215401fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666124, "uuid": "0ed96ab3-0203-4dd9-ae6f-dfd97e840811", "value": "T1A9935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666124, "uuid": "e2c17f8d-1fa4-4917-ac6f-710dbc959fcc", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3oyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKYifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666124, "uuid": "6d25c0e3-71e6-4df8-b251-e1b527b35bf5", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666124, "uuid": "f6108892-7ef2-41d3-ac2c-638be655bfb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666124, "uuid": "ef64cbea-41de-4bd2-963c-7cec9d5b6f09", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b726de9-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780642961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642961, "uuid": "a7b854df-ff51-47cd-9f57-20d228e537e1", "comment": "Malware payload", "value": "f56777243276e836f71ec3c919fc2fd5", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642961, "uuid": "ed5ad529-b15f-4570-b9eb-2bd689796204", "comment": "Malware payload", "value": "81a2b88790ab06c5d9e3ea9877b1e1114972374f18c5c7f73c9314c267fc1a30", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642961, "uuid": "642b7a6e-4fd5-4e9e-ae57-536c39dd4587", "comment": "Malware payload", "value": "abe33f8fc822b2153cf716f26300d74475d1e2a3", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642961, "uuid": "e6185dc5-d924-47b3-af69-9ac5ad9f06aa", "comment": "Malware payload", "value": "0053177e6493e3797415811e0ac4c2e122e17153d3c87753564b67df92ea83b5863ce530298d67741bef991852c462fe", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642961, "uuid": "ceb79fea-c39d-4612-91eb-e69612cd732b", "value": "T1FAC733C27B62CCD5E637E270B5EA18A4F9B37E74118340B16320B2F46E7AA715EB4543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642961, "uuid": "3a539ecf-4a0b-42ec-b3c2-d4074895e83f", "value": "705cf0fbfd9c9efdcc623a49e768e8af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642961, "uuid": "5653ce9b-3012-4d21-9394-ae94a281f79b", "value": "1572864:Nv1fLFzIcRLfhJZgbm9TojnkB3ah6MGoOo1lWYS:vD1jLZga90rQ9o3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642961, "uuid": "2e3d168c-4214-4a3f-ab75-6a487083b58c", "value": 55183872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642961, "uuid": "1ef4b6b2-5390-4562-aa1d-512113cdc1b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642961, "uuid": "620d2744-9bfd-49b0-8ab7-5d8258275aed", "value": "AIMr_AI_Free.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3740f698-60df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780664724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664724, "uuid": "20a750dc-fd16-4299-acde-8ddbc9e81471", "comment": "Malware payload (Mirai)", "value": "a80a7cc6eaa8d17f4a3ec7a56a781ca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664724, "uuid": "a166e2cd-1e54-4e4d-b5c1-ba68622a5ab5", "comment": "Malware payload (Mirai)", "value": "8274e5b51db2252ef6bd01b0e56604587c61606c04d9b656f6211bd601d0d288", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664724, "uuid": "1a191727-8a53-4068-be9c-56e2969227b5", "comment": "Malware payload (Mirai)", "value": "2d48b957c0813c7fe1940f69f3bba5fbbf595397", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664724, "uuid": "878192b8-97f5-4b81-966c-2784a6d636fc", "comment": "Malware payload (Mirai)", "value": "e4ffb9e8ac792dbc3e3bff6d7fb8ea80ffa1664e31a001e86dc6af3b10c42ec8026e1e987fae09d948dd9a67b0e138c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664724, "uuid": "5de89b4f-e346-4de3-8dce-2642b6a07c20", "value": "T186533AC5A943D4F1EC120A3414BBF7375B3AE5790429FA93E7A9A235AD53B01BA0734C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664724, "uuid": "867ecc0b-3a2f-4392-a4b7-c7884f968c55", "value": "1536:ASAhWcvdtiv6pigdwt6C/0WSN5+3Aj1WSULtCUC0h0NZ8SamaqwGOSjBT:VAQGdtiCoSwt6C7tCUCQ0KSbxwGTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780664724, "uuid": "89a8b4f2-9d68-4259-ade4-6bf9d23bbc06", "value": 66544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780664724, "uuid": "4a783d71-9c09-4972-bb83-813d9eea4479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664724, "uuid": "ab968249-8905-4691-b3c9-9be2fac16150", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e86d0cb-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681997, "uuid": "67ae8f3c-5361-4ee7-a18b-bb1015ca0421", "comment": "Malware payload (Cosmu)", "value": "4014ff819ec09b4b86a6c5341a05d50c", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681997, "uuid": "54332941-1aa5-4aeb-95a2-d4cdf7752900", "comment": "Malware payload (Cosmu)", "value": "82b1086b3bd34400d56dc69c5cc7203d281c2d27d89543e3c405b46cb6aebeab", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681997, "uuid": "f0cc6929-e2b4-493f-bc72-a6f8e76b091b", "comment": "Malware payload (Cosmu)", "value": "733bb767b38bfc623fb8a9d310dab7594b4ab124", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681997, "uuid": "1bf67e99-7abf-4a75-a58b-c263827bbbb8", "comment": "Malware payload (Cosmu)", "value": "7fbcbc43c74707c451516994c81a543bcee48cd2e72a66ad608af03f2825f724aff742c0d467c458dc8d8b9e4ae90c13", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681997, "uuid": "e6451695-504c-4f89-9122-66c1977341ec", "value": "T14D65CFB27B92C66BD4E7C23DB4458557A7F29B024D13926397A0EF3DCA392814DDCC42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681997, "uuid": "9af7606f-bcba-411d-86f2-57f5ca6853c3", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681997, "uuid": "b41d298b-57f6-4a80-8801-56dd258597e2", "value": "6144:cFlKgzelZNQSBQGH/CSpWqTPueF/mNyBXoAXjiU4bz1:7fBQGH6SfKCBXoAX+U4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681997, "uuid": "bfe29261-1f41-4ec9-99e7-83a88c07580a", "value": 1537211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681997, "uuid": "17619cbe-0f34-4009-8fe8-ad2ed5d0704e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681997, "uuid": "42f0ef51-f531-45cb-9e0b-ecffae8d1da0", "value": "node.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4458cda-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681765, "uuid": "35e91057-880d-4db0-b797-559410f97e80", "comment": "Malware payload (Cosmu)", "value": "696c0400f01f58f450208e315a104bf7", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681765, "uuid": "859d60d5-d5cd-45c3-8046-237e1d887311", "comment": "Malware payload (Cosmu)", "value": "82d5294fccf9540146174775d37c11be7fb2a69b026184689f8802ee37f4dded", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681765, "uuid": "a1b09649-6ff9-4bda-8902-a256d946f1cb", "comment": "Malware payload (Cosmu)", "value": "9f31d0049d5d192938fb39adeb6befe50f6d24b0", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681765, "uuid": "4f83ff9d-7d7f-4377-9552-4fde28af24e5", "comment": "Malware payload (Cosmu)", "value": "cfaa32fd5d695762849f53ada753aef0f2f2253996e7701133e4b5bf27b6435dbd9afdbc61b37426bfe23bc1c9015fec", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681765, "uuid": "f84115c9-5130-47ab-a5c5-af441d15c31e", "value": "T16D54F2457DA3D4B3D0414D3188E68BE18B7F6C137AA6E11BFB9D0B4B1EB13844BA6361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681765, "uuid": "68c83370-7a93-4b53-a1b2-525968e0ff3c", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681765, "uuid": "147e7eb3-d044-48ab-9271-01b49e8ad2a1", "value": "6144:dFlKgzelZNQSBQGH/CSpWqTOoAXjiU4bzN:6fBQGH6SfSoAX+U49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681765, "uuid": "2333b6aa-52f3-4187-9b63-7f13f7231fd7", "value": 290817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681765, "uuid": "ced75cfb-bde6-43a0-9994-cb5f0208dd55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681765, "uuid": "39516a69-de5a-4a08-b0a8-2e9cd676d368", "value": "AcroBroker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81716c5b-611f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780692336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692336, "uuid": "7b627392-c503-42bf-b261-21f58f336d3e", "comment": "Malware payload", "value": "99f35ea6237b72ef6a3a26599817c6ab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692336, "uuid": "8cf8f750-17c7-474d-aeb5-d5564516f9a4", "comment": "Malware payload", "value": "8353dd6f4f98f0dfcaf4fddf6e7f7f5bb3f51570ce50cafe0be38f1429ba1a72", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692336, "uuid": "425ec792-2eaf-44b0-8839-4915b6de1d81", "comment": "Malware payload", "value": "0ac862f28d3c5c6e058446969922287c23b38568", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692336, "uuid": "d8642fd6-2145-4bde-9f43-7726cbb4d83a", "comment": "Malware payload", "value": "30ab8f9d5fce593a0f99cebf272d16cf6bcce0bd8796347fffa4a7529c9acbace2facf5ecd96f1e1adf5311be37790e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692336, "uuid": "545070a1-529a-4f5d-9bbb-8934bef3479a", "value": "T1DB01AFCBC502AB5052D5E99D62E752807822C3CB55424FF87F9C543DAFB97187015F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692336, "uuid": "6464aec6-dd41-4c3d-857f-b975584ba934", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaZRFIiUpjIWTx0x8IAbuIuW2dIpCauD:kXCKysE2hi0ziQvZohavFTkm89idZ4C7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780692336, "uuid": "d2134c42-06b7-4cd6-b933-d0ce3b999ad3", "value": 838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780692336, "uuid": "621295c0-f1d6-4f77-ad38-6867320b1cdf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692336, "uuid": "1861c31c-343b-47c8-8675-9be3ec671dff", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d5ae55-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780648481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648481, "uuid": "63da9afc-e4e6-406f-8c23-0973c608f8be", "comment": "Malware payload (Mirai)", "value": "a32b8d9d231716ca1618685cee331b1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648481, "uuid": "e8837361-2af4-41f6-9d77-4374972c7b4f", "comment": "Malware payload (Mirai)", "value": "842f1beb3b217f2f1ebf37edfaeac592dde3d6ec1620a75fac8752512f4c396f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648481, "uuid": "e1e66ea7-f7ef-43eb-b550-f25d5dc9ea29", "comment": "Malware payload (Mirai)", "value": "d75932de8216257b1cb12a0b8032e06e197ead09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648481, "uuid": "55b79985-d669-4b4b-81da-88fb614012c0", "comment": "Malware payload (Mirai)", "value": "1af2550f140afbeccfa769ee4bf965fff7a855892c6094d8c8d554e27f114d76099c782549878bea633ed3db7ad4a944", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648481, "uuid": "cf378259-2a01-4437-aa01-15d38a3ca3fb", "value": "T133632982F8819A23C5D162BBFA5F02CC372663B8D2DB7217DD215F157B8A82F0D67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648481, "uuid": "85feeea5-7bb6-4608-a732-6e37f12c75bf", "value": "1536:SOVi0yHtgPCQZ+zEXk2yyebAQWdbXETnqMNAr:SOVieb+zTyermbgnq5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648481, "uuid": "2d93ffc2-9596-46ad-97a7-0f8052d7dcc3", "value": 73272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648481, "uuid": "00eda75d-4488-4b72-9474-b0309ac290b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648481, "uuid": "c2277f8b-42ca-413e-9dba-cb09fd34987d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05a35c6-60a5-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780640124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640124, "uuid": "862e70f0-2831-4716-9ef3-b981735c4b2b", "comment": "Malware payload (WannaCry)", "value": "ce59ece786f9dea5b6a7e777a672e38b", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640124, "uuid": "0a9d4d9d-3cfe-4ce5-866c-659499d56252", "comment": "Malware payload (WannaCry)", "value": "843bf88f01a70eeac55c358437c83215c47bf461efec6b9c701745979b4841c4", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640124, "uuid": "76645644-a9bd-4bb0-9bb2-0f9f59e7bd5f", "comment": "Malware payload (WannaCry)", "value": "ec71f607f022a09a635f48f7b1c4078237b82cf8", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640124, "uuid": "7067f550-32f2-4b1c-a22e-85ed5d65c0d2", "comment": "Malware payload (WannaCry)", "value": "ae29cae81250781f595f066818d8568032f37e903d859f6d1e0ab6af43e13f7896dd8e01152265c4ba264dc5eb1cf063", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640124, "uuid": "5c41713f-f5cb-4402-aa5f-afb2a68ec0a2", "value": "T17036F5143BDD9574D3B64A322CB2EB311B31FCA69C424B8F65D87B8F2C31651AD26B09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640124, "uuid": "52c955e9-4f83-4599-994b-c4d4fc681344", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640124, "uuid": "a6894cba-871c-4c9e-bc1a-bb927c1916ce", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgefLvYdfd0P8:jnXnAQqMSPbcBIvYFO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780640124, "uuid": "b27af134-4039-41c5-b5d4-768d9abfce0e", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780640124, "uuid": "a6c66548-40ef-40fb-816a-32b2c4d23247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640124, "uuid": "139b3c08-bd07-484b-961e-b7725aecbbb5", "value": "843bf88f01a70eeac55c358437c83215c47bf461efec6b9c701745979b4841c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c396cdc-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1780623930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623930, "uuid": "b9f2a70d-e569-413a-b7ec-63be7f0f7d1f", "comment": "Malware payload (Arechclient2)", "value": "0cbac84dffe0ad087150afd7eb6a7c67", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623930, "uuid": "61c581df-8a5b-4aab-b501-f21ca8f14c33", "comment": "Malware payload (Arechclient2)", "value": "84618f1d73e26d7111be332a7e15af1c97d4aba379b1e431abe18f6da6c0b032", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623930, "uuid": "765389ed-0b82-4b19-ab9a-644d470cd39c", "comment": "Malware payload (Arechclient2)", "value": "e96166fa62676e1e4b8a104fd8caf3149d751883", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623930, "uuid": "3e8904dc-970d-49b4-9dee-a1629a9f2572", "comment": "Malware payload (Arechclient2)", "value": "8a6f51542ffe739c760eda047380dd9a8c036a654a7a0b7a3d7655fd7579b64b1c606bbe28f7b5324a0b1f46e14e40d7", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623930, "uuid": "eae56766-a47d-4b23-8747-64a31763972a", "value": "T12BD47C5836EC9E16EB6EC771D3FBDA199270838F9281D22F0C8298D45A53781D709F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623930, "uuid": "f67e2f09-c4f9-4413-a7fb-47faa76fefa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623930, "uuid": "51f5875f-50d7-40e6-99ce-d31db4f6488e", "value": "12288:IsqQ30A60bhyp4Y/qNsP1TNetLiWMVWem8LMS:IsQQq/qNcN4Lgxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623930, "uuid": "496b66d6-5acf-4ab2-9806-48acb9165ab1", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623930, "uuid": "715ad0fe-83fc-480e-8e7f-a6c422e78505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623930, "uuid": "fb7a3fb2-f793-40e9-996c-dab9775b89c4", "value": "0cbac84dffe0ad087150afd7eb6a7c67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d51fcf1-60e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780668976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668976, "uuid": "e70e75ec-d869-46de-bec4-7049e25b7f15", "comment": "Malware payload (Mirai)", "value": "fab684221f5812579376c94809b812a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668976, "uuid": "a2aa113e-bbb9-4d68-910d-4d070829bfbe", "comment": "Malware payload (Mirai)", "value": "846f0531b6f8b34be6eaf47d18e6087a979c7ff6aa57ddf24d985a45d83ee9f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668976, "uuid": "14b91e08-16b7-4ccc-a73a-588cb293a62d", "comment": "Malware payload (Mirai)", "value": "cb1e6a773c648a1d83a98b1890f1dd60062802cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668976, "uuid": "36ad2dee-2bd4-4700-8f3a-3cbd83ebafcb", "comment": "Malware payload (Mirai)", "value": "a8769247ac06794f86696444ea58cf67b51ecf231320a708d033e0980e2f7f45495870158cb50413380a827edb9ea71d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780668976, "uuid": "956a0e5a-8937-47d3-9069-b4f3d65f49a4", "value": "T1AC8359C5A683D8F5E8170539207AF336A536EEB60078FDE7F76443B29431E607046A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780668976, "uuid": "ece4869f-ac70-4c1c-89f3-ee9ef29bef66", "value": "1536:cLtoTWGeU5VloDHzhwXV156uSM3oaB2ysdnPtZQlY0CMa:cJb0lojdwXP0u9om2ys1lOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780668976, "uuid": "b5f5b5c4-1a74-4670-bb97-facd2f29cf13", "value": 83440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780668976, "uuid": "d3993769-d867-4466-854b-d1a0c117f180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780668976, "uuid": "06daaad6-a724-489d-b100-63ecf8fa9465", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad1b41c-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780623928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623928, "uuid": "927077c9-f6aa-44f8-882d-ee2c1e50dfe5", "comment": "Malware payload (RemcosRAT)", "value": "84f1a1ecc963cea6838254019acb5c35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623928, "uuid": "ac0358ba-a6d1-4532-9768-fe678b465804", "comment": "Malware payload (RemcosRAT)", "value": "853032eb5dd655359faed776f158a188a642acfca46977640df7d2e7c6bd9211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623928, "uuid": "c7b15f1c-0022-4598-bf2a-e0f454fc5b20", "comment": "Malware payload (RemcosRAT)", "value": "e9d1ea2265455fe1c79d1681e988ac82b307c126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623928, "uuid": "785ad7b7-a484-4be4-9962-f6492c141303", "comment": "Malware payload (RemcosRAT)", "value": "e77a737d7dad6a07c10b1aa17e8da4072eeb86613405621c649f631e8ffcaa0b15b7814ab04749657c3b5bb4b35fdb31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623928, "uuid": "2d0487a5-7057-4c1b-97f0-bc425278103d", "value": "T161B4AF02B6F2C0B2DA7664300936E735DEBC7C31183699AB63D61D5BBD30151DB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623928, "uuid": "5b042532-e958-4d8a-aa43-d2eefe389628", "value": "7d5125df1b721f19e7f94988d3e3ee5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623928, "uuid": "47f52d87-f846-4894-a9de-eb44f63deca9", "value": "12288:VlQAiR49ckiK7JV8AuE4lKC/kPHM9/IsPZSij/:Vl0GcNUJV8i4mHM9/DZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623928, "uuid": "5e8b78c0-86d6-429d-9f20-cb68ef1671ce", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623928, "uuid": "eb3a0488-723d-4855-a80d-7e772710af1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623928, "uuid": "dc9c8ea1-787f-4ceb-bb20-8b045b82e0bd", "value": "853032eb5dd655359faed776f158a188a642acfca4697.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a2f057-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780643077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643077, "uuid": "0ecc8ac2-881a-4dd9-8c73-7809abb1fd86", "comment": "Malware payload (RemcosRAT)", "value": "ae40377791c24481abe9b1da88f2285f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643077, "uuid": "afa2f81f-82fa-4029-af43-b444e0b3e27f", "comment": "Malware payload (RemcosRAT)", "value": "8563be0fd6cd77ed46a2f52b3061cab666b98250178a380cb211a02282b00904", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643077, "uuid": "4696c438-d329-4f76-9b47-fadef52d6eed", "comment": "Malware payload (RemcosRAT)", "value": "d84bc09ad72e82a17c47582bcc9e80be225c525e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643077, "uuid": "b8fd1fa2-21e3-4c6b-9ddc-db7a109f644f", "comment": "Malware payload (RemcosRAT)", "value": "ba04dfb885a4eaf7608531a9dca556e87033b62c3c14b8bfadd4823343ba02db89e127dc39d13576b77ff029abb9a036", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643077, "uuid": "4fd0fd94-47b0-4e4d-9de1-8bf9a115432f", "value": "T16F333AB0DE5407966E472BBDDC827650D2788BA6012300D5FEDC235CA01E6BCBB7DA6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643077, "uuid": "6834897e-3456-421c-b922-ee16d64fa3be", "value": "1536:4Jo3gpZpwzAtKOoGnovsPFlorhLtKWO0D2FLpjPsW:4wgpZpKAIOoGnovsNlorhLCoALpgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643077, "uuid": "5151c46c-1282-41d6-9500-662473cd84c5", "value": 52265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643077, "uuid": "116d432d-a56b-4660-96e5-4a9ad1f9c66c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643077, "uuid": "ebd6564e-b7e6-4f0e-973e-b97aedc206bd", "value": "Glovarm.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c614aab5-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648643, "uuid": "90bac7b4-b420-48c1-a8de-a38ec397e106", "comment": "Malware payload", "value": "e5748754eb71ae54fac9424312deb20e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648643, "uuid": "77003cc6-6a66-4e0a-8a6d-4fb71a9540bf", "comment": "Malware payload", "value": "857ff0bce0f95374c4740e103bda51d51b315e6cfeb6365a4fdb59fe00022095", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648643, "uuid": "a62b4119-d7e5-4c65-b873-07e44c1f3f1c", "comment": "Malware payload", "value": "342c63863b379d4fa662b9406034285596d21958", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648643, "uuid": "2494aa40-a159-408b-88a2-817cfd38f1eb", "comment": "Malware payload", "value": "ec58c26f279793c1c0b501eeb94baf3394d8c3419ae519d1301712e24cc5602557b16bbc6244702fedd6cf5b0be054ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648643, "uuid": "c9c63a88-a9f5-4a7d-8ce5-244e2bdc2955", "value": "T1A405F63DC818412EF132D91AC49A091FF8A215C7623CE94760C7775BAE67882B7DB39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648643, "uuid": "68bb2c0f-c54d-4b59-8ed9-3677e3eda59f", "value": "3072:epl+WkS/Xw0k3kqV2S1fVA9ZiZykqR2oeE+jldnWWBmP3XJvhb9X3wOASx6C9crC:LHkqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648643, "uuid": "8e57e55a-c23f-4540-93bd-d8120dccef00", "value": 817102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648643, "uuid": "928f67b8-3be3-492e-927f-97a90d9678d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648643, "uuid": "a69a7bcd-dc73-40af-9daa-f4bf7f95d28b", "value": "BOQ_AsiaNova Order #0086334001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caec51ad-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1780642209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642209, "uuid": "50a95d75-ebc7-40d1-b3b4-14b65d9d126b", "comment": "Malware payload (Smoke Loader)", "value": "18b27e8a1e822d8750be3f170fad7c59", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642209, "uuid": "2d53cb82-5b28-451c-8eb4-4e33cb28016c", "comment": "Malware payload (Smoke Loader)", "value": "86d7fdb5c8a211adefdf877ecd253cae7eb1249da38c08511dd7e284fbe31761", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642209, "uuid": "bb76d0bf-c27c-453a-a9f9-a244fb7cb5a1", "comment": "Malware payload (Smoke Loader)", "value": "7ea017511c4277ebb70bdc960b4dc24249fd7145", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642209, "uuid": "79cd25ab-6b7d-4589-a4e9-ef3a896deab0", "comment": "Malware payload (Smoke Loader)", "value": "b8283f4f25edcb8a3fca3a7f1f1da15e444c7dff0016d0c6d25a4bbcfe0072cda2875c163e470accee7f7fa25f015e60", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642209, "uuid": "1fa9dc25-b2d9-4f97-9c52-9d568cfcf32c", "value": "T14E34296BC25330FCD553C07892662332AB73BA3847754EE70692D7358E61EC06E7BA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642209, "uuid": "43c4698d-7651-40cf-a4b0-505ee1af0628", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642209, "uuid": "f09ce4b9-2e98-45df-a1b5-4f4655b1c65a", "value": "3072:PMkiQ0Ti78ZGAttez2m7sKNqQNmTVm9he0xoyW3kXxnLwBsYC:BsG78sATmZbNmhQa3SnsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642209, "uuid": "a9e90d7f-e9ba-43b4-9acc-cb77b1af6ddb", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642209, "uuid": "6f816a00-3999-4630-9aa3-92cb0e8ef2ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642209, "uuid": "1e746e2a-809e-4b5c-ac7d-2741407f12f5", "value": "86d7fdb5c8a211adefdf877ecd253cae7eb1249da38c08511dd7e284fbe31761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd768247-60e8-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780668815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668815, "uuid": "4a4676bf-572b-42b4-b612-69f532f08118", "comment": "Malware payload (Prometei)", "value": "c7d9187030fc2e40805aeb410d5d4bc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668815, "uuid": "bc15519b-410c-4f17-aa2a-5db7d41c1ef1", "comment": "Malware payload (Prometei)", "value": "86ddd00cde2e3fc5fac8ea9ed73404c80cff4691405b0a18229179f596ca88fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668815, "uuid": "0c86d739-19fd-4f4f-aa12-37ee9d1dbb2a", "comment": "Malware payload (Prometei)", "value": "eb7fa15f2311fc2297fb7b90a2ede83d2b30485d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668815, "uuid": "b64d3e16-27a9-4926-8622-17728fa569d6", "comment": "Malware payload (Prometei)", "value": "02cbe1dbd3fa423cedd3a442ab698a33a90be764a5a2eff4d5d76a88abe835df26ee811cf9cd1f1a38fe74db6b90d0d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780668815, "uuid": "3fcf250e-7443-410f-af37-fa4a4eaaaea7", "value": "T120A423B4F9219E9F6DD769B91B24C31DE182C172589D4C2313AE94E34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780668815, "uuid": "4313ee7e-84b7-4d49-a269-4d747ea446b1", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd8:Fs6pyCC/Ya2hpi6T6N4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780668815, "uuid": "5e1f2b27-358a-427c-85ef-3ae8c249a051", "value": 449084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780668815, "uuid": "1b83026e-8cad-419a-b70b-97ed3636a571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780668815, "uuid": "0d43f838-2eb3-4daf-a8e2-1da9e16349bc", "value": "86ddd00cde2e3fc5fac8ea9ed73404c80cff4691405b0a18229179f596ca88fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7e3ca3-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648625, "uuid": "8920faea-fb4b-4060-b8cc-961bab46f0c2", "comment": "Malware payload", "value": "7ec177dca6b10005dd30fd14356151ae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648625, "uuid": "f00d35d6-7c1d-40e5-96a4-d448b09f1f8e", "comment": "Malware payload", "value": "8760f740a8d422c4d0267e37b6f2e05c4f190d06968bd96a033ff8f5d2dda61c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648625, "uuid": "0ca2445c-954d-40ed-b34d-6f7b96faf590", "comment": "Malware payload", "value": "56ddd5a2d53e83ea7452468aca6809267ceaffb6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648625, "uuid": "ee7552ca-7b30-4e22-a39f-68d4aed89af4", "comment": "Malware payload", "value": "272df98b40dd5b46c463ac67e662cebf9a50cf7cc875aa0628ba990ae22f6bb170d2a6213080da9265105c54124539e0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648625, "uuid": "4b4495ae-5328-4784-95e8-537e9ca4680e", "value": "T173139816358FCB1871A2468A46AF0B750B6F795F1FBF40C8008DEAC98FE35215C977A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648625, "uuid": "4690cfdc-7250-445d-81a6-0277f75b1732", "value": "768:onUTReTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTVTgMR19llFgbDiP61r:8gRKKKKKKKKKKKKKKKKKKRgMRf/Fg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648625, "uuid": "673cfde9-85ac-4ce8-b68a-449cdd535e6d", "value": 41968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648625, "uuid": "dd3a7cd3-af98-4f56-ace1-5c0ff11eb511", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648625, "uuid": "e8c34723-55df-4118-9a4c-d922cf55252c", "value": "D210088211888210221000-2210011.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed9c8d8-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780641517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641517, "uuid": "13d98d66-704e-4d2a-bda8-607c408daf56", "comment": "Malware payload (Mirai)", "value": "565b85aad44eda3dcde0aae07ca19cf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641517, "uuid": "6b68a1ee-f7c9-4b75-a9e3-e2c2f74ae0ce", "comment": "Malware payload (Mirai)", "value": "876d924bdaeae6929fefa13eea388c6d2095d4028663954c7d69fedfe47910bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641517, "uuid": "a211124f-c656-44f9-998e-cb92e6cb0792", "comment": "Malware payload (Mirai)", "value": "9d6d25fc3ba33677470d6193b8ca132588409e47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641517, "uuid": "94a677b5-318c-484e-bbd3-f5f53038d954", "comment": "Malware payload (Mirai)", "value": "15ade74d2238f9dcf7d805d6350c754ca0e85fbc91f6bb131614a6c5571b764684ddeb96ccf1ce2c9c671f278b45c483", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641517, "uuid": "9e3b99eb-d0b1-4b70-8f99-2c54bebdb559", "value": "T1FE33FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641517, "uuid": "decb4784-a5ee-466e-b6e2-37c203535411", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oG9:r/hqaJMeteqK806MHdkfQX6HuC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641517, "uuid": "115d76b7-3d0c-46cc-8ecd-37e425f9f1e4", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641517, "uuid": "46d3975e-09ed-4963-a86a-cd4412bf3ff2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641517, "uuid": "af6cd61e-1be4-42d0-9e7d-90d9b58c9dec", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a817e469-6112-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780686818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686818, "uuid": "a7d1e435-c2c5-4374-83a8-ceb4124e761c", "comment": "Malware payload", "value": "888ad43816717aefae8dbaafae3f6be9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686818, "uuid": "f4a4bd38-4176-47ba-b2a2-0b07c039eb87", "comment": "Malware payload", "value": "879ba80cae0e5b3a9851897daddd3f7fbe0d32a3e1d5d9804f091e95d851bd42", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686818, "uuid": "ec6f37b6-828a-4627-8fb7-94e61cbec6b6", "comment": "Malware payload", "value": "989fba598e3223763332599168b176faa9951182", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686818, "uuid": "d6744176-8025-4816-9f3c-207e78da0b9c", "comment": "Malware payload", "value": "21b9dc18c18a2e9af63ca6d5d73e315125e228e9a51e029c025011404a2623757a185fac65dcf4e99522c1f5629c64fb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686818, "uuid": "639d9175-3f95-4120-b986-b027c742ccec", "value": "T175825C0FF9424326E0D100709662467BE979A87A73C454D7FB918AED1B686C2EC3325F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686818, "uuid": "9d26e2f7-332a-43cb-8ac2-fcce3227d8d1", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686818, "uuid": "3e9ea8c0-47e1-47bd-892e-de9106f354b2", "value": "192:V6hSCngTBvPV0K3EdRgqUPGle6/C/KUSf8zwAVYNd5bo+EI2DoCGJxTmv8U9cthv:MIPVGUPG0Ud8xVOdBo+A0jav8U9cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780686818, "uuid": "546b0147-5b03-4c90-a289-9367961a606a", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780686818, "uuid": "a160e8a2-cacd-4478-acd6-1b6452029726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686818, "uuid": "f4817601-facc-4204-9bdc-b0c3bcafd207", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482a546c-60b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780647573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780647573, "uuid": "a847ea29-c254-4b50-8dde-c2e768f5db1f", "comment": "Malware payload", "value": "1cbffddcb8e1e839737bbf6e50a80aaf", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780647573, "uuid": "729f0b34-e3dc-44d2-8960-4857c5a9a667", "comment": "Malware payload", "value": "87a962c6599176e1806c0ccd1b157d3f80e3ccc288c288d039872d9683da24d9", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780647573, "uuid": "61d4dbd7-e784-4394-9ead-372cf86b3654", "comment": "Malware payload", "value": "5206d9996cdf188b7c78e6af8812afca0b53b890", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780647573, "uuid": "4080b8c0-5218-4dfc-9f36-c9bd0d4784f9", "comment": "Malware payload", "value": "266214c0a9af85794130dc7937aae2a123cd5755d9736619266d859c7309d2d95d2261d334226a07e3dc25c88ae2fa65", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780647573, "uuid": "41af0f15-2178-4d43-b860-dda62bacb9f9", "value": "T1C1E46B06B164C4EADAA546364D6691D57E32BC132F3AB78F3048F37E7F37690E825680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780647573, "uuid": "911b7a9f-95c2-464b-911b-4d4a2c73bc0c", "value": "12288:MDjDS54hLNNNm0oqH2XpujpHuPQszWkAMU:b49/NGuFuPQsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780647573, "uuid": "b8e1ee01-ad90-4c00-b743-84095a8f8f72", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780647573, "uuid": "aad730e7-c4d1-429f-8e44-60ba586a2278", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780647573, "uuid": "634202c9-b60d-4a62-972f-0d26dca9340e", "value": "\u041f\u0435\u0440\u0435\u043b\u0456\u043a.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a48c303-611d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780691412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691412, "uuid": "51a8395a-acb1-4965-9965-9df8028f10f6", "comment": "Malware payload (Mirai)", "value": "b37eacc9ad20e475e5c6aa6f11ca404b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691412, "uuid": "1a14b764-fe8a-4a57-bae2-3c7e0ba5b5f7", "comment": "Malware payload (Mirai)", "value": "88d7b2288da92ec1b5658cc6ceb0395ee572844c921132b01ae2a038ffe57168", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691412, "uuid": "51eda7e3-db6a-44cb-b123-aaa1eb83858a", "comment": "Malware payload (Mirai)", "value": "87c5784e5d85829dedcd70d274a6cc22e983c1f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691412, "uuid": "85baa7d1-0422-49c5-ba88-4c7532538aa7", "comment": "Malware payload (Mirai)", "value": "f918f932b37519204378293d9257a42b9b3d7e4a6058ee90d285d1e4ffa0d8917dfdc770101341246ef4a7092eae474f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691412, "uuid": "6a2a47e8-4df4-4627-8075-8dfdbc2421a8", "value": "T1E7D31849ED429F11D4E634FAFA9F41493353AFB8D3FA7101D9209F6023C6A9B0B36616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691412, "uuid": "ce3d0806-4073-4261-a380-84f55e72d082", "value": "3072:LCxNvfQhIENQg5KD2AWa/NQz0MY4Nb/gZzCvkRMSw5Lu:LCxNvfIdNQQKafa/+z0MY4NTozFMSw5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780691412, "uuid": "4a2c03c8-3442-4820-ae09-5513d73ad0ff", "value": 138380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780691412, "uuid": "dbb12786-7725-4955-8872-3d5c7c9b70da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691412, "uuid": "bdcaef83-b832-4a19-af44-05a125e2fa26", "value": "nova.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5224f96a-609c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780635993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780635993, "uuid": "b43e59ae-57e4-413e-8adb-a34f6dd008ba", "comment": "Malware payload (Vidar)", "value": "2368bd9c48da3fcff0271169a88bacfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780635993, "uuid": "75adb099-40e7-43f7-bd53-c8fefde2f3d6", "comment": "Malware payload (Vidar)", "value": "88f5b6c7f618471993adba7fbb008cb8e2cfc5ef811a5971bc6293ba7b921db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780635993, "uuid": "9173ee84-a85d-4c09-827f-c54011fb8d94", "comment": "Malware payload (Vidar)", "value": "d86bac168b58e22d71e548d3bfed0b1fbcbd8cc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780635993, "uuid": "0f7487a3-1fc0-4857-9a12-13e8c9b32eb4", "comment": "Malware payload (Vidar)", "value": "9d2638e4e7bb125c8258295d03a9db625a687c8d0a7f9e3ba5340e64c215ba98276e5ccf29e4594f81b033f6977a752b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780635993, "uuid": "273f96c2-9c3b-4b71-b907-388c22e5a3cc", "value": "T146C59C0A7CD108FAC0AAA3328DB762917BB1BC590F3663D72E5076382F72AE45D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780635993, "uuid": "9713ea91-3fd7-48ec-9c5f-854dbec1c469", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780635993, "uuid": "e98afd5f-69b3-43a0-86c1-7cd97fb6d59f", "value": "24576:EXFV9XZfnyVKYF94wWgO8T/Gy1kl80H4fCu2uF8rezKcY2QqZ3FvfnBele5yK2t7:EXX9pfGKYF9zJO8xkFJunzKa3mXTzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780635993, "uuid": "70d10bd4-b17f-4d5f-bcf8-c9cf10445c58", "value": 2556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780635993, "uuid": "9a1aa46f-5609-452b-9099-e4b3e125437d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780635993, "uuid": "bc8795c9-8239-49f0-9380-e408b893211c", "value": "2368bd9c48da3fcff0271169a88bacfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7b8ca2-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780636785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636785, "uuid": "c74eb874-9972-44d8-8ac0-449ddc041993", "comment": "Malware payload (Mirai)", "value": "1c39073edf7bca478cc6cf1ce6cf96c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636785, "uuid": "ef1a52eb-5044-441d-b440-d03130271056", "comment": "Malware payload (Mirai)", "value": "8a4d59c745036a82a74cace444ba9a20dcd909d5637eba03cdcd2971d42707bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636785, "uuid": "27930189-9304-4d7c-8b4d-0cf30d98d6dd", "comment": "Malware payload (Mirai)", "value": "83dcd85cc4b28dafbe2c6e57eef8de2048dc8641", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636785, "uuid": "d240e3a3-2ad2-4b6d-9e77-61e70d74d9f1", "comment": "Malware payload (Mirai)", "value": "0f380a287657b136ddd46ebb46daaa3f5605768a83dd229341e8389f3e1126c37585921da108f6068ef3eb3ce715159e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636785, "uuid": "2ef68f4b-1de7-4408-90b6-2db69b3a7d04", "value": "T15A157C9DE786E4F1F12300F1025EDBF75934A1269013FAF6EF4A2662B4327616F1631A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636785, "uuid": "439bc770-26a1-4d22-a8f7-1c2decdda9e4", "value": "12288:zRNG1absk8hBHhuCWWYmLEfHwBABXmIQ3dLNsqJUXvqPy5/n9nnJqYpLu:lE1a/8hBHhfYmEIBAB2XtLNkXvJ9nJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636785, "uuid": "2f5aa22c-79a6-4d31-9d49-65130f45f494", "value": 927160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636785, "uuid": "53447253-b830-421a-a650-b5891f59fb07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636785, "uuid": "d3735d3d-5cd1-461e-bd00-b8bd553fcb1c", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3b944c-60a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780640706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640706, "uuid": "bb48a354-3b5d-49ee-886c-be6e4677c99d", "comment": "Malware payload (Mirai)", "value": "7615253b2571e83ec172b932e476c0c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640706, "uuid": "8ce0c172-8a72-4a16-b8b0-a3cc6041c6bc", "comment": "Malware payload (Mirai)", "value": "8b1685cab922500825b846e162e12967f4bb33efb5af3f2e4b1beba9fa0b4bb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640706, "uuid": "641f05ce-eaa4-4e75-bd25-8e7432b38d2e", "comment": "Malware payload (Mirai)", "value": "f3adf90198de7d050c10614df4e2ae19033eb461", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640706, "uuid": "615e0d65-c4dc-4cde-a617-b348b4fd3204", "comment": "Malware payload (Mirai)", "value": "c03221bd9c2913e81bf93e845556bf6f2ef487dcb8021b8703d30d68b29c9ab7102755f7ab75256d8b8a6630e6dc96e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640706, "uuid": "c24c7fc3-2aa9-42f7-9dfe-0de8046c3db4", "value": "T15B933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640706, "uuid": "d954f548-25d4-4306-9fce-ee3534100d5f", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2Do:eyxt7W+G+3QBBntmzg6d7WidDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780640706, "uuid": "01f05604-5438-44bf-9cba-e1766377326a", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780640706, "uuid": "7524fe86-44bc-46ff-9810-b1f36cd5ed02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640706, "uuid": "155a2772-31ea-4066-9fc1-1820bfb273c2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0be62e3-6112-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780686805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686805, "uuid": "e3ef4a7e-07e3-498f-91fc-510e5403530f", "comment": "Malware payload", "value": "5400ebb22d4f9b94307f5b2ecefaaa47", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686805, "uuid": "e4022ed7-ec74-454c-bc3b-3b88fda5ab0a", "comment": "Malware payload", "value": "8b6818a8c1ffe8fd04b3f47c604152b9475c8cafbe6957d3f1095f827c27e954", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686805, "uuid": "bed72f7c-7d07-46fc-8e2b-695208f95ad2", "comment": "Malware payload", "value": "b14757ffb66fa95f50e09fdf86d0f36daab3e2c7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780686805, "uuid": "67587e94-1bf3-48f2-a546-3f711acc6fce", "comment": "Malware payload", "value": "72b0b0f1c631a1db1dfc2e1637a8f04728cf43ac873174a9e3f51723b2163f698ddc391cb1b5d99ce7fee5c8edf202cd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686805, "uuid": "737cba2d-a158-421f-a1bc-06eb06049e59", "value": "T1F1825C0FF9424326E0D10074866246BBE979A87A73C454D7FB918AED1B686C1EC3325F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686805, "uuid": "bcbd7061-4d66-44b8-89da-2ffecc6a4dc8", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686805, "uuid": "60cf14f7-c86e-468a-98b6-de88cc83a385", "value": "192:q6hSCngTBvPV0K3EdRgqwPGle6/C/KUSf8zwAVYNd5bo+EI2DoCGJxTmv8U9cthN:7IPVGwPG0Ud8xVOdBo+A0jav8U9cN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780686805, "uuid": "e685171b-7641-443a-a1e3-7c2dac430f7a", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780686805, "uuid": "cc4be36b-5b06-4fe1-a47b-a07b1a2c1165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780686805, "uuid": "102678e9-c617-4b70-9911-654182b9fd6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b63fa0-6127-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780695798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780695798, "uuid": "9f031b11-3820-41b4-86df-01b36e2da50b", "comment": "Malware payload", "value": "863c42cdcd2596cc59fc668c18e80b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780695798, "uuid": "3843f9b3-3f3f-4524-b388-781648c124e5", "comment": "Malware payload", "value": "8ba88a141222949ba584059305164640eb7b4858bb70088200af58251605bbbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780695798, "uuid": "4c937938-0417-44cc-8bd8-922c1427071c", "comment": "Malware payload", "value": "d7c4ac31e8ea56092cf97773ceec880fe94d866b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780695798, "uuid": "dd807bc8-e235-4da5-972e-745359aa1f56", "comment": "Malware payload", "value": "318a00294a06e92e4447dd66597f4d3dccf750efbe45a3534da8324b5052b5276c018efa4310269563c03b16d5a79351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780695798, "uuid": "bc6ae8e1-744e-4eef-a6fe-7bbed630ece5", "value": "T19AF7C546F605CDCAF86292B8449B8F61A332ECB08760939733A577296FFE78C4DB1544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780695798, "uuid": "a804b1c7-cffa-47e4-baca-d0e6db557aab", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780695798, "uuid": "3b73cd5f-5d93-4cd7-9784-f749d56fc4db", "value": "196608:N5VjSGhrqNLbc+FFmb43OgrRVXrqNblvQkq2QB2TpCjPxTjH+uqBYXAb:N5VHhrqNHcTgrRNrqN/QB2pOxTjyuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780695798, "uuid": "0d372f18-4c68-4bad-af1e-f4050ceac0b8", "value": 75285504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780695798, "uuid": "c7701300-58fe-46ef-be14-a6821f033510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780695798, "uuid": "d516400b-c094-4b6d-8aa1-e5384ab5ca55", "value": "zinst86235862001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2952e9f-6117-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780688983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688983, "uuid": "f95f61bb-0a6e-4672-bb16-89372374820b", "comment": "Malware payload (ACRStealer)", "value": "3ced23d7c57871075694370ed4e6eb77", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688983, "uuid": "887465be-2898-4e63-a269-12421aa4435d", "comment": "Malware payload (ACRStealer)", "value": "8bce779c21544d2c9006d1624b7929b467111260bd65c9562830aed303a0343b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688983, "uuid": "39ff35f6-2250-4f15-9f7b-91af03474c2c", "comment": "Malware payload (ACRStealer)", "value": "9c4ee659283f2ca82081a0dc941ad962852aeb0f", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688983, "uuid": "2f9d653e-9dfd-44ec-a42f-a55986aa7023", "comment": "Malware payload (ACRStealer)", "value": "9d7e8bffee6c888faf7cf56c78cbff43d286cd213725ece9e2ddead4aa05b13fec20602b116469b023ae668e5a8009e2", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688983, "uuid": "d1e1bf3a-d744-4cbd-90a0-78ec19d943c9", "value": "T19E77CF02B7F84066F5BB563495B68622EA36BD611B31C3DF0294A26D1E737C0AF34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688983, "uuid": "72577087-61e2-4624-b2af-37b2156441ac", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688983, "uuid": "ccf2f76a-c565-4953-b911-c94567765c18", "value": "393216:w0EJgYWrJmie69Dn4WoyURBt6PALgfJkedJ9GOYy2WYKSAnIPwbXAMRaH/y2e3nz:LIgREieaBURY9JMAnIPwbQMRaHq2e3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780688983, "uuid": "86b21e26-c825-42f4-8965-3a394aed2e9e", "value": 35344384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780688983, "uuid": "30a4de72-d4a3-40c0-9ee6-12c2a177a207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688983, "uuid": "07380d98-915b-42ca-a400-b54207bb7acd", "value": "cx-programmer 9.1 free download full_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae38d21-60c5-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1780653805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653805, "uuid": "f42ecc61-b57e-442f-8161-2ef1aa0b899a", "comment": "Malware payload (NetSupport)", "value": "7df01f91c4a8062843df49046648f4cf", "object_relation": "md5", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tiqwtkmma-com", "colour": "#2EDB57", "exportable": true, "hide_tag": false }, { "name": "zbxcgtqt-com", "colour": "#31D944", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653805, "uuid": "259aaee3-3cb5-41c7-b65f-add60f794d7f", "comment": "Malware payload (NetSupport)", "value": "8d60ebbaea8a7b8be25cd7e41736eb6a4801d3aa0a53a0d7022d12951f5a473a", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tiqwtkmma-com", "colour": "#2EDB57", "exportable": true, "hide_tag": false }, { "name": "zbxcgtqt-com", "colour": "#31D944", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653805, "uuid": "12dd365a-d191-4cd2-8367-753abe6bc633", "comment": "Malware payload (NetSupport)", "value": "4dbe2fecb6fe2d3608d8ea486806a82cbfe3c351", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tiqwtkmma-com", "colour": "#2EDB57", "exportable": true, "hide_tag": false }, { "name": "zbxcgtqt-com", "colour": "#31D944", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653805, "uuid": "0bc6da23-ff01-4d36-a3d1-7432e000d279", "comment": "Malware payload (NetSupport)", "value": "859b299377111e6622cb3a30b788aa2405c0f591d5b38a649bb21ac2fd3b585a9fb5b0d9a289562278a3418d646c4c92", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tiqwtkmma-com", "colour": "#2EDB57", "exportable": true, "hide_tag": false }, { "name": "zbxcgtqt-com", "colour": "#31D944", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780653805, "uuid": "b5474137-2440-4443-98af-2f2560bac43b", "value": "T1EA163365305BCB6AF5470B3E19821274070AED624776782F262B3F384D7B3A1877ADC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780653805, "uuid": "8a3602d7-fffb-4add-8b95-231c33f91adc", "value": "98304:tzK+68enjUoT5bHK06mOl3wTXKD2eZcNcQlcALN/:Ybno45bHK0CwbKD3c/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780653805, "uuid": "2fe9b4ca-8636-44da-905d-2f72b7f2667d", "value": 4022272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780653805, "uuid": "a332f723-cb57-4a70-91f1-1bd0b87de718", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780653805, "uuid": "0d183be6-849a-48d9-beac-40ff1b8f3d19", "value": "setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e161ade4-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780641817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641817, "uuid": "a7dee140-7e0a-4f62-a99f-b1798d3b170d", "comment": "Malware payload", "value": "4c2134e61508bae9c24b2de5149dd9f8", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641817, "uuid": "51fbb2db-9a07-42ba-9930-dbe76b66c7b2", "comment": "Malware payload", "value": "8dc9a9949c8bafd6facecff62de7141591d947532b7c57a7fc48e439d07f11b8", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641817, "uuid": "32d9d5b7-d3d7-4c54-95df-26243d9d7c95", "comment": "Malware payload", "value": "7d6f8656568ab3386475b1ef8196eaa93a2731fa", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641817, "uuid": "4caa7c7b-73ea-4e16-a5b0-7663d7b2576c", "comment": "Malware payload", "value": "cac4d2a43f192c48e2008b6176906a0aa074c2c509cf24badd9fd3568318d52943bd41a6ab1705e9945422e2e2b79371", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641817, "uuid": "83a252ba-a796-4473-ba86-cc8e34bc4e3b", "value": "T1D4D41246E2C1B96BEC938C7C5A5599D32D16FC023185CF2FEA81730D21B7AB4AD37816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641817, "uuid": "c964ec6f-f337-46f0-bb80-227a854ffd8d", "value": "12288:ijHLLLLLLLLLLLLLLLLLLLLEi+m5nEyKqflH0PZXDovUn36A/He42rUAMB5ZBVv1:cHLLLLLLLLLLLLLLLLLLLLy0EAlH0P6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641817, "uuid": "6aa7ac5e-0882-4b52-b603-6e3b83f3f8b7", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641817, "uuid": "d1de79d1-0731-4280-bbee-8c66b6524e1b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641817, "uuid": "07dbd74d-39c9-428e-9955-d7f625dbe000", "value": "Invoice No. 213.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03d4ec5-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649492, "uuid": "4c920bde-b8bc-4561-a88c-179a8e569e42", "comment": "Malware payload", "value": "1863da10ae3696a85bf1a186e2e5d7b3", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649492, "uuid": "d7579955-308f-4991-8ba2-39e391e256fe", "comment": "Malware payload", "value": "8dd3e5b205f94816095e516bcaac791910f60ef1fafa71bb7200c76254bdd504", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649492, "uuid": "42dbf6ac-d077-450b-b8bc-5e859c97933b", "comment": "Malware payload", "value": "debb71f3bc87a535f1ce19f91615f3d80017046e", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649492, "uuid": "d8d114ee-fcda-441f-b356-bc2a3b3e3a3b", "comment": "Malware payload", "value": "43d14b11a4ba8dfd33455bfa21c539cf2788fb801bbba86e1acd22b7a2fb88ffde29a9e778bc0175a0c8e0e700e7e566", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649492, "uuid": "d7c997b9-8c6e-4067-aa5a-47588c3eb0e1", "value": "T17312AFABA7BCC0ADFC0C0D70BA9891154CC10CDFD344CBE662BD79AA39896DC591B186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649492, "uuid": "f2850a73-9588-44eb-bc7d-8f1cc456ed17", "value": "192:OrpJ0ah2amjyc++hyh0yPLxLUBBRxHqcxA1GOjZMzDilaWZVpOQKST7FDkqUrxp:OtJJfmF++hoLZUZxHqcuRjGzDiaWTp5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649492, "uuid": "a2dd8865-dfe2-4ff1-8820-6334f1223987", "value": 9756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649492, "uuid": "6bcbc05a-89c2-49b8-8c9f-9e0b173a4791", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649492, "uuid": "11ed8880-d9bb-4d9e-a729-4174d42a65d3", "value": "photo-357643063.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa73d85a-6109-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682956, "uuid": "e61dcad6-3538-41a0-bdb8-de72019e68ee", "comment": "Malware payload (Cosmu)", "value": "8705a312989a764dd8a740989759a818", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682956, "uuid": "57557d2c-6aab-4c08-8988-9a9d6c4b0c4d", "comment": "Malware payload (Cosmu)", "value": "8dd8f268fc1d225aee28a3b83aeb7f0c60c8f3874de7396d5a7b4eb23450e8aa", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682956, "uuid": "d9518243-e95f-4fcb-9c21-061d82b35eb1", "comment": "Malware payload (Cosmu)", "value": "7aabd61b20ab5f20a592bbab627f1f2aa70fa620", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682956, "uuid": "969ef77e-03d1-40d3-821d-d040ecee37d8", "comment": "Malware payload (Cosmu)", "value": "0cd3e46c0b47045a2d1b816e7f451ee880863679d5e024b4addf9e69e4b1e26855e1b0a38730215aa58d3e1c2069bce3", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682956, "uuid": "f89171d1-b10c-4623-b454-c00834d878a1", "value": "T12524F1553C93C4B3E0414D7289E58BD18B7F6D03B6E2E15BFF990A474EB029C4BA72A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682956, "uuid": "2c460de6-7ebc-4e44-9072-82044f4fc0f5", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682956, "uuid": "8671a6d7-3afb-4eeb-9c45-48d260548584", "value": "3072:XQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBs6:C9lKgzelZNQSBQGH/CSpWqTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682956, "uuid": "1356ee05-feb6-42eb-beee-64a3ca217e79", "value": 221185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682956, "uuid": "70c6561e-6738-4919-bb34-f0bc2967700f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682956, "uuid": "57be5fec-5c5d-45cd-95f3-d7549427c5a6", "value": "7z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef596f1f-60b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780645276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645276, "uuid": "d3c9572a-0dfb-479f-9b64-c21385f380ab", "comment": "Malware payload", "value": "57ab90d4c8118a758f435e9dbdae95d6", "object_relation": "md5", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645276, "uuid": "13da682a-a37b-4b73-8458-2a9fed33feda", "comment": "Malware payload", "value": "8f09515e2995b5d47963a0e32c97cc1bb36c52b0563506587854433b4fa40bfe", "object_relation": "sha256", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645276, "uuid": "f9bf098a-65a1-452d-be36-2a3973026b2c", "comment": "Malware payload", "value": "24a14103635925b434f765cc9e8a99d94269b933", "object_relation": "sha1", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645276, "uuid": "09573b00-37a6-4337-a12b-60b2d5883099", "comment": "Malware payload", "value": "de8d61137ca820126626291c41e117feb9acb6edf96469ce263d088731b2d8efa6c45a27f203315f7c5a2832e3a83702", "object_relation": "sha3-384", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645276, "uuid": "835cc747-33eb-4b12-9850-368defff8029", "value": "T1A6862384F587DD3CF611FF396C9783E1E8E476645A2A5E2B06F021058D66AD0232E3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645276, "uuid": "b7301650-b658-43fe-9173-2a90d4fa18da", "value": "196608:8q2Gs2C1K8ZVb6GClzPEQ3lgQJKOP52IB:8BGs2AKH0QJ3UE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780645276, "uuid": "6729e3cf-07b5-462e-aff9-a55fa7d3b244", "value": 8137981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780645276, "uuid": "eee39da8-1034-48f0-9a0f-505b60301e2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645276, "uuid": "c958f4c4-0f4b-42ff-8700-3f7f334967f9", "value": "8f09515e2995b5d47963a0e32c97cc1bb36c52b0563506587854433b4fa40bfe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03aeea7a-60f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780673657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673657, "uuid": "937b36e3-89e2-41ed-b57c-e8ef43b4c934", "comment": "Malware payload", "value": "a8cbd661bea2826b55278c29e50fd20f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673657, "uuid": "b482e513-b565-4bc5-92a4-d78dcefaa255", "comment": "Malware payload", "value": "902f4068daf140afbe2f6407eff7c5775fc0cb960c44119061a1f94181bf8ba9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673657, "uuid": "63a30770-4c6c-4112-803b-5650e30673c0", "comment": "Malware payload", "value": "2f1d61032fd633e91868b63124159932c6b8ef9b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673657, "uuid": "6f1f126f-a83c-47b6-993d-d52a8e6faccb", "comment": "Malware payload", "value": "7c9bd38b8dfe4af146e379975c9107468e0fb685617225e793908a7df27df39a5b49ac8ba0e6b03070602d5e51dea11e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673657, "uuid": "3ad92897-efe8-43f7-8495-2a39fb2518c7", "value": "T1F0D2DF34C4D82FBDEE9A2A1C06FA6620D7D68B1E9494860637477D9B4F37D80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673657, "uuid": "0d8af208-1f29-4925-aa38-72090fe89a2c", "value": "768:XumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Xu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780673657, "uuid": "bac4c0e6-d0eb-44ed-a46a-f3bb980bb749", "value": 28662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780673657, "uuid": "4d5e0743-2821-467d-8d34-ee930a865a8c", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673657, "uuid": "733d1f80-3ea8-42e1-bcf2-736f7456bec3", "value": "23.94.110.24_1780673626040952_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380723d0-60df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780664725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664725, "uuid": "c341cdc6-d596-4b4f-b0d1-c2c93812b3ca", "comment": "Malware payload (Mirai)", "value": "67c24ea8e263b724c692f1f5e695cac5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664725, "uuid": "097a2ea2-1fd6-435a-b0a8-571cf730a659", "comment": "Malware payload (Mirai)", "value": "9075c15ef9ca9e199e2e1da782fe873d156a987d1a24510ac67ded2c8b47473a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664725, "uuid": "6f1b698e-7157-4da7-b21b-ca2a20ae532d", "comment": "Malware payload (Mirai)", "value": "e5dedd49beb6029a18ee1c0b0582b601b7798232", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664725, "uuid": "6de67708-ec8f-405c-9ddb-41f567c01dfa", "comment": "Malware payload (Mirai)", "value": "c9bc9e34d27225281aecf43d4828af07715f1563eb9018ef1de3facca25d61626c3967cbb274a1b9197b66bd1c73ba41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664725, "uuid": "8522845e-e463-42c1-9fd6-9991530845d6", "value": "T1F083F946B9918E12C5C212FEFA6F419D33136BB8D3DE7202DD20AF5477868DB0E67612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664725, "uuid": "4cb8a5b5-81cd-4bc5-9419-bb9087d50dbc", "value": "1536:zsnsc6gnsAIWeoQbqkfOatSFWA6MvRYWaclw03TMSiSobshh8rK51YznBbqbUr:zWs8eoQekfL0aMvva4bobshh8rK/UnBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780664725, "uuid": "0e671995-0093-447a-a746-d3c0bf68afd0", "value": 86536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780664725, "uuid": "328cdc14-1a8c-4d14-b737-568a255eec0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664725, "uuid": "7c1daa15-adf7-4214-81b6-a3846e5a44bc", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ec712a-60f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780673652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673652, "uuid": "0d2cc60f-0846-4833-a858-bd7811001b83", "comment": "Malware payload", "value": "425fa21ed2728788c42e89ce92a4afe1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673652, "uuid": "c8e3fcb4-3c11-4835-8314-9412743fdea1", "comment": "Malware payload", "value": "90b63765258dfa25476687ad31b13d287279a706491585b3cf0f3aeb37b31ce3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673652, "uuid": "87e13f16-c465-43ce-a4f0-34030b4e6a84", "comment": "Malware payload", "value": "2bef04e7c1b5eeac43ee42ceced6bf4b29b791ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780673652, "uuid": "06f96f9d-3e89-462d-a3b6-a04ecbd389c6", "comment": "Malware payload", "value": "d5845a273ba6e0e94bf4ea777b39ae264609f61bc428432bf40a7709b35c934dfafed1d6f8042d763917550d4d1e6e84", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673652, "uuid": "8690ba33-adb5-4f29-aa6d-4e5101afc8b2", "value": "T136D2D034C4D82FBDEE9A2A1C06FA6620D7D68B1E9494860737477D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673652, "uuid": "f71e34a2-3bca-4ac3-91a9-6d9dbd5f8f26", "value": "768:VumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Vu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780673652, "uuid": "fddf72ae-b857-4297-821b-059d591fde1c", "value": 28656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780673652, "uuid": "dceb175b-a12c-4d74-9b1f-e60e68e801aa", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780673652, "uuid": "d2ba6294-6169-4877-98ff-4e48ad7979f8", "value": "23.94.110.24_1780673623444741_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666a6502-6091-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780631302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780631302, "uuid": "c5c235b3-6944-452c-bc7b-76bbc8bd038a", "comment": "Malware payload (njrat)", "value": "1302390db5d9d136b97d2731871172c2", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780631302, "uuid": "8bf24bca-69c5-4a93-a54d-c32534e1ff91", "comment": "Malware payload (njrat)", "value": "90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780631302, "uuid": "7a6802ac-30e5-43bb-83ca-4eea6f21ba9b", "comment": "Malware payload (njrat)", "value": "361612b57dd838db5ea82cea6d0a07c5e6f0ee05", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780631302, "uuid": "5321a06e-5a55-4a0f-8df6-c8d27ba6124f", "comment": "Malware payload (njrat)", "value": "9306856f14a1deaa5f2ae55f133de1d409d8b9b23753bce029ecea0a7ec25384ab4452feb07e878410b0fef255b03236", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780631302, "uuid": "de991913-89bc-45df-a66c-b48e66cf2e30", "value": "T15423501B62ED7DA1D07D47767B3387C1C3B9DE024A03DA1E09D560A4AA7E3837901BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780631302, "uuid": "62b67a4c-d387-4a81-847c-889d25646ceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780631302, "uuid": "e6ab74cf-5e7e-410c-a2a3-36bd992e0c63", "value": "768:bwARrzPwgoMqsFWAwlYwQgAWmp27bydQzQbCMV4me+jHYZ:83dMqH1gp+yUQbqmeMHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780631302, "uuid": "d28e3c62-10b3-4a81-a799-b0a982f02146", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780631302, "uuid": "563f0e3f-dee6-4a5d-a5a0-e5d1c37ebf98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780631302, "uuid": "89484f8f-c9e9-43c7-9581-782be8b6f38c", "value": "comfortconcept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474e4f7f-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780648430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648430, "uuid": "deb6a3e4-51c9-4df1-86f7-f3ba405c863d", "comment": "Malware payload (PureLogsStealer)", "value": "c3b88a2365aeb7eedaff84cf054a74b3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648430, "uuid": "1ceff16e-3843-4451-90de-c5eb0eba424b", "comment": "Malware payload (PureLogsStealer)", "value": "90fba1598ab0ecbed1cea61d4360d993059cd8543411c475346f3d839ff1ec45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648430, "uuid": "a748e5db-5891-4b88-9830-085bedbf124b", "comment": "Malware payload (PureLogsStealer)", "value": "989d4fc29e4ac86eb9f44ba7610db3439299a5a3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648430, "uuid": "3b9a131e-0583-4c06-a737-422537dbd6aa", "comment": "Malware payload (PureLogsStealer)", "value": "051e071766581d9b48f89bef1f06b72ded2db664106fa7e8c81573b7add1bdc0aadfa9e6bb4a61b3175c5f048b1487ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648430, "uuid": "7d771476-5861-4d86-88c8-992243768fee", "value": "T19705E43DCD14412EE432D919C89A096FF482165B222CEA4790D73B5FAFA3882B7D735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648430, "uuid": "470e61ae-a1e4-4150-83a8-06c89deb3eb1", "value": "3072:rSEI3z2KR+NRZX+u9B0wOlAU9k2JO9U32AkJ++FSVC76Ja8/9RnV0NvzDMXSM5O0:7wz2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648430, "uuid": "3e866313-1b69-4ba0-bbc6-4250ffcef01d", "value": 803960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648430, "uuid": "8f10acb7-b5ab-4451-b7d5-7615ca1be167", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648430, "uuid": "f2966790-5139-423c-a886-95c54e4d5b3e", "value": "swiftcopyusd90290000.00.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d30e97-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780642735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642735, "uuid": "a15d863f-def0-49ba-bdd0-65d34f48c54c", "comment": "Malware payload", "value": "5f0a58db2817077905f20b1e4b5ad2ae", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642735, "uuid": "158a1c0a-4904-4f77-a616-4bd5b14509af", "comment": "Malware payload", "value": "91c3ff9ec7cee3f3460620ee79851263f1099abb63e55b0946eb24245cbb3ff4", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642735, "uuid": "eb75fbac-7b03-427f-9bcb-918672690501", "comment": "Malware payload", "value": "9f345e79de9efef3e781fd63eff34d576ade56c9", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642735, "uuid": "cefa008c-7fcd-4679-8d1b-d2326b1e4544", "comment": "Malware payload", "value": "e72e7091cc9743b81ce93c8a9c1e08ce12ded8dd554815c45e0b3d667f867ad03b5f6bffbbe81c3c661256ae6522b8d2", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642735, "uuid": "3dfa38d6-2a3f-4d88-bfb8-01b7042f40ad", "value": "T1A405A7C55222D16F069E8D476E477BDC2878D1AFD5C9A302E094BA4F64BC22BC5E8FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642735, "uuid": "45f16bd2-f313-4af2-8392-9e3a2a681f23", "value": "6144:TdhBC6fo+p9grwF2j1gAFQCxgiIOi4VSRSN7OM/bSKEuXxfMxUq4tKPeDMOQv8cb:JCyOw86Axge4Yhx0zWC8zoUI/kahr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642735, "uuid": "d64504aa-6932-4582-88ae-7d0c0dd5063b", "value": 860630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642735, "uuid": "4413a255-b4cc-43d3-b05c-0120c8585214", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642735, "uuid": "0cc8d008-4f39-4ec9-aa21-60fc2775c6a3", "value": "91c3ff9ec7cee3f3460620ee79851263f1099abb63e55b0946eb24245cbb3ff4.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378925d4-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681475, "uuid": "cd978c56-dea7-42f2-bb4a-126ee7c77677", "comment": "Malware payload (Cosmu)", "value": "208d7847c9cb6729f53d2a149c23e32d", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681475, "uuid": "1843fab0-0fc2-4760-9a9c-fa81c08e48db", "comment": "Malware payload (Cosmu)", "value": "91dd225149b1afcb2d17ccd71b3a72293d720a229839e6825cb62abcfc3a81ac", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681475, "uuid": "92e5ea9e-b927-4d2c-9a1a-930357469cde", "comment": "Malware payload (Cosmu)", "value": "4bfa22cc32bdb0ea36f2ff0b1e4d2383f5c9f629", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681475, "uuid": "0a6ce2e9-f21a-4b32-a97a-2909717fe5b8", "comment": "Malware payload (Cosmu)", "value": "9cad408624571f3cbf3499ac6707d423d2af3bbdaf6ac81ab6609c78d11183cf8a181b15eed040523f4fc9f95386b2f1", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681475, "uuid": "46661770-a569-4836-b4bd-f24d0adbc0a1", "value": "T1DD74F245FD9384B3D041493189E68BE14B7E7C03F5A6E11BFB990F4B1EB13988B66261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681475, "uuid": "da96d9b9-032a-4625-9b79-8af62f7ed31a", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681475, "uuid": "884fd71a-64cb-46a0-a973-e6f0da0c691b", "value": "6144:iFlKgzelZNQSBQGH/CSpWqTT6oAXjiU4bz:lfBQGH6SfX6oAX+U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681475, "uuid": "b03a9865-c3a5-4c26-b6b9-f2e32431ed21", "value": 340667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681475, "uuid": "69ea2588-b18e-42af-8065-c74599b9af3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681475, "uuid": "4ffce715-ab6f-454f-8096-c54c1620b2d6", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bb9486-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780667424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667424, "uuid": "6ae88160-f321-441d-ab0e-5418fe008d5f", "comment": "Malware payload", "value": "decd485cd8bd593c9721a154dca201e4", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667424, "uuid": "3ab8fc78-9ce0-4c41-bdc7-64d8922cb3b0", "comment": "Malware payload", "value": "924c38155e1c0b700633e32a0e5a22f410a7306476a001c4b0c967f4636f6d40", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667424, "uuid": "94009673-4d1e-42e1-aa65-82842cbaf454", "comment": "Malware payload", "value": "7239c8a6c3ab643f86640a103f8c647de0414ad3", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667424, "uuid": "7bb72a79-75fc-4c50-bcfd-9f92579563d3", "comment": "Malware payload", "value": "d393bd00e16bc3ff5b169b16062bfc348b0087c7a702b686d1d4fee5d2d6dd5016cab6e493f91a82986856fee72a0e68", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667424, "uuid": "588e34d8-7160-44f9-9559-a73cec63f3e1", "value": "T168575C22F2649E35C0DE473A849B47516331411A4F93978722EC9ABCFF893921FB674B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667424, "uuid": "172111f0-5657-4af9-b46c-4b0b3e6d59fd", "value": "4e375618d1c51b35ddcd7027d4c0eb90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667424, "uuid": "14180379-8d14-44e2-8b57-8123f529a9d3", "value": "196608:1yPHUlDB3FdduWnu2IbdCJcX6i919eys9dbasIUPDNGz4NcRDcCIm:18UNN4Wnu2Ib+86I7ey6osIqXN/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667424, "uuid": "44dd995d-1015-4bcd-ac0f-45a543f6c964", "value": 27423232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667424, "uuid": "1866d7bb-f61c-4539-890f-eb434707a78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667424, "uuid": "603af3e8-4a7e-4cee-b045-bb9d8ae3aa77", "value": "payloadbanker.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af94850c-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642592, "uuid": "e9c741d9-95ac-4067-8dc3-1c3bc3d24697", "comment": "Malware payload (RemusStealer)", "value": "76b9d860782e92e99a1645cfb1f60786", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642592, "uuid": "8cc1ba68-882e-4a82-91fd-a55b0dbcd2ca", "comment": "Malware payload (RemusStealer)", "value": "92a20f806e431e5050450f2caa6888e71548e9bb96c6019f557741fc3d42222e", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642592, "uuid": "525690cf-8365-4df3-95f5-9fed4ee58d6a", "comment": "Malware payload (RemusStealer)", "value": "1326ef0fc58b1651561247cf5f5e6c793e2b1911", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642592, "uuid": "abea502c-ae13-42d2-b5cf-7af2a020db42", "comment": "Malware payload (RemusStealer)", "value": "b55464d7971dbe51f0d2e94f4193b3167f6a542021e488d107a768bae1277a41f74b617586b647636bd5ebbb063448c9", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642592, "uuid": "7425cb50-6de1-4827-87e8-91ecc523c7ac", "value": "T1E226F128396DB077F88C72B39140601A29A8FEA58AC7047C68DC759A4D37DD3372F56E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642592, "uuid": "065f6c97-204e-408b-b5fd-501e35f6fe4c", "value": "64906e468e77ee6c0a5b5f7d1038d7af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642592, "uuid": "64dc8420-a2a9-403c-9095-7d89480adadd", "value": "49152:dNZ8ImXjJxqznwfl/yUi/wjlGV2O2OL0jEV/JtMgkj/2PyxNmZASeiK4KVErDUuX:GImXjDsEDi00/JtMRj/jftVErDU4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642592, "uuid": "b46a3de9-fa60-46f1-8b68-d78de9c8f005", "value": 4837376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642592, "uuid": "fc3cda9c-bbf4-41bc-a3a5-ed134987c3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642592, "uuid": "c5d56b8a-0c4c-4c33-8451-160e9659ce35", "value": "92a20f806e431e5050450f2caa6888e71548e9bb96c6019f557741fc3d42222e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e4c3be-611c-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1780690955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690955, "uuid": "15c22cf4-0e10-46e0-8ce9-a224c06695a1", "comment": "Malware payload (BlankGrabber)", "value": "f793b51c2a84b9f791e08ba6c5e63b08", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690955, "uuid": "dfbda2dc-b203-4fc5-b0e7-cfc54c25905c", "comment": "Malware payload (BlankGrabber)", "value": "92c474f765393d37a0cbf81b9c2961ed8eb2ce749fc7ef26c4d6d000dc6945df", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690955, "uuid": "413ebddc-df7b-4e2f-833c-664499d62912", "comment": "Malware payload (BlankGrabber)", "value": "7cfb7359f01ebd3c50fad6980e6f3f6be7ef5f89", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690955, "uuid": "e116d51a-9f17-4ce3-b7cd-4b035af2ae63", "comment": "Malware payload (BlankGrabber)", "value": "ef8991ac255e8ba18524716ec5a789e360b686ce92a5097031940f8c58e092cdbeeb0f3597edf585de0119ab3cfd9fc4", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690955, "uuid": "90c5aa5f-71c5-45da-ad24-8d692c9918b7", "value": "T14D6701217A9A98ADD05AC474C3468B725A3130DB0B35BAFF448896793F6DAF41F3C358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690955, "uuid": "18755ea8-28f0-428a-9b99-58d11cc8115d", "value": "6d0bcf2f15f1b6c754d506661e259968", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690955, "uuid": "707e7b2d-7a9d-4721-8480-7baa220791b3", "value": "393216:6mU2YkUOshouIkPftRL54huBopYkUOshouIkPftRL54huBoPYkUOshouIkPftRLI:q2YCwouTtRLOYCwouTtRLqYCwouTtRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780690955, "uuid": "625d245a-bf75-4a9a-b05d-377da62deb72", "value": 31259136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780690955, "uuid": "afc0c6ed-84d9-4de4-9848-3411c43ba9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690955, "uuid": "6cd9e827-1c76-490d-8d07-21a18ce8e1d6", "value": "bw8OQF8A9vA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab39f81-611b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780690500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690500, "uuid": "ef575566-9a4a-4dfc-97c7-7f3e45dfeb68", "comment": "Malware payload", "value": "a928898af6c595c1a95d432b6fb5fd59", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690500, "uuid": "2914f092-838a-4935-bb1c-aa4cc0abad79", "comment": "Malware payload", "value": "94bf3096bc61b186dcdabd32b53b09d6276aeff08acb9b0bec9b3f234b4e4559", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690500, "uuid": "143d1a32-4706-4fed-b454-ff21c726d361", "comment": "Malware payload", "value": "4ca8cfb5e06593ef5a267f019cfd242366fd8365", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690500, "uuid": "6c4073c2-223b-4494-9aaf-968f91bb3c6e", "comment": "Malware payload", "value": "cc99ea78a1f57da15b9d3d8386d98584aac34988a587eaf4789a26d57016ab96c92671f444f32977bf37cb4673d24c22", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690500, "uuid": "b1cb5cd1-75d6-4574-8a20-641d33da029f", "value": "T18AD02B584786C0DFD35270822654BD405819F95058DADC0D62E5C94B58E24D186595A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690500, "uuid": "6da52ca3-b7a7-49ae-a911-8dbb7a41e1d9", "value": "6:HRYFVmRz7fyU3zaAXTj5W9sFGIf5oeTckmu54vVG/4xHy:HRYFVmRzjzayHRzwRVW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780690500, "uuid": "30341f7e-ccc1-4015-b0b5-0beb609035ba", "value": 259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780690500, "uuid": "faa756fc-b3b1-40dc-a71c-306e882a8d24", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690500, "uuid": "489ab2ba-a45c-49e4-8a5f-7a79c4ba4396", "value": "List of Required items and Services.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49f150d-611e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780692100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692100, "uuid": "40e10ac2-e3e9-45ec-8e0d-82e82f29fa38", "comment": "Malware payload (Mirai)", "value": "68fa390d83bf2b74dfca9e13904510d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692100, "uuid": "475916c1-17ed-4908-9673-92a4438c9edf", "comment": "Malware payload (Mirai)", "value": "94bfe257099cad922953e7be5329526638027197b43b9cb0c1ccd42022c3f42b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692100, "uuid": "55213d18-358b-4055-937d-d093a698769d", "comment": "Malware payload (Mirai)", "value": "820c771a288fb9d85ff58ba854841f8452e64967", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692100, "uuid": "75202225-1a7d-4e69-9bc1-c4693bf61d3c", "comment": "Malware payload (Mirai)", "value": "d45ededbf9e7ed871b6b89197efe1586868993cfbfe90085bd81eb19598c36c10862539fe10cdca9cb5174d431e26e36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692100, "uuid": "068061f7-883c-48c1-aeef-73b63a2e7a98", "value": "T104C31A82BB43DAB3E85314F111F7AB359A31FD3F083AD986E3647CE199612C1961636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692100, "uuid": "2f00bae0-0b0d-4d22-968e-43435160b106", "value": "3072:XzgczWxtfvm1tM5ob7gy5r/WoOogNvDO:XUczWLfvcMOgoFgNvDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780692100, "uuid": "75558d39-7ba0-449f-8be8-938ba77e5fa1", "value": 125668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780692100, "uuid": "0ac1a0ac-5871-4bb1-903f-ebfd55c28095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692100, "uuid": "b58d0140-f4f6-49f3-b4ea-684e1fcd724c", "value": "nova.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c478c22-6119-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780689804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689804, "uuid": "21987ef2-2766-4f00-a5bb-67e3fd5d1b9a", "comment": "Malware payload", "value": "b434b770c0bcd995dc655a6aaabe9ec4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689804, "uuid": "4f89afbd-6183-4fc8-9d63-74d921a9d1da", "comment": "Malware payload", "value": "951bcc9b8cb5ce723f17428a5e85686d93293067585ded7bd3776116cae9619e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689804, "uuid": "168319f2-d579-4694-b2a7-e0ed9a3ad652", "comment": "Malware payload", "value": "02460d58551befcf7affd39403cbc1988da9cf9f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689804, "uuid": "03c845a6-0823-42e4-a49d-2d8240954c68", "comment": "Malware payload", "value": "b58239f42077c74f8156f0a879f41aa60373d03ed35f31899fc56db10dfc6c6790c593bb260ae84f3bf07e13ddc669e2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689804, "uuid": "a6816431-26bb-46fd-a72d-96b6989ecf65", "value": "T115E6331853E006FDEA6BC13C7DE25245F0A474A45B72D9EF4BEC67A26D231D1883DA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689804, "uuid": "26b6bc2e-759d-4684-9f73-adbc8c2da8f9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689804, "uuid": "45ded205-c9f7-4002-974e-558b9e7c36f8", "value": "393216:+zCFlFfK7hKBhYnE61D4NOHnZpZoXMCHWUjXwcuI3/PGTAI:+zEFCQ7Ynv1D9ZpZoXMb8XlH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780689804, "uuid": "b893d26e-38be-4605-9a6a-2046812bd004", "value": 14339416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780689804, "uuid": "0ca54bff-cd56-488e-9480-739a47ebc593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689804, "uuid": "e3999614-25ef-4043-a15d-e6dc62c3b97c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bfd6da-60df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780664722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664722, "uuid": "2bea0baf-0d16-403c-b947-e85813984386", "comment": "Malware payload (Mirai)", "value": "0b80c50b2a0249dd4a986b59940298e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664722, "uuid": "d356215f-8376-4fa4-8599-903338ff9cc9", "comment": "Malware payload (Mirai)", "value": "95403e6183f09caa25ffbba88965865b2554cd18900c6b2d742ebd33f4e5e56b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664722, "uuid": "8ea92615-1fbf-4597-a2d5-edc97eee8fa9", "comment": "Malware payload (Mirai)", "value": "7d54111d6c7cc7339894d95b5d8e3b750655a256", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664722, "uuid": "69408503-b355-48f7-9ec3-742f79f76e23", "comment": "Malware payload (Mirai)", "value": "b0c4bd855204c584ab9916b5fea9ff067a6c2a5ba6fffb79b1fce9709f30ce1a46867f1b107f21b72b3eec2ef274d503", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664722, "uuid": "c947890b-e25e-4e12-a2ac-fda5103866a5", "value": "T165730956BD818B23C5D222FAFBAF019C37227BA8C5EB7106DC21BF51374689B0D67211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664722, "uuid": "bb65fab4-3078-46bf-9b15-4621d4070d63", "value": "1536:dnuWcuwFl8zHmzTNo+3sAFmkOb271DOBG0vRnBbv4f:dnwFl8zGzTNTFmkObOiRRnBb4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780664722, "uuid": "85e18060-168d-4bb7-8ce6-04b8b22938a8", "value": 75460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780664722, "uuid": "ad5fe616-fa71-4578-af99-e4116eeefbcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664722, "uuid": "b7e6f424-7cea-40fb-aacd-a5d1baa641c5", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5978dea0-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642018, "uuid": "ebe4d549-1f5a-4e6d-a9fb-ba6ec81db591", "comment": "Malware payload (RemusStealer)", "value": "e491ef9cbeac07a5155b37bd4a0764f3", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642018, "uuid": "5a4b4242-3691-4705-9f2f-523a2e16cae3", "comment": "Malware payload (RemusStealer)", "value": "95aa6cb8d1070d033da84cfcfa136ef46a0c6d7192ee06458707a28a7c1c94a9", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642018, "uuid": "37873190-52a6-4993-96a1-698f1e72524a", "comment": "Malware payload (RemusStealer)", "value": "4b370022f41f6b9faa5c2f1a14a0a4ac0368b354", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642018, "uuid": "2439a64c-cf80-4880-95b5-bcf07e9ad128", "comment": "Malware payload (RemusStealer)", "value": "0984c940a41b9c52e67e23407920d6dc00ebf83e8b14af724ca4bbb7ceb7680d535870a9fc6ddc67555695cf53894457", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642018, "uuid": "6e7b8d30-5e71-4c2f-b217-d80cc5b641cc", "value": "T1F014386BD25371FCE553C07882667231B732B63907346EF742A2D730AE329D06E78969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642018, "uuid": "bd974105-b665-44cd-9307-07243fce772f", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642018, "uuid": "9c1f50b5-5d33-40e7-a5b1-64fe624a0f1d", "value": "6144:mpFJxVbqzn7nZsdAzjOj2lvF8EIuHKoyqYY:mtxVbqYQlvFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642018, "uuid": "579c68a0-1964-4102-8fb0-7c7162f3b88e", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642018, "uuid": "b1ee8d38-7601-43df-a6e7-32df828a75f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642018, "uuid": "f9614639-4484-4f64-aaaa-08dac059bf71", "value": "95aa6cb8d1070d033da84cfcfa136ef46a0c6d7192ee06458707a28a7c1c94a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a90b4b7-60df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780664730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664730, "uuid": "0be65e98-0342-454e-9165-5d295a83365c", "comment": "Malware payload (Mirai)", "value": "f0d5e03943ee740a7e8e58ad97fc6b81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664730, "uuid": "bc257f3e-f9bf-44e6-b70a-c8e83228bc94", "comment": "Malware payload (Mirai)", "value": "95df6cdc03dc5b43900885d116ac20984af5bd1b73a9d1cd51bd7c9256a39341", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664730, "uuid": "2ff8db1d-0d28-4ead-9e81-531243e89511", "comment": "Malware payload (Mirai)", "value": "a06ee87cc42339810d9ed4e902d904f4e16c9934", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664730, "uuid": "a514587e-a780-49d7-b47f-2747c511f6a3", "comment": "Malware payload (Mirai)", "value": "b75103143f5c14cfb37feeefd942d9ba76302c5eea5cd9db56f12a323f4dfba51b88f6fbf9b5427cf494547c9058c7f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664730, "uuid": "80f57680-9372-4cca-acf6-b34682dcefc1", "value": "T1D523F20787978F3AE4F05C7294E56E1B735BBBF45A8EEB72EB09095E8C5A51103AE001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664730, "uuid": "d32515c2-cb93-4519-b0f0-fe9258dbd762", "value": "768:hSMi5iiKieUYO2JB0awyyzkA+7Kb/mQkfNlTC3PGTVb5PZTZBwbXZB0ZK4zIkvlU:hSM2Kc2JBWwKjtSDTC3PS5PZT/wbJDEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780664730, "uuid": "927aa8f8-95c2-49e8-a263-ab470be278b2", "value": 47028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780664730, "uuid": "006274a2-046b-4f7b-a523-cec00f4d0f75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664730, "uuid": "9d4a18bb-1978-4749-ab60-35f66a2a796b", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0dcf2c5-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681786, "uuid": "94cf52a9-60f1-4377-8d04-90d6764bed93", "comment": "Malware payload (Cosmu)", "value": "97857eb978687a71534bb66092541f07", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681786, "uuid": "8ea309f9-cf99-4e7e-bef4-be3fe78e8241", "comment": "Malware payload (Cosmu)", "value": "95fae7ff5d7ff4d072e0a34179ed74f5d513342dcb7ccdc751fedcc75db68bb4", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681786, "uuid": "cc9b62ae-49e8-41ac-be25-661903b347af", "comment": "Malware payload (Cosmu)", "value": "65e1943063d212394263fae4e9054ba5b5fe25ab", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681786, "uuid": "2e634e44-fbdd-4ab0-baaa-00ceda5509f7", "comment": "Malware payload (Cosmu)", "value": "6bc1c6ba57bae9a3de33049d58ba7a74336edbfb9a8b9c1e175790f22cc7c7cab2b6d0b6dc743cd4552f623c976c09b7", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681786, "uuid": "531853dd-0593-4d64-a841-2e6c56376903", "value": "T11524F1553C93C4B3D041497289E58BD18B7F6D03BAE2E15BFF9D0A474FB02984BA7261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681786, "uuid": "927c4e8b-5f62-4f51-a3af-a6065f75e8ff", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681786, "uuid": "208a39b1-926d-487a-b2dc-90ef11cc9038", "value": "3072:DQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB5b:O9lKgzelZNQSBQGH/CSpWqTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681786, "uuid": "1a31bbb2-6f7d-4792-ab7f-f898e1a85209", "value": 221185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681786, "uuid": "da6acc5e-fbf2-4081-b8e5-f11e56e0c1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681786, "uuid": "cb7df5cd-057f-4b76-9c74-2b97863a37a6", "value": "jabswitch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98a2024-60d4-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1780660272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660272, "uuid": "ffeec8f2-1e2b-46a4-8578-76f82a718fc9", "comment": "Malware payload (NetSupport)", "value": "b99fa8867399e47a93990fd20ab7720a", "object_relation": "md5", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "dkilkamajsiot-com", "colour": "#30A32E", "exportable": true, "hide_tag": false }, { "name": "lopstmisot.com", "colour": "#824AB3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660272, "uuid": "58632a37-cdb7-434a-ac62-df7b6efb84f9", "comment": "Malware payload (NetSupport)", "value": "965688a4dc8af90607e8c4b69cef2a2a3adaa4f65b115332cab0b04534d18876", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "dkilkamajsiot-com", "colour": "#30A32E", "exportable": true, "hide_tag": false }, { "name": "lopstmisot.com", "colour": "#824AB3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660272, "uuid": "c2119ea7-ecd1-4eb8-89b7-edad9bcd9f35", "comment": "Malware payload (NetSupport)", "value": "ac7892f0074ff6c62697083f887b1335ba62c7d8", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "dkilkamajsiot-com", "colour": "#30A32E", "exportable": true, "hide_tag": false }, { "name": "lopstmisot.com", "colour": "#824AB3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660272, "uuid": "655bb771-88d6-4d1f-935b-a15042571b8e", "comment": "Malware payload (NetSupport)", "value": "8f81814c001bff156489a5c350f604a5238d745e2fbac006572ff9a0062c35cc85e4264704cf4be49f9f77f33fb41c82", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "dkilkamajsiot-com", "colour": "#30A32E", "exportable": true, "hide_tag": false }, { "name": "lopstmisot.com", "colour": "#824AB3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660272, "uuid": "5822825d-6b58-43c5-b773-50ee58ddb087", "value": "T1CD6612BB6A7C4DB5C83CE47E57139F52D9B8F8411B6C648D0D52B3B02962A716B3E038", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660272, "uuid": "2267c97b-0d67-4f3c-bbdc-6aa37344d3f6", "value": "98304:3/EhnCSlllllllllllllllll/ss3Vfg2UNRtM4PABjrb5Iq7UgIWihxg8FnuAq4B:qnFfgNVaVTodg8Y3LOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780660272, "uuid": "aa30a0ff-6b2b-409f-8378-539fa5a08e6f", "value": 6889472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780660272, "uuid": "df52c3c3-78dc-4c38-bfa9-1912d5cada1e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660272, "uuid": "7da4d4e4-c3c1-4c3f-a800-88854762fc41", "value": "965688a4dc8af90607e8c4b69cef2a2a3adaa4f65b115332cab0b04534d18876.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d80ff6-6115-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780687960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687960, "uuid": "3b59b0a8-3d52-40e5-a0c5-5e8255b2b926", "comment": "Malware payload (Mirai)", "value": "00fe016ef59dd90083090d90354aa694", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687960, "uuid": "36b94b21-3dfa-46af-9d17-e6ccd7066bd6", "comment": "Malware payload (Mirai)", "value": "96e46a96b57caed8d283fa683279d9928669d17bb71defeee847f27c8edf748a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687960, "uuid": "84c77bce-36a6-463d-bfaa-c44ce37041e2", "comment": "Malware payload (Mirai)", "value": "35e16cb7ce71200bcd77bc23c86c2327a41c78c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687960, "uuid": "7a0309de-ebf5-477d-928d-29ccf0b9fa99", "comment": "Malware payload (Mirai)", "value": "f0b24bf7c5c1ed907be5e6c63634f122f3f74c28df0887b7daa9a910645c60970ab49d05a0225978395b3ec2c589e28c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687960, "uuid": "70403378-e6fb-4403-ad96-af7ddc6e016c", "value": "T10F356D5AF2F370FCC167C030439BDB62A839F46511226E7B25C4DA352D66EB01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687960, "uuid": "9e59aa3f-f2bc-4f34-a8ec-e61e5ebe6d1b", "value": "12288:rDf0/Q5nHf5SpsYSA2sUNxXtxKRa+pwySZoYmylZT9gA8/5k:rD4QZ/5SpKkUNxXtxKpxj4Bf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780687960, "uuid": "5cc18903-8807-4a89-ab0a-2f3660072dd5", "value": 1102944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780687960, "uuid": "e2d5abdc-cb79-4361-85df-2438defcf9fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687960, "uuid": "170c2550-f328-4cc0-82fb-905d58cd7a1b", "value": "nova.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80711aa-608a-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780628406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780628406, "uuid": "f5b94323-71ad-4dde-b70f-cee0d9d26a75", "comment": "Malware payload (NanoCore)", "value": "10298a0ee5b9119ac7722cbbb1b77a3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780628406, "uuid": "2c581ff3-1d33-4ff5-8fb1-73ed0a9b4121", "comment": "Malware payload (NanoCore)", "value": "972c93d7cec662851b13b110d38fb7f70cd87fd1d2ad22799f5b073dedf3c968", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780628406, "uuid": "2776d9f9-40f8-4959-b18b-c7aead834d3a", "comment": "Malware payload (NanoCore)", "value": "a5ec243077ecfe82e4d5aba576b973163ae2937d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780628406, "uuid": "cb02c3dd-8397-4adf-b1f1-ede4e7de294a", "comment": "Malware payload (NanoCore)", "value": "a0314779f563f81ea3e14331b06876d50eb6bfc12f3661ff6550cb2a2465c1b0c64a9c532f26dedbcc442a09770e3ec6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780628406, "uuid": "c857ae25-ec8d-4b9d-9759-8240b0d4d030", "value": "T1C314CF5677A88A2FE2DE86B9711251128379C2E399C3F3DE58D464F78F227E106071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780628406, "uuid": "e5ed1ace-52a7-42dc-8992-dc63707f4c83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780628406, "uuid": "4ee1fdae-ff39-4c49-b0d2-5d2da321ed54", "value": "6144:MLV6Bta6dtJmakIM540cFHkf8wa3PNMGdsg:MLV6BtpmkbrH3wKlMGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780628406, "uuid": "5636a815-6330-4dd6-bae6-93e3ec6d6643", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780628406, "uuid": "c05d7a74-ac23-4971-bd78-c1e72e7e040c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780628406, "uuid": "5fdee5be-62d6-4761-a97e-8189602d7664", "value": "kem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb39f96-611b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780690694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690694, "uuid": "d141c7dc-01ec-4703-a211-2dc61c8f7cb4", "comment": "Malware payload", "value": "e27c81b071e713f9995402dcc89f8650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "statsnewlab-org", "colour": "#90B6D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690694, "uuid": "cdd9173f-caaa-49a2-9fbe-81fd11230d7e", "comment": "Malware payload", "value": "973e231cfa1e7d1ad1a409dbe5c501b85f76d1c8ce167dd388fa11d71b1c86a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "statsnewlab-org", "colour": "#90B6D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690694, "uuid": "33f9bd57-c507-4828-8879-c4fa6f844286", "comment": "Malware payload", "value": "077d2ba312acba43181daf1fbeb0ba87b329a807", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "statsnewlab-org", "colour": "#90B6D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690694, "uuid": "704c96ce-b48f-42a2-8c26-676558028381", "comment": "Malware payload", "value": "7f2b61acd235d6432d024c37e440306192681a1ce6e4a80077283816bf6bb50ddc76a05e9b3c9a07f400944c1dfe94b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "statsnewlab-org", "colour": "#90B6D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690694, "uuid": "aadee475-309e-46b3-98bb-c47b33db70fb", "value": "T18657330293B7E0EBDCD1FF3B1BBAA41C95D05CC842C7A1E0A5E34F98BF25B1A55061A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690694, "uuid": "95566087-367b-4e45-a42c-cf59f2e63664", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690694, "uuid": "5c0340e7-3548-4dbb-a5c8-2feff98faa36", "value": "786432:8mw5oSyduo4PCO1P1GCjYbtmt+E6RTQa/I7:8rqGKO1ovb2nWMa/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780690694, "uuid": "f1e9e970-a1db-4c4c-a52d-8f9fd8a5c821", "value": 29427336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780690694, "uuid": "69e37851-8c7e-4247-8200-36f892500a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690694, "uuid": "d09f19ed-7716-41d1-9881-2420e296c1c1", "value": "Wondershare_Recoverit_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a906b71f-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642581, "uuid": "c8cbc906-61fc-4b4c-8d51-9797471945bf", "comment": "Malware payload (RemusStealer)", "value": "4c65ef16ec9e6425be291f170ecf2e3d", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642581, "uuid": "5f0f9a69-efbe-47a2-ae6a-874dd79c86eb", "comment": "Malware payload (RemusStealer)", "value": "99d6ea218c93a9e3208a4066cfa08b84e23ed8a7688daca82809fa22040f32e0", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642581, "uuid": "1e9c6802-44a3-4247-9476-aafe691df6c3", "comment": "Malware payload (RemusStealer)", "value": "ba98c29205ed525b6c05352918e2b155d2c12f3b", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642581, "uuid": "f91e9c68-bdfa-4c3b-b027-2d59bf8e1a3e", "comment": "Malware payload (RemusStealer)", "value": "d015e22011ba169361633355da534a184dadfbfce9124e40ca475cab8c89e2dc14f9f6126ab912c91f18e2cf83445b36", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642581, "uuid": "128a9ad9-fd67-43e6-b133-d5a04ea6e917", "value": "T11326E0212DED202AF87ADDF1A0F0B5C91DA4BD7D45A508EC68CCB675DC128533BAF819", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642581, "uuid": "b968b7f8-5936-4f76-b9c1-0e80162dbe99", "value": "2357c925d5987053dcf0c59a30ebf2d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642581, "uuid": "29f627d7-e7a9-45b0-9a32-6b9eae285030", "value": "98304:kBXwY53vIMvUnh9bqnWkI/B5NJ2dIaZ7L/Foze:kBAs3Ji+WhpXJ2dRZH/Fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642581, "uuid": "6e760090-1c32-4882-bfe6-41e9ad62809b", "value": 4816896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642581, "uuid": "5af96ed8-7c6e-4444-8fd2-0a9da1192d23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642581, "uuid": "345fb7c7-4d2d-46db-a42a-c5916a74cb60", "value": "99d6ea218c93a9e3208a4066cfa08b84e23ed8a7688daca82809fa22040f32e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64066f4b-609d-11f1-a769-42010a9c0008", "comment": "Malware payload (MasonRAT)", "timestamp": 1780636452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636452, "uuid": "4776b461-4f2a-4818-a67e-0b1aa5bdbc8a", "comment": "Malware payload (MasonRAT)", "value": "1edfb73fcc9f2f5597bd9173c323ae76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636452, "uuid": "2492b2bc-498e-4024-bd1d-3d39ce465362", "comment": "Malware payload (MasonRAT)", "value": "9a9862af5fc80f9c220b07c5f84268434eda94d6cd48b097b7c0236d888fb2c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636452, "uuid": "0131ab27-6d9d-4c7f-9d5d-1b86c63a4a3b", "comment": "Malware payload (MasonRAT)", "value": "161123875ed2599e9876dc86a457f9264ea02d05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636452, "uuid": "c2352ef3-70cd-4bff-b360-867f15619a8d", "comment": "Malware payload (MasonRAT)", "value": "e128e9378a142b97525bd6de96194972f3e9f26f17de69facaf17ddf3c335133f39d39ca91024397024167b40753bad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636452, "uuid": "b505e8b4-f4fd-4ce5-a6f8-fdae8901ee3c", "value": "T1CEF41706F353A0EDC52AC17487ABA333B931BC1E52306E2A5794EB713E64E505A7DF18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636452, "uuid": "b712629b-f32e-4b95-9ce8-1d7dcd68d00c", "value": "b34a950632f5cdd12b595483e6183a05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636452, "uuid": "49ad2fcf-c293-4ca6-b62a-39fa3ecd6afb", "value": "12288:elalGWhYrGlLXavhJisHyTw1OJckAPJ+guvpHylI:elalGWqq9ihHHyTw1ke+gapHylI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636452, "uuid": "7ce1f77c-aa36-4257-9dae-50d8a0a4b79a", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636452, "uuid": "7ac4ddd1-a577-409b-bfcc-c24df8094afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636452, "uuid": "2c27a8a5-c695-463f-8f92-71c7645544b1", "value": "ryo-checker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367c3c4a-60df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780664723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664723, "uuid": "bd0f6032-f08e-4794-8065-79747b2fc199", "comment": "Malware payload (Mirai)", "value": "e7abf054affae8be101cba2048dd7c0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664723, "uuid": "95d54968-c5f3-44da-8431-f26354f57b07", "comment": "Malware payload (Mirai)", "value": "9b95e0dfbb4aa14a992e8bb6c69c3ff5552f99b000e4ddc6586e40cd25b09f32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664723, "uuid": "5becdd22-d7b4-4222-86f6-16dd1cf693e3", "comment": "Malware payload (Mirai)", "value": "e85141e8dc75d21c8cae16ff09d7e0f2a7b98933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664723, "uuid": "93b4322d-3af4-4f23-a352-4439d30b8cc2", "comment": "Malware payload (Mirai)", "value": "b51d872c40916ea3d9eaccdba44e9f6379e8cc351813ae200ecfa85cf41736e072cb2584ef9f092a9c48522f056c6063", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664723, "uuid": "ef298428-af0f-4429-baec-030c0fd9a53b", "value": "T1CB632A13BB40C0FDC489C2744B57B53AD57375BD116A72EA7BD8FB217E46E202A2D908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664723, "uuid": "32e370bd-714b-4733-8fc6-152340cee276", "value": "1536:heXaC6VdoaDOVCxGU4hGJJ/iU+UrGtoNajAT7KbggBW:maZ3oaa0xGU4h2iU+KNajAKbggs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780664723, "uuid": "b594e1b6-7dc5-4213-a352-d507f5c320d8", "value": 71360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780664723, "uuid": "8df42d9d-f952-42b4-a6a7-8357ac5ddd89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664723, "uuid": "1a7d801d-042c-49a6-a3fc-d6e8399a7e19", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bb7494-60e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Hamweq)", "timestamp": 1780665497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780665497, "uuid": "f19c8342-c005-40b5-8963-67594ce33f50", "comment": "Malware payload (Hamweq)", "value": "e79669b2b69c9b0f19d7756f5e4d2d2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hamweq", "colour": "#BAF3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780665497, "uuid": "24c17cd8-45bf-4817-aead-65d0399e7889", "comment": "Malware payload (Hamweq)", "value": "9c17957eb6381aee161201ca7eb42c1dba1daa39079a298a8c4936346a517bc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hamweq", "colour": "#BAF3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780665497, "uuid": "b93485a5-ec11-49d5-906d-41b93fae7493", "comment": "Malware payload (Hamweq)", "value": "e52cb8e29a515310784022ecfdb11f349e5bfef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hamweq", "colour": "#BAF3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780665497, "uuid": "637ff6a8-74db-485f-8bd9-a14427c73807", "comment": "Malware payload (Hamweq)", "value": "a28fefcbe38b6ed971a47a90996691e796bcc2cce33fde0ee94497af3190f1a7f50300f3f40808edb694edf8c374c5f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hamweq", "colour": "#BAF3E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780665497, "uuid": "3eeaa52b-84df-4286-8dda-0c8cf46e6163", "value": "T192E27C87F5CA987DD92089FE4D93E10EA3E276107C555591F5FD0D2CAEBEE42220E283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780665497, "uuid": "98c04590-e93d-4827-a122-ce307ad421c5", "value": "183c7dcad54977c28922e6e8144a5b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780665497, "uuid": "2e495f15-8c78-4212-aca4-ff3f6601eaa2", "value": "768:NiGwwsx1McqaAdpm2CUzF0OhjjqYaNxpzHH6sl:cYsXpAdp9Cy0Ospjpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780665497, "uuid": "aa7d8d06-e2e9-4792-9e0b-506e13d44660", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780665497, "uuid": "0fec68ff-47f4-4c5d-a9c4-b57bbc77ff43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780665497, "uuid": "a26ac842-d4c9-4ad7-8ed9-21a9cdae66c6", "value": "9c17957eb6381aee161201ca7eb42c1dba1daa39079a298a8c4936346a517bc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bc563f-612d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780698509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698509, "uuid": "62441d69-5d5c-46fb-931e-0af3b8044453", "comment": "Malware payload", "value": "66f4c23a7070daf36cb28959e167d6f7", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698509, "uuid": "02bd208b-d91a-4f50-bd54-f9dec69472e9", "comment": "Malware payload", "value": "9c52b234c2f87beac902c2c2bec0db2f3c03a7dffab99a8251dfba40fd2ec297", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698509, "uuid": "ef13d715-4dc7-49c6-baa9-8dfab60b7942", "comment": "Malware payload", "value": "745ca75bb5151561f7abbb90a82e9b69eca6aeba", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698509, "uuid": "1dd710e7-d3f8-4983-9b09-d77cc1ae2320", "comment": "Malware payload", "value": "04accf0f3bcf6e03dee2ed7ec1dd71adb32921267c6c216457ff6334e2489428dbabc54336f7af2ff72a76c97149cd30", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780698509, "uuid": "a221bfc2-b1e6-4260-a6c4-8dfe474023bc", "value": "T1A0E6123BB18BA53DE46A1A35B972A170487BAE6194024C1396E0FC8DFF35070DD3E697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780698509, "uuid": "56f9b6f3-e10b-4368-b744-7f4bf66696f3", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780698509, "uuid": "8f6d002b-216a-436d-b31d-c66bea65b05c", "value": "196608:wvXHKZPdm0Y7Gj6hpDkjpTC7KaY6QAED1kTG:wvXqZ1mBNpDipTa0AEBkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780698509, "uuid": "c9018b97-1f59-48bf-9f9d-71c7b0f56bb0", "value": 14054328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780698509, "uuid": "da931562-f92e-44d8-ba48-927363ba2e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780698509, "uuid": "7639e962-a070-452e-aa64-c06cae76d120", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0ee9d5-6084-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780625727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780625727, "uuid": "5bf0775a-af3c-43df-afbd-45bc43b5bd16", "comment": "Malware payload (WannaCry)", "value": "2b18cc88bd5b6a6241489e5e4e4fe62d", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780625727, "uuid": "090d03a1-a849-4b7f-ab4f-ea7b94eba66b", "comment": "Malware payload (WannaCry)", "value": "9c70d387014907d3149f841f3e591e3f3b7b95aacb2af785e9c6f74a2c296fef", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780625727, "uuid": "17880be6-e651-4fb0-8ca7-cb3a43bba2b9", "comment": "Malware payload (WannaCry)", "value": "b629e050a90a6bb7d99caea1ba281ade80904d2b", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780625727, "uuid": "530136b7-b9d5-4970-98b2-d27f0a979570", "comment": "Malware payload (WannaCry)", "value": "af491ccd0d20cd2c693638463eacc1acd694edcf2db3cfd13a3b8134b8b9eed3c392ffae963f0f57e89ca84706f1d302", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780625727, "uuid": "17639fbc-1cb2-44cf-aad6-b256259a227d", "value": "T17A36239932EC90FCD5162274D4B34E15E3B37C9932BD870F9B9486260E03791FB69B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780625727, "uuid": "09d48b77-efa2-4f39-b5d7-8d6455d69665", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780625727, "uuid": "59d3849f-df78-44d8-8051-6b15cd2d591f", "value": "24576:jbLgBbLgurgDdmMSirYbcMNgef0QeQjG7v:jnsnsEMSPbcBVQej7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780625727, "uuid": "e15c30ab-d85e-47e3-bed3-990b149f232e", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780625727, "uuid": "811c8a9b-909e-435e-816a-415826a2257c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780625727, "uuid": "da2642bc-35c8-434a-9c2c-6f6b8227644f", "value": "9c70d387014907d3149f841f3e591e3f3b7b95aacb2af785e9c6f74a2c296fef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0236b3ea-60d8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780661629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780661629, "uuid": "06221341-9c96-4313-83fe-dfc60fe255fc", "comment": "Malware payload (AgentTesla)", "value": "fb7acc8477638380bc0974c546037a15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780661629, "uuid": "0615ba84-9a94-47c8-b6a7-ca0d8a6532ea", "comment": "Malware payload (AgentTesla)", "value": "9d5ad9a5262bd3869350cc8651b5693582b46e6b117b380794b2d720f41f0366", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780661629, "uuid": "e0a760b2-9819-47a0-b5ca-3ae24d7ccb13", "comment": "Malware payload (AgentTesla)", "value": "a04ac5ad0ffcd99fcd10df5e10a6d4118de7bf27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780661629, "uuid": "101cbbb7-2349-4b24-aa96-f86fb6a9de8c", "comment": "Malware payload (AgentTesla)", "value": "5bb4712c3e164053a0559d7581ace847d2b8683f410d6f578a646189ad57a2755baf275c96c8f4616e64f44103378a92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780661629, "uuid": "13628b60-0ca8-4d49-ac7d-572d115ded52", "value": "T14C05193DCC18422EE172C529C899095FF8D2560B222CEA4B94C7375BAF7398677C729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780661629, "uuid": "9c7950ee-8d32-49dd-995c-7a2775c44a39", "value": "3072:eb3PUg36SMk/7W8A86eWydLoUeYGNrktOHnnJgw8PWbVAlLfCcMnvlOarPoaJ+zV:5A7WW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780661629, "uuid": "0f48ba4e-e47d-4db3-b935-89a67bb6f4a8", "value": 868750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780661629, "uuid": "d25e940c-24bb-4d2f-baa3-d36e7d75795e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780661629, "uuid": "1062aa19-eccf-4d94-a669-64ad37ec278d", "value": "RFQ 102603813_OQ_Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae51f1c-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780638692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638692, "uuid": "ae0d7725-c650-44da-bbd0-a001b81e9dfe", "comment": "Malware payload (Mirai)", "value": "62421b4d807736e13e90d3ec07a75ae0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638692, "uuid": "d7b23749-e104-42a6-8eca-e5058dc5ceba", "comment": "Malware payload (Mirai)", "value": "9f2b9acf5ba4f3c9057eb20457cc5bf43606cb05e8188728aa3c62c834a87ce5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638692, "uuid": "f476a545-404a-4e78-9e86-ad3310eb5f03", "comment": "Malware payload (Mirai)", "value": "7f1babc0b4d6d1811c753bcd9356076f6225fbc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638692, "uuid": "5bd24e5b-dd70-416c-b9aa-e2b6a464b260", "comment": "Malware payload (Mirai)", "value": "5fd34791747951a26ee77a3dafa3f31fee48e318968842d566c6fba46a685a5f598168b5a7d20af82b8b183221c53290", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638692, "uuid": "3df90e41-187c-4ee2-9cef-7f81264bec8f", "value": "T1DBE3F771E64BCAB3C40300F201AAEF6B4E31BDFB48329585E779BD50DA324D29651F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638692, "uuid": "083cd8c7-8f1c-433b-9fb6-02be5598fa9f", "value": "1536:XnhpUdynThoOx7X3tRqo0cm3oxDlWKO20nnMWPUEkin40W2E+AFRxoHFPn05Gk:Xn8yThRxL3JJVuB8ETn/3iyy5Gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638692, "uuid": "3fc9d0be-3c63-4482-aaee-0d5e70739d38", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638692, "uuid": "75cebc41-f25f-4fc7-8e9a-fb92507e539f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638692, "uuid": "0d8047ce-be34-4c4b-95e7-f66caaa34888", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fdd4fe-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780648665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648665, "uuid": "db7c9e7e-f0e2-4c18-9159-2e3b572f7fa1", "comment": "Malware payload (AgentTesla)", "value": "52aad8b6a67c920aa5847d9788750954", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648665, "uuid": "b7133c85-76af-439c-a0e1-6dc5020b5a76", "comment": "Malware payload (AgentTesla)", "value": "9fe76c32913a4978b460e3bd149c3b84c5078dfb4e06e8c1e3a3228053519212", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648665, "uuid": "e2b11e11-a106-4168-a77f-131e202e0c78", "comment": "Malware payload (AgentTesla)", "value": "3c3c1f6072e5e06bf691401488ac662160fb9366", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648665, "uuid": "2a92ae3b-75cc-4db0-8218-3c5ca13fdc4d", "comment": "Malware payload (AgentTesla)", "value": "e1e37232a38fd06f298599c811d4810047c67e3f6bb74b302df11c77e21f8532b8d9415d6a5a4061e99c387c4ae86407", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648665, "uuid": "0180fe71-bde4-44ee-8bc3-a92d9417ecff", "value": "T12E05F73EC814402EE576D629C546046FF8932A4B123CE90764CA7B5F6FA388677D339E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648665, "uuid": "472562ab-431a-4fbb-ae89-78d5c37e364a", "value": "3072:O9wqoSuIqc1PWjSS6CC4YxyNN8G3B61A05gGsZMo05wYf/8/859m1rOIfq83ZHgQ:QrbqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648665, "uuid": "4d0eacde-eef7-400b-a979-3b31bfae0036", "value": 857588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648665, "uuid": "dc6725bc-c8a8-4b3c-883d-8808434e921f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648665, "uuid": "327f18aa-3815-40ca-87b6-219c70f1c320", "value": "POUS45096222077.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc6c73f-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649486, "uuid": "f0ae1977-0740-4959-ba0e-9cb6a2912c86", "comment": "Malware payload", "value": "2342f4e041495afaa6187bd687ba9ce1", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649486, "uuid": "f6bf7184-f838-4ac6-859a-e31ad554af5f", "comment": "Malware payload", "value": "a0581ea8275aee7613b8965a80d8458dad75f70775ea479f9c97bf0160eecf3b", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649486, "uuid": "7946a4d5-0546-4de3-a937-d20d6abb62c4", "comment": "Malware payload", "value": "1c6aead22db9853593beb5b6e0a78d9327f28783", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649486, "uuid": "5bfca2d8-f947-40d1-b35c-b58dc140cbe6", "comment": "Malware payload", "value": "8f541b99e3c52e23afc52a4af0391f188765329ecaafd50478bd203974fc44fd0c7a864c7b7dc5ed98a5d665f3c57bcc", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649486, "uuid": "db6dea6b-46b1-442f-9585-75547ceb1d92", "value": "T1B932CF031AAA531A88E3EF7D9C6B6942D539C819AC4981D4BA878E7F4DC10D2CB1D56C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649486, "uuid": "9236a049-c56e-4846-a52f-b509eb73d11b", "value": "192:RnSq6nq82SAiWB9w4Q2vDs0GJgnDK+3cfYhWMmJ45KCEgzLkiKnx8tMc5ZMCSjsD:RnSHnqbztNLs052AWMsaKVwLkiq8awZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649486, "uuid": "9d9b176c-121a-4a49-a2c8-760883f51493", "value": 11254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649486, "uuid": "86f7f601-fb1b-44a8-9b8f-0e5543b400fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649486, "uuid": "05e5c1e3-b7e1-4c9b-9f97-b96f7127b6da", "value": "photo-832072274.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dad668-60ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780670790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670790, "uuid": "d3e291e2-342d-4e8c-bb01-c7224d344c1f", "comment": "Malware payload", "value": "9f4ef78e93f9a94719c42fd6f5b00924", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670790, "uuid": "59cdd615-d41b-402f-a444-43710ebbbde9", "comment": "Malware payload", "value": "a068d551cca9b0a5590d836cf0f131c722510b7b5af0726c8eea236b3c9dc3ab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670790, "uuid": "ae7a9d45-e34e-4194-b80f-07132e906844", "comment": "Malware payload", "value": "22a97cbc9b53296640961f526cc4f6bb1867d255", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670790, "uuid": "2b6412b4-80b0-46b0-a290-68424ef1feca", "comment": "Malware payload", "value": "81ce22e4e7b335e61e41bc9dc4dc09975929e31685f27d81167ef6177b6041fe0cf9500a2142b0e18ea717f999c8ea65", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780670790, "uuid": "e78d8a26-9217-4f01-9792-2072d3177c61", "value": "T1F20180CBC006CA6041C5EC9D2AE75045B410C3CF36468BA5BF6C643ED7A5A447059EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780670790, "uuid": "c50aa783-3d83-4718-a6ef-cde8d18a4a20", "value": "24:kXCKysE2hi0ziQvZohaYZVa5E5cWN6AjZjxWX:e9Qp+MsYZVa5E5NjZj0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780670790, "uuid": "8f5eb5e4-f2e6-416c-bd46-d3d074b24baf", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780670790, "uuid": "610d9d5d-9843-4d20-b8a6-c26a73b078c7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780670790, "uuid": "0496f4f9-fa27-4828-a31b-5b72d373609e", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da98e71-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642321, "uuid": "e8f8b6e8-ad62-4958-9621-d44635e35af8", "comment": "Malware payload (RemusStealer)", "value": "1d3457022e3d107766c7651f96b39196", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642321, "uuid": "6f419004-b96a-4c02-a1fc-cf8d491f5169", "comment": "Malware payload (RemusStealer)", "value": "a0c1657e74f2f773936a87663bc9b5b2509451066e26ead3c4ce33009b8c6269", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642321, "uuid": "43f825e0-9563-46e6-9762-41ed6b2a32a4", "comment": "Malware payload (RemusStealer)", "value": "7c0d0f01840aa8fc18b0cc396416461fba90588f", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642321, "uuid": "70d1d16d-c12d-4f1c-a79e-ad0376b954ec", "comment": "Malware payload (RemusStealer)", "value": "2bec61fe3cb371183bc06f385ece110d628f1a32ee658c7064200e351aa6127bf53ab0b877f84badeae51a17775ce5d3", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642321, "uuid": "4fd11120-81c9-4c08-ad36-054066a661cf", "value": "T142B5180A7D9749E5C46A8235B9A671BD3F30BC7C0B3223EB2F5076391E726D4587A708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642321, "uuid": "0cbe6ce3-8f49-4750-a66c-b9fc36af48a7", "value": "24576:btLcpVLxTTLiqO9nMBNhHYLIzQ4pH7J/aNFh7BvT/wBtP62uF/aT/8m:mpxxTiqOVMnhHYLMQGJ/aNFh7dwqFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642321, "uuid": "596f2b66-6b6f-4732-a424-851021e8c9fe", "value": 2486272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642321, "uuid": "680c6965-b530-45b1-b480-d1c3e7e7fbe9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642321, "uuid": "737ed6e2-4314-431e-b5f5-985f7c680a5b", "value": "a0c1657e74f2f773936a87663bc9b5b2509451066e26ead3c4ce33009b8c6269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fd6925-612e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780698865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698865, "uuid": "e478f9bf-ba79-4954-b074-248dbce2cdbf", "comment": "Malware payload", "value": "f3cacc631ba3d39d4e563ab37a5881a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698865, "uuid": "79ac5e74-7224-4d6e-a06a-22d6b9b6c399", "comment": "Malware payload", "value": "a147cf371162df3270dfb0ede11e3ea1c2fdf0cfb27eaa731c9f241ccae64efb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698865, "uuid": "ac3e0272-8b33-405b-b68b-ba4d303680f0", "comment": "Malware payload", "value": "473750b095f7854db842506d4536a3aebe88c35e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780698865, "uuid": "3ec76764-f6f5-43bb-a10a-025c8b28b7f6", "comment": "Malware payload", "value": "ef8ed364ddd8903479ebe687adb5b2ae91537b0bc7166fe8bda0aaa9de6279fc802f86705812b532ca7fe02f6e48b401", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780698865, "uuid": "4953dda9-94f7-4f24-b263-651df44d1f92", "value": "T10567CF77A1067CE9E9A94DB4841015816D787C874B78A3C7BAC8B1F666FB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780698865, "uuid": "4081a178-02a7-442e-9e5a-1525e54469e8", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ7:cqYUQuVDt0TZEAok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780698865, "uuid": "61f213cc-85ae-4740-9677-9d376e439a4f", "value": 30244864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780698865, "uuid": "1f095810-2dbe-478d-86c0-51b36877a593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780698865, "uuid": "7496e836-78f2-4a41-8b23-9fe7ef3edea2", "value": "a147cf371162df3270dfb0ede11e3ea1c2fdf0cfb27eaa731c9f241ccae64efb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65a6b75-610e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780685231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780685231, "uuid": "69101514-a88e-4a92-9dd1-1fdb1ddda79c", "comment": "Malware payload", "value": "2259ee7924379133397aff662b06c897", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780685231, "uuid": "ebeab95f-a4ed-46c3-9c02-254b3f185864", "comment": "Malware payload", "value": "a2386cbd90d030c121a34a881d45cf6ff9507bb4a35918ea00767be7f8e79924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780685231, "uuid": "63d663f4-ee37-49e4-a0eb-0049702c58fa", "comment": "Malware payload", "value": "25772621a1624676621acf4041870a76a5ff9881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780685231, "uuid": "43125ee7-bd8e-4ae5-baca-43924b491d35", "comment": "Malware payload", "value": "845c11d926e29a06e4b6a7bc5b3dc4cbb2578cdcb9ed3bf63ae639cfb1e9aa05823a2a36690e5e5ced472eeb6bcb1aed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780685231, "uuid": "7c942312-367f-4143-82e1-d57ca8e797df", "value": "T1E49222EB8778ACB4C05AC1761A37874971AA00B416B6A2B1AF900E2F506C1E55675F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780685231, "uuid": "50d732c5-366a-4045-b0b4-ed0ea12b2e15", "value": "478eacfbe2b201dabe63be53f34148a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780685231, "uuid": "8e77e77d-6156-417e-ba3c-b46b64d733e6", "value": "12:eNGSGFcNz4sm9xrVmKxgbgnar4KlgMQrOq0:eNGS8OrmvrVFGNO7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780685231, "uuid": "ad852fc0-98e9-44fc-a635-63b8b50b5243", "value": 20572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780685231, "uuid": "6c6b23d2-0fd1-4329-89b5-798db45ccb79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780685231, "uuid": "02da2c4a-d892-4c9d-a3e6-0c6a02e82346", "value": "shellcode.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb9787b-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780641755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641755, "uuid": "a85af23f-6354-48fa-bc92-3dceb0ee23fe", "comment": "Malware payload (AgentTesla)", "value": "63c355df7a07005a8fe5cba89a4d7926", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641755, "uuid": "df12f5cd-03f3-44ac-9538-3868385112e1", "comment": "Malware payload (AgentTesla)", "value": "a28c670ed37eb2c088804104e57eb01f9935033d03506d705de8acb28c7641b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641755, "uuid": "52244c31-bad3-4f33-9491-fa5d3f4a93aa", "comment": "Malware payload (AgentTesla)", "value": "a6b4870b02f9f79538b1ca245c7e978fd98b1af9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641755, "uuid": "6702399d-4b9b-4b4a-be8f-38694e106869", "comment": "Malware payload (AgentTesla)", "value": "4965f002086f789b4be4229d664c86ad8862043e549bc7dbe4b6a4b00382e8105ee14a049ae8785deb3bcef0fd312e97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641755, "uuid": "6ad903a9-e381-4d31-9b4f-ff7e7301e24b", "value": "T1BC34F1007A40DC27E94BA9B0286629770E7AED3D696F37A72310DF183C617E6167F346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641755, "uuid": "0f8e85ed-b8da-4a34-bca6-18c5af16d8aa", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641755, "uuid": "06e13a96-0f98-495a-b8c7-8611a385000e", "value": "6144:6fL+oq7oj+OgzBXzHH0VjkAr3mpcdyvIOn:6fLzSBzBjHHsLGvfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641755, "uuid": "e853ea2a-2940-4420-88f1-6652b9455a23", "value": 243824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641755, "uuid": "fb8af4e3-7a22-487b-96c8-802ac547fe19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641755, "uuid": "138debc5-83b2-4376-89d7-7c8ed8200f84", "value": "10045_2026-06-05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f773f3ed-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681797, "uuid": "3154caf9-39ae-4a4b-b797-4448194a5940", "comment": "Malware payload (Cosmu)", "value": "b5a8a291d4ee83a6a397c742239b02b4", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681797, "uuid": "63838280-da5f-4daa-a858-3c915eddac57", "comment": "Malware payload (Cosmu)", "value": "a2b6234c80df7df91b4b159bb4a4f3f0c33e0764889f5df17ed80ced99a34205", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681797, "uuid": "c9f0eb58-6a23-48cf-a477-259ad335299d", "comment": "Malware payload (Cosmu)", "value": "56d06358c9d0ca5cd651400f28529a7cfedc299b", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681797, "uuid": "279bd35f-93c5-4e7e-8831-460c5317cac6", "comment": "Malware payload (Cosmu)", "value": "29d7c4cdbba31c3e774ee147534f31c600305508acaca1ddce5195da8a356c5c74bef0f45c6891626d3e271981e0f37c", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681797, "uuid": "d3a02fd3-78d0-4820-9824-e0e1f2008ebd", "value": "T13E24F1453D93C4B3D041497289E58BD18B7F6D03BAA2E15BFF9D0A4B4EB02984BB7361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681797, "uuid": "04ca3bb6-3d79-4f8b-89c8-4bd9cd8c5834", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681797, "uuid": "c5e5cfcf-17f4-4b72-bfce-8b09533d273b", "value": "3072:EQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBzZ:d9lKgzelZNQSBQGH/CSpWqTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681797, "uuid": "96e00ef8-c424-4018-a022-9b5b638e5f1a", "value": 221185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681797, "uuid": "f858fb06-ddc3-44c3-a614-d0af5a4057f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681797, "uuid": "eb603b87-0329-498b-ac52-f23c532c714a", "value": "MsoHtmEd.Exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2e88b8-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667314, "uuid": "178f2e93-061f-4d00-a177-47b070ff8dd5", "comment": "Malware payload (Mirai)", "value": "0ee2616188e13aab45ab3d41013faf94", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667314, "uuid": "031920cf-fbd2-4464-8db1-a26a4abc1c8d", "comment": "Malware payload (Mirai)", "value": "a3a5db2511516a59c9c39b4669c5ed26f04870e07b911daa5f8f6e87e85ba8f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667314, "uuid": "b3d8d41d-7151-4808-b0d9-2790d942ac3d", "comment": "Malware payload (Mirai)", "value": "d6caf2c44446a24956b320b2d351bcf7709c651d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667314, "uuid": "a6339ad4-9f6f-43b0-83a7-6090bced4009", "comment": "Malware payload (Mirai)", "value": "73eb89b9e171405422f5382675c9c0b13eda9741468f995e619534ca210b38009182cf5954237f1cf759d5831ffca51a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667314, "uuid": "d6e42585-f556-4532-9e8b-bca4ff85b857", "value": "T149F36C41771C0D47E2671DB0293F23D183AED9E122F5B649290FAB8D52B6E325582ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667314, "uuid": "10b2db8e-149e-40d5-a860-7c9bf1597ca5", "value": "3072:bbWpew4s+zNju8dV2JdlHW44uABPvcnVQnIjtQTjtrD7kQ5Q:Xob4rxu8dV2JdlH6BPoV6I5QvN3kQ5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667314, "uuid": "0d83a131-d735-431b-b1d1-36997a8781ad", "value": 157304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667314, "uuid": "efda9337-8dfa-4317-819a-9c1bfbddc6b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667314, "uuid": "237b4370-fc6b-45a9-9b89-014dbe9701db", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a505c0e5-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649446, "uuid": "88b7c36c-382e-434a-82fa-578ac9076360", "comment": "Malware payload", "value": "32ed1b5591ba93e470179ba6f0ee575a", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649446, "uuid": "007aa162-b972-4cf2-9b53-9e5a6d6582f1", "comment": "Malware payload", "value": "a48d30f69e7420ca9c528185e0efa14923c15c9c6c084bbbcf4b87169620d692", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649446, "uuid": "441f99cc-9bbd-4c5e-9b32-65ec3a45bff5", "comment": "Malware payload", "value": "f3fb483143ab84175f93f6b6e52a4a2199879ce2", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649446, "uuid": "030ed29d-3d22-4caf-94f8-cfb5e42864d1", "comment": "Malware payload", "value": "84a34536d8f92d2857bad59e875e9f0753a4e373a884e6b3c0f7ccda9229e13ebe72aaac16fb51e6653a256d233570ee", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649446, "uuid": "f56a9094-c01b-4599-9231-23f0c5e214ed", "value": "T1FAE19D9AD2635E12DC45CD3920E0B6AC4003B47CDD1D33680ABA0E856BCA7F066428EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649446, "uuid": "be4570d7-bbb5-4d69-8141-4426432ba20e", "value": "192:KoI7uib8Unks+Y4vDAr1zv5fP+SzXxwvy2g:KnDbrVeM1zsSzXxF2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649446, "uuid": "1b8058d6-8e9a-415b-9a95-01439b22ec8e", "value": 7231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649446, "uuid": "d9ee4f8b-cf2f-4465-9bca-15f8e3fb7f48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649446, "uuid": "2189fd0a-ef5f-4f60-8a6a-400c3f53136b", "value": "photo-568557018.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5fc1f5-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681966, "uuid": "df52203b-9ed0-4af2-9aa5-63c6f1eac8bc", "comment": "Malware payload (Cosmu)", "value": "9abd65864c4de27cf58605c316eb1a06", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681966, "uuid": "8bd9d2ad-7771-4196-ab75-c273542e05ac", "comment": "Malware payload (Cosmu)", "value": "a548bceb3c9df7a798363c408dc3956d790e08f6c0af9c372f3cb62e83e74a3f", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681966, "uuid": "e309959d-df92-4e81-b1f5-a2165dd348f5", "comment": "Malware payload (Cosmu)", "value": "157dc1695cfc97589ef0c6af341f15597760a60f", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681966, "uuid": "86c999b2-d292-48af-9407-f0fff817d287", "comment": "Malware payload (Cosmu)", "value": "7cd440f8d6ca2e11a891e7b4b47b5d77267750b8d956600dafa36336256c99e7a9fad4a622bac276d0ccef0832f05469", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681966, "uuid": "e7f35d76-25c6-4e33-9f49-00dda637e94c", "value": "T1A734D0113A9ECBB2D3C288318C6DFAD153767D2F9B61D137B7983B4F1E712885A66201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681966, "uuid": "cd73b1a5-8f2a-4e36-b8c5-57979ec2236a", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681966, "uuid": "277fa2b8-3f82-4ccd-ad4d-d000824ded77", "value": "3072:LQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBVw+1:m9lKgzelZNQSBQGH/CSpWqTzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681966, "uuid": "35877eec-1f09-435d-861b-114b48b29588", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681966, "uuid": "bcedd238-50af-4958-a6c4-7e401eda8851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681966, "uuid": "3ef3acc2-e8e4-4a2a-ab37-beb0788292f1", "value": "7zFM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc7a09f-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681462, "uuid": "b4c9b2fa-0228-4a2f-a846-06b8d9df2a3d", "comment": "Malware payload (Cosmu)", "value": "947fd76114a18c695b5956cd28350656", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681462, "uuid": "429bf839-4859-4c31-9e8d-dc17319f028c", "comment": "Malware payload (Cosmu)", "value": "a57c57366ca62e19547d2150a402fdf9f1781f4173eb4884aa7f25219fbd2ef0", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681462, "uuid": "a0a9f3da-9b69-451d-b379-d58196e75fd0", "comment": "Malware payload (Cosmu)", "value": "87044457ff48102aeaf71f82842b67d5327f7426", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681462, "uuid": "0400923b-ea76-4695-804d-b299e9155f23", "comment": "Malware payload (Cosmu)", "value": "73d36d4da375ea161e60af8b3d7c1a7a5b680de879020095a5510a164fe4a1a4fe276158ddc22503c06d208f04a60949", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681462, "uuid": "3ca2c48d-80cb-403a-ab6e-354930b61d00", "value": "T13C74E0403A9ECBB2D3C249318C6EFAA157767C2F9B65D133F7983B4F1E712845A66201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681462, "uuid": "5d5b5099-0bf3-4fc9-b3f4-e80da55c29d0", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681462, "uuid": "e2bcb01b-fa0d-4cc7-b7a9-a63ea50f8aad", "value": "6144:2FlKgzelZNQSBQGH/CSpWqTzwDoAXjiU4bz:xfBQGH6SfYDoAX+U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681462, "uuid": "01789d3a-4249-4dfe-9428-a86f362c8428", "value": 348843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681462, "uuid": "12cd7d32-b567-4434-b009-bc86256e3cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681462, "uuid": "1d058e05-0c47-4d12-b650-68f1c603b927", "value": "7zFM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdeb2b0b-6114-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780687821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687821, "uuid": "c93f984f-0484-448c-8443-0ea7fb399fc4", "comment": "Malware payload", "value": "f181262c046138c9bc5b4feea7043282", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687821, "uuid": "5bf6e214-2b8c-4b49-87a1-65cce9b24c93", "comment": "Malware payload", "value": "a5ab6ade12c0b3b14695b3f532ac3cba0392f070c34918ce475cc278061052db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687821, "uuid": "387b694b-0ea7-4a91-8df0-ab732611ca01", "comment": "Malware payload", "value": "d7aaa0fa271be7e97e1c585bab328cd4770fbf2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780687821, "uuid": "8562f8ab-d3d8-4d80-896d-9c7ca88ed6da", "comment": "Malware payload", "value": "2457be0a75099faf8ab4762d329ac16213da280e26c9a61cda87cf6a1419b779541573762a2776dea65c72e0aa2fefe5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687821, "uuid": "24390e16-58ed-4a96-b3be-d9f0b6a1d7b2", "value": "T12CF32A46BD418F13C6D721F7FB9E428C371A6B7DD6EB3102D925AFA0378A5D6093A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687821, "uuid": "0e1134c1-a246-44b6-a6cb-7bbcc6fef8a0", "value": "3072:1u8U4hVTh6KJ4O4mLWRZBkwmtF1dls/ZD:E8U0vJ4O48WRZqTtF1Y/ZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780687821, "uuid": "bf017977-c932-4a28-94b7-e3d66d7cdc75", "value": 159008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780687821, "uuid": "78be8f52-4882-4194-af6f-c3119742eff2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780687821, "uuid": "15344cee-b63f-480b-9c0f-c95649f9a77d", "value": "nova.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3a8675-607e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780623336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623336, "uuid": "55b50794-32ec-4001-b256-afe6e95a9985", "comment": "Malware payload", "value": "82b0a4cb5b8e2a2ab76fabdea13266f0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623336, "uuid": "165931ef-5eff-4dcb-bf9d-7bbe62c182d4", "comment": "Malware payload", "value": "a643f6e4c319e5dfc5d67da0d4304cc8def9ae687404fafef0462aa270857393", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623336, "uuid": "b39558c8-db00-4484-85c6-8d0eac5715fa", "comment": "Malware payload", "value": "07820244bcb98af633b95b45ac2fa09f81182f79", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623336, "uuid": "2462b168-63a6-48d6-ac81-323f99efeba5", "comment": "Malware payload", "value": "64c4badaaa05f9ebbee35ad8e828894cd2f7559cf468cf9172709a2482582e4f03ffc49bb8b678614d1bd45e6d615733", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623336, "uuid": "a7ef2247-bafb-41ec-90dc-c956230ca259", "value": "T1D901AFC9C1019B70418AE8AE26AB61C07811C3CF55458BB47FDC543D97ADB58706DF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623336, "uuid": "6b533700-d6d1-4fcc-a7be-bdb675f0b51f", "value": "24:kXCKysE2hi0ziQvZohasjGjhqYuTzMgy7:e9Qp+MssjGjhqYuTz9y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623336, "uuid": "10afde55-83ab-451f-8652-a067f1f2a164", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623336, "uuid": "32bba635-2c2e-4fd6-a97c-7a7e157da930", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623336, "uuid": "c24a1253-bdd9-41eb-a1df-556f6faab323", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e64d783-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780623934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623934, "uuid": "9a1776a3-5e5f-4e80-a368-04b13921d7f9", "comment": "Malware payload (ValleyRAT)", "value": "043e953a69b7dceffe7e9fd80cfeef9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623934, "uuid": "92a9a1f1-b32c-4e13-b326-3449f27857a0", "comment": "Malware payload (ValleyRAT)", "value": "a665d9abd9d4a28112503ba9aab17ea492ba0f2741607cdfd446521e4bf9fb22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623934, "uuid": "9035fbe1-92df-45ef-aa53-c3adff32f280", "comment": "Malware payload (ValleyRAT)", "value": "b411441d74dea499495926655b6a981793beb111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623934, "uuid": "3df80529-ca58-464b-9435-ff4252c2d6a6", "comment": "Malware payload (ValleyRAT)", "value": "49637579814561f7581acf8682f8e08938e3f2a8f87bd4b7f2892c9d36d74021c6a362eba0aef0d870f76f472350bf15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623934, "uuid": "641a38ec-5400-4b06-b292-7891babd4b92", "value": "T13933E73B53E98054F2AB92B56E79717658BBF47C50B4B20E0321CD2D2B22E395ED432D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623934, "uuid": "8b92d3b6-9ac1-40e7-98ba-6074f417e536", "value": "a66ac84db6116999f6cded522d9f3b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623934, "uuid": "a1ad0b46-e7c9-48d2-9927-84bec3d55e88", "value": "768:YPWZ6PRcrS+DR/4a1eTity7oe7lur0EDYr3Rlm/pZ+1OZJz:YgHuyRAgH07oaEDYDbm/pZ+1OZJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623934, "uuid": "77396f70-e4f1-475a-8070-bd7d49c269dd", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623934, "uuid": "8db78c7b-2b79-4028-8f31-463580833a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623934, "uuid": "92ad14d2-c793-458d-8152-6e2e567ccb6f", "value": "043e953a69b7dceffe7e9fd80cfeef9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3f9bfb-60a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780637644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637644, "uuid": "f88ef205-e490-43ce-b125-ebff15b1ed65", "comment": "Malware payload", "value": "a1be04749eefed9ce5853845ffa8f198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637644, "uuid": "12618831-479a-4a02-af8b-0f679405f889", "comment": "Malware payload", "value": "a6830477f4782309c46e70dbec61a14cca0ac7d36ce5fa50fb9bd68c1f23b2eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637644, "uuid": "27e85c1b-bea7-405a-aa0f-1e555ffef8e2", "comment": "Malware payload", "value": "19badc73b7b7119e235a64c5aeed49232e49e87b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637644, "uuid": "30b6f4db-985e-4050-aa14-403948933db2", "comment": "Malware payload", "value": "c69820486030dcda6266c86f19e1d9c2824f500c9693802f373bb48fb91609eda01f519ad952e07b6b47880c75d91d5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637644, "uuid": "32637452-2856-4d56-a61f-f06aa722d874", "value": "T1D0F1B40BE7AE09EED862C5BAB5D3A233B6717C084336097B5F148B634C63B50E938745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637644, "uuid": "229352ac-6489-44c6-b775-8ad5a6886460", "value": "ed5a8301e3137255f0ae0f357bd0be74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637644, "uuid": "5408eb57-31d6-44c1-8f9a-d91a655daa63", "value": "96:rpIOGCaJU0CGey8STvtjhIm0McVewEXE8e9SeDDf5PFj3JlAOJd1+:6CaUbGPtjAEU8BMlPFj3JlAOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637644, "uuid": "62b567a7-4ada-4675-af3d-33c900f0a822", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637644, "uuid": "085ea1c1-b27b-4e59-9960-9d29e9c16835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637644, "uuid": "83af0a21-7491-4081-8fd5-ff5e3c6fd9a5", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df535fec-60b8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780648256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648256, "uuid": "3113c34f-af23-45da-8468-109fd80b7a9b", "comment": "Malware payload (AgentTesla)", "value": "7e40cac59b0b156fb98d64df147ffcbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648256, "uuid": "05421503-d3c1-4878-973c-2f4bc1d6cbea", "comment": "Malware payload (AgentTesla)", "value": "a703a4f518add7d4a816050208c3f448ec6a9787932521bbb3c6b234d97c5635", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648256, "uuid": "44b8bb02-f334-450d-930a-4b8f32df1a05", "comment": "Malware payload (AgentTesla)", "value": "66892b176d8b0e58c1f337f86350b0c878b7250f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648256, "uuid": "98fc6727-bdc9-4a28-9338-aadde2a59396", "comment": "Malware payload (AgentTesla)", "value": "ebfd9517401974579e4f37eefdd1dbd5bd6ca2ce64395314017e1bb199da19de3e9cd64dd6ddadde75798c6ac1503e37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648256, "uuid": "0bc78e1d-b974-42a1-95f0-e8e4a5992a8c", "value": "T19B34F1017590CC27EA9BAE309461A6675E76FD2A251F73631311AF283CB03F65A7F305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648256, "uuid": "b2868738-aaf9-46d4-90a1-a7f21855fa9f", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648256, "uuid": "4ab668d4-258a-4ce0-b1f2-8437b5f02105", "value": "6144:jfL+oq7oRI+OBXjf2psw0Y16+JYPv5p7IN0nsRau/:jfLzRJ4TepAY1snzVnsRau/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648256, "uuid": "9b20f03d-f904-430d-a535-761f98de4a20", "value": 247696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648256, "uuid": "ac059ff2-7849-4b47-95bc-e3977fca6bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648256, "uuid": "b7f1c1b0-7454-4c52-987a-73642fa8538e", "value": "Purchase Order PO-2606-14750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4e5ab8-60e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780666127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666127, "uuid": "01c57ad0-a2df-40e7-b76b-1942a26329a2", "comment": "Malware payload (Gafgyt)", "value": "19e206d8c93a8a67983c74e3d1021781", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666127, "uuid": "97d801de-962b-42d7-8901-8e0cb9fcc11b", "comment": "Malware payload (Gafgyt)", "value": "a77fbe4323b4ea439a6ee5de75f779da6a15e9085e9f78bb8931718d2ca25af5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666127, "uuid": "b38657e8-5f6b-41ac-b42a-d30c8c11e0a1", "comment": "Malware payload (Gafgyt)", "value": "6b2931bc6f4304e4b0c1c00ebcac58c68f02cf98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666127, "uuid": "e021da52-4f13-48e3-abf4-6502ae30e004", "comment": "Malware payload (Gafgyt)", "value": "e53771acd6454f5dd0491fca5e9f709736f0bb83699727b4b0cba3b754577d513ebc220bb06bb8cb621655ca1ae91611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666127, "uuid": "7f4730f5-4485-4b8c-be8a-51966c39e334", "value": "T147C39517BB618FB7D81FDE3305AA8902108DE58A12D96F6BB2B4C52CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666127, "uuid": "206ce23f-54df-4407-b59e-317064ba0e19", "value": "1536:/RHeTECAms/Y8Zm3lKYA43gMJwSkJ8EpIyDzUh8rmW+IFB1Df11hR/:/R5LqAmgMJM8EmyDw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666127, "uuid": "d1ef7739-5bdc-41ae-a616-6ff9c4b71b10", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666127, "uuid": "e0991e91-f8b8-4d98-bb09-ec7d27724a35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666127, "uuid": "a63f14af-5eaf-4058-a972-dc6e51c44e19", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf4e5bc-6117-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780688945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688945, "uuid": "ae72b6e2-51f9-4909-b072-0f8996808485", "comment": "Malware payload (ACRStealer)", "value": "4bf34c99ed0c98c7459ee732f2fb8fff", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "pw-4992", "colour": "#A1F276", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688945, "uuid": "cf179e1d-d467-40fc-94c0-3a93df4716cf", "comment": "Malware payload (ACRStealer)", "value": "a7ce057d245221282fde6951dac52b12c890b7cc3dfd9d63e28252c6a59b76c6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "pw-4992", "colour": "#A1F276", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688945, "uuid": "e2313ea0-e6ec-46c1-b792-4b0f7bfb395b", "comment": "Malware payload (ACRStealer)", "value": "c540d4c4ba6cbc0f56aa8695bac7c687733dcb28", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "pw-4992", "colour": "#A1F276", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688945, "uuid": "8e742451-35eb-4a85-82c9-41fdf96bb483", "comment": "Malware payload (ACRStealer)", "value": "f2a6bdbffaa4d484c4942e6527f6f190323d41d65b0c8c031081d7c09623764d68a9c77b6c393ee5bb9497064c1a5de3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "pw-4992", "colour": "#A1F276", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688945, "uuid": "81409dc9-03ac-420f-840d-30d40275f612", "value": "T140173381213649F738C2FF30C96BEA75B1D11E956AA593C2FB5613478B3F192C41CB8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688945, "uuid": "2e48ced9-1a1d-42cd-b373-9351b53db9c0", "value": "393216:3VUg0+wnGKlP3zKvS8TxxEZQ6l2b2jO5W1G/61TTGU5fccK88u:FmHnzzb8c2u26jOq4sD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780688945, "uuid": "a5945c1f-26c3-4321-8ac9-2b946a4bc8d8", "value": 19061491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780688945, "uuid": "32941524-2f47-48a1-9abf-ae26e5dac0f7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688945, "uuid": "da3e5658-2550-400d-8ff0-415f7535c588", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79ecb61-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681770, "uuid": "0ba726df-edd0-4e2f-bb43-a50faeaff62f", "comment": "Malware payload (Cosmu)", "value": "f88df7dd7a20362befbe8db05337a422", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681770, "uuid": "15cd1420-b769-482a-9033-98a7b39a6845", "comment": "Malware payload (Cosmu)", "value": "a8246d38f9838ed42ce52254a6296cd4ec54796db75f2e6d52b461691a4c2b46", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681770, "uuid": "badcde8e-a94e-41a4-9236-1c78c1dc10c8", "comment": "Malware payload (Cosmu)", "value": "4bd55c497178e8551fcc759d784d82c9eb1996d7", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681770, "uuid": "5ddcb574-809d-4c9c-81ca-ecf057eab7b1", "comment": "Malware payload (Cosmu)", "value": "47c64a00458cc8496fee56907c1d5489e938f13d602e4ae3774ec742fde7942a69db4e1b85a5df3971c66cf9fa059049", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681770, "uuid": "5fabcbfa-5676-415c-b210-9fd07958fa61", "value": "T10B24F1553C93C4B3D041497289E58BD18B7F6D03BAE2E15BFF9D0A474FB12884BA72A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681770, "uuid": "da2715dd-ed34-4ef0-89e0-820c15afc373", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681770, "uuid": "67672c02-295f-46c9-ae12-0e55a786771e", "value": "3072:UQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBEJ:N9lKgzelZNQSBQGH/CSpWqTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681770, "uuid": "a557e668-5004-4abc-9ed8-4311c5ff5447", "value": 221185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681770, "uuid": "cc064276-73e0-4de3-81f9-69c0fd1d83c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681770, "uuid": "38d19e85-fd32-4266-be88-3fbe49d2df8b", "value": "appletviewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595e675b-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648460, "uuid": "bb471ad8-a5e6-4c8a-b41a-f78330543872", "comment": "Malware payload", "value": "47c2d308c1ed5c7491b2e9533134a633", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648460, "uuid": "119c2cc7-68c5-4ab7-8b9b-f5cc8dd06eaa", "comment": "Malware payload", "value": "a99feb9a298832af411c06c751f7ad6206c1fa66f9ea858c2adf58d66006b53b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648460, "uuid": "4ea0240b-e510-48cc-8ed1-b8b4a0b919e7", "comment": "Malware payload", "value": "fcec76c8049c685fcd8b2826c59eb749e2751baa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648460, "uuid": "a73e4b6e-379e-4232-8e97-c977f71699e3", "comment": "Malware payload", "value": "32685f4832a3a0c69d7c7580ba46e8cddfddde1570b24ff212cd98967961839deb218ec12e4511c3143011d2594d137c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648460, "uuid": "c469c8aa-bdb5-4189-af6e-cfaeadd53a15", "value": "T130D2DF34C4C82FBDEEAA2A1D06FA6620D7D68B1E9498860637037D9B4F37C80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648460, "uuid": "306e5d44-8ae9-4fb8-965a-8871446dac01", "value": "768:fumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:fu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648460, "uuid": "b2409224-88d8-4c70-8acb-cb00d8f22b47", "value": 28658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648460, "uuid": "df203247-c044-428a-8c46-28f3a1f6b5d0", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648460, "uuid": "02a2c097-deb2-4aba-91be-85b50b13b289", "value": "23.94.110.24_1780648385224020_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30286bd2-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667289, "uuid": "f2100869-196d-40bd-819e-95ac2da8fa27", "comment": "Malware payload (Mirai)", "value": "c6514898d2d432aa22625f9ed261b6d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667289, "uuid": "98d9cd0c-542b-4016-9abc-d394735f8f8e", "comment": "Malware payload (Mirai)", "value": "a9b3ebac6c62e54be314020a5a73b215a2f4d9668eddf7f0dc0ea7c652d39b4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667289, "uuid": "612a7285-9d4c-492c-bbd4-1d9decad9865", "comment": "Malware payload (Mirai)", "value": "4487d4417bb48d7e79409ae70ab87fb97c2c4e63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667289, "uuid": "f147a2ce-2479-48a8-9dd4-47e34b93ec2b", "comment": "Malware payload (Mirai)", "value": "3925596a106d3bbd34059a585a68ffd30bbada93844c0739d64e0a8a8d66426e0537e2dfda6ae70d415534d649fe78f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667289, "uuid": "b8d30b73-67c6-4247-84cc-4702a046ea01", "value": "T1AB839D52CC745DA8F03A2D3420B58AFA4B23B544A91B2DF77C4682255017EDCF5ABBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667289, "uuid": "f8972886-e634-4777-a4cf-033ca57d01e7", "value": "1536:mGdu42URZv33uFRfrrtMDmobDvyq95OtWecQoh7goMCst4F/D:mGduZURZfwRfrr2mAvD9mEMoMN+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667289, "uuid": "ad361a47-ff0e-4cc4-9134-daba9a283439", "value": 88556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667289, "uuid": "ac8d02bf-dd09-4634-a2a8-59b3d24d0ff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667289, "uuid": "908f58a2-1a1f-4061-beac-b7d00ca3a87b", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ec99c0-609d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780636342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636342, "uuid": "5e80604f-7a85-46ea-8ac0-7f038b856f4d", "comment": "Malware payload", "value": "cdceda0eb64da7dd2ad76125d9db8fac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636342, "uuid": "1e80280c-62c8-4546-b2f1-7b2e7ab791f4", "comment": "Malware payload", "value": "a9d41a6aec4a745cdd729a094d042958f7a682b90b06dddafa9e24c8cdf1f3a6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636342, "uuid": "4a52fbc4-529e-4417-b894-d798223b45ae", "comment": "Malware payload", "value": "5aed51fba229f872bef18fd43632cee9e48ab7a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636342, "uuid": "19c7a404-6531-434a-adac-2ee7c38c7a85", "comment": "Malware payload", "value": "4e16dd9c641ec6564e39f31d0afbe3f362662bfb7243e16ae8e4d639bb9ec536d0b75c5165558cf5f2433ea33e854ddb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636342, "uuid": "08346196-c6eb-4694-8aaa-b34b4721e3fe", "value": "T1B301C2DFC005D62040D6F4AD26D75544F830C3CB2646CFBABE6C983E9BB964870A5FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636342, "uuid": "439c2a8d-ea67-4885-ac6a-de170c556d7a", "value": "24:kXCKysE2hi0ziQvZohalfMmahne+1H0dX:e9Qp+MslfMmaJHH0dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636342, "uuid": "26374ae8-20a7-4c47-92ea-1c404028e102", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636342, "uuid": "e0dd4b3e-2260-444b-a3ac-0c133c2d2f8e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636342, "uuid": "c2a52541-ce05-466e-bf59-3de63f0536b5", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ba4d58-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780638813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638813, "uuid": "ee56e53a-107d-4e01-9175-5b3617f6beea", "comment": "Malware payload (Mirai)", "value": "cba9e2be751faa6ea956d612314b4323", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638813, "uuid": "dcc77a4e-2121-472d-8399-f4cb08a86fff", "comment": "Malware payload (Mirai)", "value": "aab64d03bf58874d37fbf8c07d003885a8dc3a75b30e623a82918ef13f90de7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638813, "uuid": "f1ca528b-7fa4-43a5-a10a-c6afcdef11ce", "comment": "Malware payload (Mirai)", "value": "32d431335b0bc9cf0b18d51f21455d2215caaf9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638813, "uuid": "e56ffe09-1bc2-48b0-b7fa-60db77ca97ec", "comment": "Malware payload (Mirai)", "value": "3255593ef808f1a8d241a878742e62c46ca769f28e05456a155eb9f08a06c7e5ae131ede03bd5c797a0200f168fc8f48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638813, "uuid": "f2910a4a-f12b-42f3-8960-01b316f20478", "value": "T1E8B3E834E41C4B1AC2D322FAE7589A4F7E221FEB53EA31118B34FA9057F26D71664D24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638813, "uuid": "d0b15bc9-676a-46dd-815a-e9cb62d0af31", "value": "1536:jBn9BroUhU4RDM7CAch2aU7IICNdRizrT8kJ58CdxctY0jqj:DmeUiUDch2aU9rT8Ajk1jqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638813, "uuid": "25c1fffa-2697-4bf8-a431-4a479ff0db60", "value": 116508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638813, "uuid": "e1eb12ec-867d-4192-98c7-f82d918abb7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638813, "uuid": "7965216a-c249-4f55-b336-39b2ed533f4c", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f89ad5-6105-11f1-a769-42010a9c0008", "comment": "Malware payload (Koceg)", "timestamp": 1780681046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681046, "uuid": "3d1bdd11-bd77-4737-bce1-018abcc228e9", "comment": "Malware payload (Koceg)", "value": "527ebe34c66323a3270eb139dbcc6945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681046, "uuid": "ffcd7bad-8503-4aff-bc4b-43b5294240c8", "comment": "Malware payload (Koceg)", "value": "aba87dda94089ec8a6724b27eb8d06ddd81661e0a67fd17bddc561b27211f5a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681046, "uuid": "1781646c-cd81-4640-be34-50cd0c82e501", "comment": "Malware payload (Koceg)", "value": "23f37f90acebd713478df24048b2c06b35e46aaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681046, "uuid": "1baacf63-678c-421c-9225-a3a7ecb9bb90", "comment": "Malware payload (Koceg)", "value": "68e5bd8ecb2152984c5b0337cda7f210a9ea76135eebc963eecddd123b0cbd185537040193512623fd7bf310755948f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681046, "uuid": "39f4f152-627d-4f1b-8ec9-072693be1ae6", "value": "T1DCC4238413A6CEC5F18731701BE31AF52F62257B85A99F4017B99FE247A75CA88C10BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681046, "uuid": "f8850410-6866-480f-9abc-bfe7741e1b89", "value": "08b656407b8d307979dc72c3fcc683a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681046, "uuid": "67907258-b3b5-46b6-9012-35742e82156d", "value": "6144:ACZlWG0GN7xOz2x23dNs4U1JOhtpWhkPWPbGvOJ/Q7r:ACCs5xOKx2Nhfpn+jGDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681046, "uuid": "176404d0-fc65-4c99-b218-504ff49f5d72", "value": 549911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681046, "uuid": "d9de47d1-fc0f-411f-85a5-4f956c26ac7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681046, "uuid": "af3b1c94-c919-4f3a-82d1-ebb13aba5e38", "value": "autorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb60e1a3-6107-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780682206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682206, "uuid": "52d40ce8-b277-4e3e-ae69-f990fd9a717d", "comment": "Malware payload", "value": "c9e2924c9222d5f1ffacaccfe8522466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682206, "uuid": "aef63369-e961-4b83-86d9-adef1275bc77", "comment": "Malware payload", "value": "acdca4322e3238a29f7ce73e0f00c2dd789ea96b7366a4fb98c3ac07c27c651d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682206, "uuid": "62d48e4f-05de-4bc4-a604-55d38738564f", "comment": "Malware payload", "value": "a3608a6782c805470e97e2b835d862d69425e436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682206, "uuid": "d5ecaf80-9673-436f-a8d4-10efc29e2056", "comment": "Malware payload", "value": "7d8afaea757b6ce41600a7c659090531b57d2cf1bb716242e819b80bf19ceb612b2d4382c74c10eaca41f8507398adce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682206, "uuid": "10d41901-2b82-4480-b15e-7ef2152375c0", "value": "T16E34E1443DB3C873E0414A3589B64AD1AB7F6C5775B2D01FFF680B4B1FB12888AA6365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682206, "uuid": "3d5ed020-f0bc-4c0a-a49e-1dd3e7726a7b", "value": "b6096454c0b0666c7e487d2e3e0cbf92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682206, "uuid": "452602b7-74e0-43df-aef6-7fa4dcad1b5d", "value": "3072:EmyvMnbtGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB3Rt6f:uzlKgzelZNQSBQGH/CSpWqTfmQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682206, "uuid": "87489e2c-6229-48b3-b0c9-ff75794053d4", "value": 245761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682206, "uuid": "d364f304-b20f-47ea-a250-f76b4bf07301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682206, "uuid": "fdeff87f-6840-4bd4-9784-7ea9eaa6878c", "value": "jabswitch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f54362d-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780623909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623909, "uuid": "e531112f-0936-411f-8f04-ef35ede73f90", "comment": "Malware payload (NanoCore)", "value": "01a6f657cb150197666007466f36e429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623909, "uuid": "22c1f274-9191-48e5-99da-56568392e40c", "comment": "Malware payload (NanoCore)", "value": "ada828ad50eb7aa49ac8eadf9bef72313b302091decaebbf3f24e6b10174e5dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623909, "uuid": "ce38960d-3d8a-4c41-a3dd-56fc38e32553", "comment": "Malware payload (NanoCore)", "value": "d99573914c33c1d8b74ab31c4a53d919cf575e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623909, "uuid": "d6e0e041-330c-4ff6-9df0-02fdc3f85de3", "comment": "Malware payload (NanoCore)", "value": "17be78ed33e4dcaa46d857106a68e90a6234ba4add68d1e90c5ae78205ad1e983b61614a31928adc51b89120284a8d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623909, "uuid": "2cddac22-3db7-45c4-a477-bc82a9329003", "value": "T1A604122A737C1A02D2CF96F461B337BA8A76F709EA63CF59A5CC723A191730745041E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623909, "uuid": "49f5663d-4459-4cdc-b192-d409b26b5305", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623909, "uuid": "2b7973b8-fb61-4883-a010-2e9655d099ed", "value": "3072:Pk3StqvoQzAZmrcOWFFOLqvoguk++bfp4JaXfZRAGgKZnpCiLLE0X9z:PQtsZmwTHvnXf3XbXZnfJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623909, "uuid": "55f43788-99b4-47c8-9714-dd6b01a8ced1", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623909, "uuid": "251aaaf9-5493-4f41-b650-03e8bdd1f407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623909, "uuid": "3f470304-5083-4bfe-a956-41dd0c0c90f2", "value": "01a6f657cb150197666007466f36e429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533ddd5c-6105-11f1-a769-42010a9c0008", "comment": "Malware payload (Koceg)", "timestamp": 1780681092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681092, "uuid": "73e2ab4d-c32d-46e0-bac1-9ecb08a43c8b", "comment": "Malware payload (Koceg)", "value": "2dc93c9f7f07aac6b9ad9edea51e49bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681092, "uuid": "fb31776c-02b0-4ffa-9bda-c05d09ac9219", "comment": "Malware payload (Koceg)", "value": "ae9c8b5fbdf178a5628ebf9b310f15d52b4e83ef7d13930dbf34ce25ca92a864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681092, "uuid": "3ce4109a-5eb9-4367-b2e1-a4c431ab1cb4", "comment": "Malware payload (Koceg)", "value": "32b60d67b2f6cd88300330c6ff22f8933663e1a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681092, "uuid": "c02e82c7-d95c-4fdb-93b3-966a507f4007", "comment": "Malware payload (Koceg)", "value": "54f05f720ae33410e239703115b8107d1ed7928fe0689e38ede97106d0ea62847128b1c709df0b6f8369ca8e1e4a3259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681092, "uuid": "796e144f-904f-4bff-998d-bbc730fb9dba", "value": "T106B42304178BCFC9E51272B11FC32BF46C36167A84798B9A03EAAFD25B738D94891497", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681092, "uuid": "c4fccf74-dd64-41a0-a6d8-e83e26264c89", "value": "08b656407b8d307979dc72c3fcc683a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681092, "uuid": "0c433f0a-dc3e-4916-b7d8-c500dba93ec9", "value": "6144:ACZlWG0GN7xOz2x23dNs4U1JOhtpWhkPTu88geJ:ACCs5xOKx2Nhfpnbu88J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681092, "uuid": "2860e78b-5609-41e2-8781-78e52940ce50", "value": 525334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681092, "uuid": "f8891243-e191-479f-8177-ced4e831a446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681092, "uuid": "394b2573-5635-486f-955c-27cf696a296a", "value": "autorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9723d464-6106-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780681635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681635, "uuid": "126ca721-8444-469c-9667-2403c3eee4f3", "comment": "Malware payload", "value": "548e28199b99c800f4c8b8bf051d2ea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681635, "uuid": "8e235dff-75ce-4176-9bd4-b6cf0a1ef920", "comment": "Malware payload", "value": "aea879a0689d4f0510d63043570474978bf51013a2d5b5d9154ec1238d8b2da5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681635, "uuid": "b0549d7c-8989-4f3f-981a-bcccb309d196", "comment": "Malware payload", "value": "ce2a4ec814aa1224b6270bc592cd292b8d298681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681635, "uuid": "67053b06-4ab0-47dd-9355-19a8e0f15047", "comment": "Malware payload", "value": "8f79cf64d54e2dab2da35f5f6c52e5e621f00ddf76e261d116c9aad15df310625b75c2b786b29d2ce5f596c0d66d8027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681635, "uuid": "49b3df8b-4508-4fcf-95b4-b5afaeaab56f", "value": "T185F7B316B7468E8EF0769274549B4F50E332D9B14BB0933723B9676C1FEE34C8EA2254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681635, "uuid": "0ac7c30e-ac91-49cd-9f65-93095013e995", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681635, "uuid": "94d7ac2a-3df1-4b91-b3ee-ac815ea36eb6", "value": "98304:ud4lWxRyAVH2v9LCaQysL8kxEVvJDGrfQVTuQ2dCdWkwAru3fpuGtTYAnpAqu8nW:udZxRyl9t3nkSVvJDJTn2R1cUTpAiZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681635, "uuid": "417e8d37-5104-415a-b10e-def8aa0b4189", "value": 71675904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681635, "uuid": "b5aac86f-b25a-42c0-8ab8-09fec9f5cbbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681635, "uuid": "1f5874af-8d8e-434d-a360-a50efbc670fe", "value": "ainst86235862001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda1aa86-611d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780691659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691659, "uuid": "d806f6f8-bb94-4614-b007-27ff2ffac47c", "comment": "Malware payload", "value": "4dd292e7d0d58aaf8ef6aa32ec05b0dd", "object_relation": "md5", "Tag": [ { "name": "212-34-155-18", "colour": "#734DD0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mdprzinwo-xyz", "colour": "#A158F0", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691659, "uuid": "c6a192f2-36c9-4d05-b9bb-3822ff1ed7f5", "comment": "Malware payload", "value": "af4f0c2c79e9de42d53954841c48094e3c37e1c89265eb7d33b027761d4bcf56", "object_relation": "sha256", "Tag": [ { "name": "212-34-155-18", "colour": "#734DD0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mdprzinwo-xyz", "colour": "#A158F0", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691659, "uuid": "c2a2cf98-23e4-405b-b825-07e9dc44b99a", "comment": "Malware payload", "value": "8daea1e3716754cdceed3fede8d4f9962c27c519", "object_relation": "sha1", "Tag": [ { "name": "212-34-155-18", "colour": "#734DD0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mdprzinwo-xyz", "colour": "#A158F0", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691659, "uuid": "a6091ddf-197f-43f0-89f9-dd377325bdfc", "comment": "Malware payload", "value": "00974aa90f35e1c869cec4b09a5fdd11748f6e4b399559d0991f4c3ec3cc584a03fa6358a1915d21093a73df6dbfcb3d", "object_relation": "sha3-384", "Tag": [ { "name": "212-34-155-18", "colour": "#734DD0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mdprzinwo-xyz", "colour": "#A158F0", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691659, "uuid": "4dd2b747-dacb-4f17-aa78-ddfda6151a9e", "value": "T138F66CA7B2907A95DFCD17FF8E18BFDC12EF8632054BA18C513A97D25613A2A8F0C541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691659, "uuid": "c0458679-0271-4dd6-9f34-ff72107f0be7", "value": "d68e24f6a8c98a6900eeb4c13dabbaed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691659, "uuid": "48c7cac3-c202-4d59-b961-080fed67233a", "value": "24576:a00jXxZlUDUf2RK37f1iMaRJH93N7ZT8XqYspmLmwLujERUqrPhVHc4aSVOCEoUF:iNUedGJH99WXqnw4IvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780691659, "uuid": "1cfa91a6-67cf-40a4-9f0c-95ca0afe1bda", "value": 16690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780691659, "uuid": "80199853-2735-44d6-a192-5e276d67a297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691659, "uuid": "5757736f-cb53-4860-920d-5ef4147ef71d", "value": "jquery.min.js.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fb1537-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780642381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642381, "uuid": "f2c0e688-697f-447a-a9e8-aeb324d6b269", "comment": "Malware payload (AsyncRAT)", "value": "ec3eb6e3b3d6300e1c2734f3f732c4f8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642381, "uuid": "838e96d4-40cf-421c-b0c0-b04ce6bdbc01", "comment": "Malware payload (AsyncRAT)", "value": "af680b0ac96bd5bbdf2d9f8d67c9ba54e90d139f1c93143ef75e7f8f3b97d1da", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642381, "uuid": "9eec169f-0c81-4964-8cec-64b0db5a1e8d", "comment": "Malware payload (AsyncRAT)", "value": "e24e3f53b3d65bf80dcfd9b856b84d3db52a66c7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642381, "uuid": "16bb9ec4-9bc0-4e7f-a112-f03838bd1d35", "comment": "Malware payload (AsyncRAT)", "value": "c1e9e60b54e269b8284825a591e9cf51e3b5f1220007b32297ff0666663b3774a3d19c2714f0dd989b703d560d6185fd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642381, "uuid": "e72a0959-18a5-421c-9ac7-f8a34a3c36d7", "value": "T135F4016A0927C602E4A56F705DB4E2B46BB66EAFF135D02E5ECE0C6BBB633147D01350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642381, "uuid": "8d59d04a-30d9-42d0-b8f3-ce52c3a1a5ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642381, "uuid": "84f56407-666f-4e78-86fb-d3727c566d79", "value": "12288:udtkwq+PV1twMCBCkk6Qt6+4vU9/GbIFgWHIn65yZbzJmRhqtalRjudF:s+wq+djwxBCkpb+yEO8qZ65yZbVEMQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642381, "uuid": "92fd69c6-710e-494d-af6e-c6a045b6a1fc", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642381, "uuid": "eddf30b4-4fac-49c2-8b52-728a68363765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642381, "uuid": "d48fef5d-efe2-418d-8c46-3a9910f48fb1", "value": "GHXW0987654567800000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63169b73-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780667375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667375, "uuid": "c67f6722-1d73-4b42-9557-26125207b6ae", "comment": "Malware payload (Formbook)", "value": "bbe47adff25ca5ac9cc0a14fbdbe285e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667375, "uuid": "28e54a93-170e-459d-b170-57df514520d1", "comment": "Malware payload (Formbook)", "value": "b00fb63de14d48996d948227f6fc5e044a2d6122e13be8d79382e478405cc769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667375, "uuid": "e63bc5e6-3f97-4f0a-bfec-f7bf84d5ef21", "comment": "Malware payload (Formbook)", "value": "4c55585e7a47c368a29ec969bfceae4d9642b27b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667375, "uuid": "413f75fe-b954-4aa8-9ed4-3bbcd1a698e2", "comment": "Malware payload (Formbook)", "value": "ad818d2ea72982dddb778917e108608395f2b74d087aa3be369d3228e787f10875d905c864d625f3e79410853c69d936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667375, "uuid": "89942eea-fb09-417f-b170-cfc04a3fac16", "value": "T1E345D0101E8A0F84D46F2FB4C123196173F6BC533E76DFDB6EE868A8B9627458E01917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667375, "uuid": "5243618c-ad41-4143-a77d-82c53f4410d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667375, "uuid": "75765541-8d62-4f48-bca2-627107c44cf6", "value": "12288:n/T2jid1ZBIouHQI2isCR4fHKoV4VGuIL8leSz9yy/noQBm07UvIjGM/HedtA5ZI:/Ym2ZHQvlAVW07yyF4AKcedMZGRbkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667375, "uuid": "5abff9cc-7bc6-4b1e-84bd-357025e325db", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667375, "uuid": "16bc6604-416e-4636-8e89-9687f8b8ce78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667375, "uuid": "796757b7-b52b-41a2-ac0c-f9978b589990", "value": "ORDER_SUPPLY_2026.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4ed031-60ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780657512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657512, "uuid": "58788778-1a7c-426d-9b50-82d749a513ca", "comment": "Malware payload (Mirai)", "value": "de52937cef2045be2b9e5a1081ae3c3c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657512, "uuid": "547e3c1e-53a0-4014-889b-d080c2e4ff72", "comment": "Malware payload (Mirai)", "value": "b04abd606343b463c22d3f05cd64e33413d903cc8557abbb5eb19bdccbb631b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657512, "uuid": "b24cec12-9957-4927-a1c8-dc67ead51689", "comment": "Malware payload (Mirai)", "value": "47b0fb22bcbe2fb722f37c169bbd56f030d8efe1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657512, "uuid": "0be5530e-82cf-432e-8089-1b6e573078b8", "comment": "Malware payload (Mirai)", "value": "bd34921b8f68404292ca20f01fa99c7c0e7efd8b3bfb9fa18e609a80a5e36d0213d04fae707c44ac094d38a8b3085ca7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657512, "uuid": "043014d5-2c47-42ae-bfd9-3acb40411482", "value": "T1C7934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657512, "uuid": "092ca703-b9ee-45c4-9de7-5443113a66b1", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JINlS:XGptyz+VJzB7T9/bLUAx9e/SBJOlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657512, "uuid": "13b18896-fccf-4e58-b7b5-8c0d2ba8d215", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657512, "uuid": "6e7c6563-85d0-4211-97fc-1c9c9b3283a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657512, "uuid": "987ed2c7-7c5d-4c58-b132-5e3a86b18bf6", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0676116f-60dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780663354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780663354, "uuid": "64556b9c-db2c-4e29-ae44-daca623a2c27", "comment": "Malware payload", "value": "b89e401bfb55d5278b31e5dd49628c18", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780663354, "uuid": "945855d0-286e-4a66-b742-f531a64d3304", "comment": "Malware payload", "value": "b0cf13898f47bd979435a9c98bcda87bc080f9ce52151b05e94ad6ede767b662", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780663354, "uuid": "cd6153d1-d612-4ef1-b58e-8ce027a5f954", "comment": "Malware payload", "value": "83b3065e571b2964e1aea671ef4a0566a3eb1959", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780663354, "uuid": "ea4674df-a34c-48e8-b0e7-de4dbbd87bd7", "comment": "Malware payload", "value": "2fe93de21edba652a29f2810bd6f115b41687a5457bcc17bb19c403eb5149d7376ff2776778dc2027f71bc066d096360", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780663354, "uuid": "2879bd98-36c9-4d60-b7f1-454f6cf85a11", "value": "T102C59E02F55160BAD4D9E6318566E181326138180F363BE37F95BABA1EF77C04F397A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780663354, "uuid": "67f8d174-add8-4be2-bd5c-6a2d2510c3bb", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780663354, "uuid": "d25bf19d-2ad8-4e81-899f-56b6493e862c", "value": "49152:cdN3Brb/TYvO90dL3BmAFd4A64nsfJniZY7cN2N5FgOLe+2xMKhNyxB3iLQ8QkjF:83J7LNyMlmskJPeNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780663354, "uuid": "4e6b6378-79f1-4629-91c5-eb9b8aeb2e26", "value": 2708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780663354, "uuid": "7b3ad41e-4c34-4566-b093-45d8042eaa60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780663354, "uuid": "ab42dfe7-df0d-40b8-8980-ff226183be69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdadef31-610d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780684733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780684733, "uuid": "ac3e700d-069c-4283-9137-b6e4c64653f6", "comment": "Malware payload", "value": "8cff72eb3c3ed85d70c6d289593cb8de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780684733, "uuid": "037ca352-756e-40e9-b353-8b9d608eb15b", "comment": "Malware payload", "value": "b170c7bfa4c4436198e8d310ab3dda818a08f27a5d2bef86ae8150683bc5108b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780684733, "uuid": "3303f73d-00f6-4ccb-aba9-166ffdc653a8", "comment": "Malware payload", "value": "d3f38c69245f997fb8db8146da77edba8d104bc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780684733, "uuid": "fd07ac4a-2361-4f5b-8206-4a897fae4c59", "comment": "Malware payload", "value": "a50de730866e24a78a7a64e57f7466589085bbba0bcb39a5612bf23b8234a26fac20bfeecb9a0d9ae2c67b6166bb86ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780684733, "uuid": "8b63b2db-f8cf-424d-bf1d-85dae9dc8a25", "value": "T1D637CF77814338E9E5A98DB4D41025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780684733, "uuid": "6f2ec5d2-f416-4b9b-b49e-47c52aebed71", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQl:cqYUQuVDt0TZEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780684733, "uuid": "45da98a3-89fe-40ee-9ac8-b94d4bd48174", "value": 22511616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780684733, "uuid": "542952d9-fd27-492b-88f8-c832399eb27f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780684733, "uuid": "ff18a1e2-916d-440b-9975-2ea5b96cb757", "value": "b170c7bfa4c4436198e8d310ab3dda818a08f27a5d2bef86ae8150683bc5108b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62cf3f4-607e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780623249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623249, "uuid": "de9b6b67-5054-448b-b766-ba61cfe1161e", "comment": "Malware payload", "value": "5a84dc4188f8b8524f4afe1cdf4e65c3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623249, "uuid": "5e696453-b751-41f9-9814-4df7edbab1b5", "comment": "Malware payload", "value": "b194bda80cbf22851e4f395adc6e6d6d956e60f2422d89e36748c53b64c6268b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623249, "uuid": "507a3030-f076-4faa-9ee1-57325dc529a5", "comment": "Malware payload", "value": "211e76d4b58f966f9b530e9af2f9d042e259134d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623249, "uuid": "284d8785-1363-43e6-bd83-4d8baef9566d", "comment": "Malware payload", "value": "99d5b01c6e40c1feb774cda79ad9d77582af0a6f33f3a1be1ed6661540a6972b7ed0ee3fb2c388e71ca1e03025c74c0c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623249, "uuid": "31ac7ded-306b-485d-a5c8-4dc02c8d9a81", "value": "T196F030EE303F70BF0D04FE88A0A58410F210F38A54D0CA00ECEC4DA298A6BAAB118A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623249, "uuid": "bf0e5017-2ccd-4d16-9b87-25d0171e80b1", "value": "6:h4E3FN8c0hZSwgNW0IQZNFN+NNI70jvGrF6GjNCa00nLKCI75ZXNbNu0abnVn:KE1N8pZSpN+UXNKNIsIjN3LKHnNIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623249, "uuid": "d977c267-178f-4889-a77c-b63b58152211", "value": 441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623249, "uuid": "0fbcf652-8acc-42c1-9b36-f0006994ac0f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623249, "uuid": "68ba4d21-2b36-4fcc-a250-99160ae3e464", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c03808-60ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780657504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657504, "uuid": "7eea0a1f-c277-4690-bfb4-3290090c30d6", "comment": "Malware payload (Mirai)", "value": "a08d1273c0c26d82c87978bfc5539ba9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657504, "uuid": "bb5bda9c-529e-4991-8ecd-8ade91626e6a", "comment": "Malware payload (Mirai)", "value": "b2554f471f7fd0fbe10b3369c0213b7c2bfaecafbd453f3c220560170cda5b2a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657504, "uuid": "7fd4270b-45ec-42a0-8390-045a9f71cf26", "comment": "Malware payload (Mirai)", "value": "021e7f8fe552a41aad4c7f6fc3f0b4a78a3e8793", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657504, "uuid": "63de76e1-1f10-480e-9ef5-f97db032c954", "comment": "Malware payload (Mirai)", "value": "2d199a5a95c50c5230f88e82d7eed781de762a6944f00740bd8010f1b556dce4a559fe0f59d1ab172694423b1743ed32", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657504, "uuid": "612354bc-fdb8-449c-ae20-d3ad7374a655", "value": "T1B2B33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657504, "uuid": "ae50c348-68a0-47d7-ab4c-49af91350c37", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJS:4azwz102cPPaRl+AS97JS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657504, "uuid": "2752d40f-5444-4a6c-b857-23c55dcec45c", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657504, "uuid": "cfe97d16-39eb-47f2-abd1-53374e4a3d86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657504, "uuid": "fd95e980-ff94-4615-b2f5-428aa554f933", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc73883-60ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780671607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671607, "uuid": "d61744c3-af1f-4cf4-a4a0-786fdb57060e", "comment": "Malware payload", "value": "6444ed7654103f310f553b02bf514dbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671607, "uuid": "82b85365-57b5-4dd0-99df-fb97de14551b", "comment": "Malware payload", "value": "b2744110bd720e03946cd501c5be9df6f01e25ceb6c2501341f3c971f2932d6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671607, "uuid": "abfb22e5-3afc-4dc2-973e-df82da1d4f0d", "comment": "Malware payload", "value": "9506328ead9d98250a514dadb28d69b0bf853f4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671607, "uuid": "ca0cacfb-8ecf-4181-bc51-1eac8dff54fb", "comment": "Malware payload", "value": "17909bec0f4b0c090d9cbaa7d02638687054704c745e673a824ed5ce512eab8ebf834878713f867014f2ab170ea4bc24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780671607, "uuid": "d8ed1182-8d36-4f12-ae6e-7afbaae9bc5b", "value": "T129D1954063F8862AE9FB4F386CF313161A75BE015D72D64D1C98424FAC32B248E61BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780671607, "uuid": "4a6b9eab-01f3-4cc4-8efe-236c30e7a0dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780671607, "uuid": "d60669d9-00b6-48ef-83e2-b993bb2b5463", "value": "96:TZnRletEvWIXRVffu3K+TVw790jZlmfZwtC+n8drxMsEdNC:pXMeW6VffYpVW98Zwfe8dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780671607, "uuid": "15363cfd-3879-4ae0-9585-d866e48c267f", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780671607, "uuid": "ca1b7486-9a6f-4091-a5ae-bdd1ce0d89fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780671607, "uuid": "9057ce23-bdc3-4a07-9424-615173a7a682", "value": "rFernandaAnt__niaMelissaApar__cio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19e5f96-60ed-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1780670969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670969, "uuid": "f441f412-e35f-4842-a65b-f6f3ef19270d", "comment": "Malware payload (Gh0stRAT)", "value": "aa15622af649888eb60ca86bdaaaf24a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670969, "uuid": "391dac9e-c54e-458c-9966-ccadd73309d8", "comment": "Malware payload (Gh0stRAT)", "value": "b29f131d9bcc54b1bed5287c18ed3b8b0ac78933dca14c14a0eded4eb91df2db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670969, "uuid": "839b924c-d02e-4f5f-898c-f79dbe6fd76a", "comment": "Malware payload (Gh0stRAT)", "value": "69bc8cfaefbf4e6160fc848db6cfb9a039342abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780670969, "uuid": "907bc840-616a-401f-8bfd-27a1c05037ed", "comment": "Malware payload (Gh0stRAT)", "value": "ca1590c13e65379518a0e0ffa931a8168c59e5711ecc6f5e3f561fa9dbc25ee33e645c6e29e2592c380f4fad56c2358f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780670969, "uuid": "f7ea875f-14fb-4013-86d1-9822d195bcf6", "value": "T190C73316B68B107FE42A4E3E1CB3D512063BAF25E9124D9752E82C9CCE374D12D3F696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780670969, "uuid": "f0d3896d-3ba5-46d8-a4bb-e49b5b69cf6b", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780670969, "uuid": "77324cc6-08f4-4d5e-afb0-cb6fdcfef803", "value": "786432:v8n0bFWVUr/t7VzKCXSnYpm7EbYrp8uJ5ieTSbNd/oOPsSk1+Ipl8fbf6PdxpSoF:0n0bFVr/t7ZKCinrlT5ieTSwnS+q0Rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780670969, "uuid": "6b3e7ef6-b02c-4335-852a-b5a4841288d7", "value": 53711916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780670969, "uuid": "9d1ade95-5868-4e14-be54-f2d1b9c4d274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780670969, "uuid": "f559c4bf-2c88-44be-bbe7-61ee4a65388e", "value": "tsetup-x64.6.7.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7f64cb-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649509, "uuid": "68cf82f3-7792-41bc-a6cf-bd0b1e8a865c", "comment": "Malware payload", "value": "4ef98d1003b11e04bd2b27f4fb8808f2", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649509, "uuid": "f44abe71-7021-430d-88bd-f86b13672406", "comment": "Malware payload", "value": "b2c8f8ad30b80fe62ac0aab1acd00d87b76fcb56aacc85d402c5ee1b55c0427d", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649509, "uuid": "2db2f5cf-5e23-4a62-a800-fa18bc35fec4", "comment": "Malware payload", "value": "2a469056bd94dec62ad6478da0ff0606dd83d32c", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649509, "uuid": "31fe33e6-65ce-4768-a064-3e98644a3d56", "comment": "Malware payload", "value": "e4ecc0003a208fac254225ac707488e8b0a6f1531bc2dd5f4fbe06d37dd7ab5b494c5b4bd78b66e56609e71ae83c9a0f", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649509, "uuid": "dc975388-bc72-46f6-9cd8-aa4844120e92", "value": "T18672BEACD046C5E88E610E7E63526619E534E3856F3D9320E3AD3A037D74F5A7E260F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649509, "uuid": "9ac17d5f-871a-4019-bc51-4ce91c7b2ce3", "value": "384:j1fJ5QWPRk3OLVcoFumDyBRqEdx/8JVqeFr24ky:BfJ5Dk0u8yBRdoJ4GC4ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649509, "uuid": "40a358de-acfd-4d97-ac95-a3613194360b", "value": 16385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649509, "uuid": "1e0ef65d-302b-435e-8914-14b9c6330ade", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649509, "uuid": "6fd73ddf-7ac4-4242-98a6-7865d278e920", "value": "photo-109685732.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd85c06-60eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780669995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669995, "uuid": "97084143-64ca-40dc-bf6a-64ced17b852c", "comment": "Malware payload", "value": "2d775dfa11bad196145c41eb640586aa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669995, "uuid": "06269265-d431-4166-bd75-21c20ea7c7f5", "comment": "Malware payload", "value": "b3d0e183b918042d369ca54f2186339e38c87d4969a16a8b92a7986c4b99be2a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669995, "uuid": "45b26c20-8557-4ff0-9f90-3753973dff01", "comment": "Malware payload", "value": "f689ba2bba09cba225143698f7bbcbfa00afaab9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669995, "uuid": "73454808-2e2c-489f-b292-1e3dbb8c0765", "comment": "Malware payload", "value": "b0aa23e2fcefba00ca7896ca4ac1202273a30452f603fd4982bb55b40958841ae174e65e30ef11c26657b024f929a8df", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669995, "uuid": "80367c4f-850d-4773-a42f-ac96bc1c8837", "value": "T15A136D6526953C25AE99883B5C7F2F0CB9A983E2304491DDBFCA3CF18C15A9CE71871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669995, "uuid": "05244177-7872-4c4a-96e2-21b8577057d6", "value": "768:0Jr9NyXsZztCf9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:uHusZRco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780669995, "uuid": "7b92083e-b704-465f-a328-551350276c16", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780669995, "uuid": "8a908fc0-9d15-499c-9a77-6701c1588a91", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669995, "uuid": "21b25d64-130f-4f41-acbe-12f40961303d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cc4a1d-60b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780645185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645185, "uuid": "0ca01ea3-e448-421c-8442-e25b47f7088e", "comment": "Malware payload", "value": "d48afc56572ba1b0147c5e053b811955", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645185, "uuid": "81710810-9012-4243-a0d1-fcd3f78ac2ea", "comment": "Malware payload", "value": "b44016ca88547899186f335c10a4558fa56f0b2599ec1304bdee250c5504f6cf", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645185, "uuid": "5c5511e5-9763-49f3-be2b-9cde401a06de", "comment": "Malware payload", "value": "11effde6efb25e8706a404d87a37ee2872f56a71", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645185, "uuid": "74ee7985-94dd-4ba4-a7d3-5baf81e4d546", "comment": "Malware payload", "value": "af0e1953bab7959981eaea49400f2431318374c655f52d6b212fb966e496c2ccbbcf9006267e95809e2e01f9c965bee8", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645185, "uuid": "ed873e22-21b6-48a5-beeb-501d48180730", "value": "T10575F5A94E1B38C8986568D2C252B1425FB5063F6D3DC8437B613E41A62F31EDBCDA4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645185, "uuid": "1b221207-89e3-4609-8719-4c76f7d6783b", "value": "12288:EUSO91/ewQX9Ulw2dbw6t5mAIXDqhLbt0juUziBKrrsSUjDCI7ZrTAUGwYGjq1uE:L7/mXWDwT+Xc/Zm9v1nIxiC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780645185, "uuid": "c090c178-679a-4178-afa4-b50eb7497337", "value": 1618911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780645185, "uuid": "98998b05-4f2c-44e1-ab52-d1228a65d93a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645185, "uuid": "b828c7bd-39d9-4af6-a68b-377c0abf92b2", "value": "b44016ca88547899186f335c10a4558fa56f0b2599ec1304bdee250c5504f6cf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171b49de-609f-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780637182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637182, "uuid": "47689070-ce3e-41ea-904a-f3b5bcdcf276", "comment": "Malware payload (Prometei)", "value": "449633cd5ba6fe0ab0635bb8027acc89", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637182, "uuid": "23487f09-eabc-4d17-abc6-f706033e1bb0", "comment": "Malware payload (Prometei)", "value": "b524ca7cbafab904d0090fa29ebb79941c65ec1c42011aa234cc33f6d47cfdbe", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637182, "uuid": "f846f60c-3c7a-4a28-945d-b38e549574d5", "comment": "Malware payload (Prometei)", "value": "e32341cfb0aa624c444ddc823c14f0fc329c6965", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637182, "uuid": "8a21ad40-00a2-4bf6-8453-b9ad3446ffd3", "comment": "Malware payload (Prometei)", "value": "2d5e80fa6b8ccd4647cab1770d43704b44ee43f66fdc230704173fe3d286b737ee98b9f68b403f8ad11529d37c485e56", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637182, "uuid": "83b3ef14-8983-41cf-8ee5-5fba70a1b169", "value": "T1D031A4CA32F10A70ADA0A927726EC80070E6F5CB19CA5FD87CDD39F6418DF497001AA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637182, "uuid": "ba5367cf-1244-41d8-a310-f20ba4d66f55", "value": "12:q0FgsV0Fg20FXc43fX0FCneekX0Fstk0Fs7Cd0FkaX0FaK1FZ0FkuGEX0Fgm0Fjr:vgs+gjXc4kCnasMwzsaK++EsgTCJlG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637182, "uuid": "92cdf963-83f8-40b5-80c0-f66c4b71f38d", "value": 1646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637182, "uuid": "7fdab27b-61e2-4c86-93a3-b0ceac3143d8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637182, "uuid": "20225c0d-2535-4d9f-be49-a57d818cbdea", "value": "b524ca7cbafab904d0090fa29ebb79941c65ec1c42011aa234cc33f6d47cfdbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c2f40e-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648458, "uuid": "38e9eda4-ecd5-4226-8f21-0026e0749a5b", "comment": "Malware payload", "value": "0cde69fe9ea4b827be0382caf50a9411", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648458, "uuid": "a1dbb626-ed6f-4c7e-aefc-9bc6b3b3ff14", "comment": "Malware payload", "value": "b5470f6aea7a1504ef4ac1b2bbd90a4fa3e9ce6189aa208128fa82dbfc397fd8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648458, "uuid": "bd49f7fd-a3b0-41d2-bbdc-e6e0dddbdf19", "comment": "Malware payload", "value": "8d7ba182b7d77d3b62530cc8e8406efa09b6d174", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648458, "uuid": "b3a27cf5-7bc4-4a2a-b3ab-17df2cc2cb5a", "comment": "Malware payload", "value": "d5afe5d75ac6bb046e564c9f927b3ca19b599a25d1dc6f01dec93253db99183daef9e182f3398e9e176c84647da5784f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648458, "uuid": "d4fcd48c-7f4c-4383-8c9d-8ca61af93000", "value": "T1D4D2DF34C4D82FBDEEAA2A1C06FA6620D7D68B1E9498860637477D9B4F37D80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648458, "uuid": "c4b6ca95-20c0-4c17-9ede-0036df0e3279", "value": "768:GumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Gu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648458, "uuid": "3ee19cac-90c3-45fe-a706-0b2df8cd1765", "value": 28662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648458, "uuid": "4d4f0f8b-626e-4861-8f82-6795ac2b92c1", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648458, "uuid": "30c56946-36bf-42df-8b5c-cddd744b3302", "value": "23.94.110.24_1780648382994235_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216d4fa0-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780641924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641924, "uuid": "d9d55a00-29db-4ee6-af68-36d26bca55f5", "comment": "Malware payload", "value": "772d0494e571dd1dc7128288ee3939d4", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641924, "uuid": "4a871298-f79c-4c6d-860f-53b785d8c7a0", "comment": "Malware payload", "value": "b5bdc4b6740c98e23619809ca39dbad8c9b08ce2e4571ad96222af620fc123fb", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641924, "uuid": "46c6e0d8-0b14-4657-99fa-3f81897ad1c1", "comment": "Malware payload", "value": "00c87c2ba3c15b5d507e92606a07a154deb34ffe", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641924, "uuid": "fc6691db-51ba-40b1-ab14-8340abf987ff", "comment": "Malware payload", "value": "b4703f0f86e4df6a1850ad81e110fd6f7c1936d98e6e8f4f65d1d46bfcfc92426606bd62722b466b1a45964c23f30017", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641924, "uuid": "8c33a3a3-abe9-47d5-86f8-e3771d77f2b4", "value": "T1D1E73382877F50B7CA12FD20607967ADD69202DCFC70DEFBF326936461F62C606960A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641924, "uuid": "6e063b9c-9ea3-4bab-ac9d-fc5799d72e3f", "value": "1572864:Ix2zKwP276MITBRprYkwP6gxJ0CtbNo42fPuzH3ZXTn/r3pkiJjl:g2zP2TIfprYk26gxztbNo42fWzXZjmIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641924, "uuid": "37f58f3d-8c95-4bf7-b626-bf5849602318", "value": 69564844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641924, "uuid": "4477e27f-63c3-473c-b426-71145b48d495", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641924, "uuid": "1835a3fe-5e9c-4fe6-a184-c4c44e6c3626", "value": "b5bdc4b6740c98e23619809ca39dbad8c9b08ce2e4571ad96222af620fc123fb.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730d3d8a-60ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780657523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657523, "uuid": "4c127ff9-90d8-407d-8e88-98b747499889", "comment": "Malware payload (Gafgyt)", "value": "ea4e85e35d0a051c1b7e317111e082d0", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657523, "uuid": "e4d26e3d-f9d6-4809-8c46-8d6597fa9b9c", "comment": "Malware payload (Gafgyt)", "value": "b5eec555aa0e07b1af33a0ec195a3fb195e1543339d22305fffbfa7e6a7b4381", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657523, "uuid": "b2e2e95c-779f-4b1c-97ae-1cba74df42a8", "comment": "Malware payload (Gafgyt)", "value": "ed46c62595dfe74fb43def201f347aabcf4b5620", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657523, "uuid": "e910340e-ff81-4274-8f8a-ef596ab60bbd", "comment": "Malware payload (Gafgyt)", "value": "9ab7ca39a96acb42c59eadbd0e33bcbe6a357ca8cac3603f7b5535366e99de0e1d08d0dddc8bd307ffedfaf598a75e1d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657523, "uuid": "29c48258-1907-4074-87bf-6499ed2f0ac3", "value": "T13B412BD710924BF36CA5D83732798480B5D1919694CA6F0AAEDC3CE58CBFDECA844786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657523, "uuid": "7f3c5b70-ce54-4246-aa6a-1e569262de9e", "value": "48:vp/d8jpCttQdMppYpyRpm7pDT6pnCpJIpAL1pC5NpJIpwxpZT:v9d8jsttQdMbYkR47RT6BCzIGBs5NzIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657523, "uuid": "21e9b051-d0e9-40ff-8d35-fab70839b508", "value": 2111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657523, "uuid": "c6de8b8f-8e64-490b-b00e-50354beedf3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657523, "uuid": "e3e337a8-f739-4a43-a1cb-8a4c91e7f75e", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d78a36a-60ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780671338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671338, "uuid": "c4d6f210-ca10-4836-8524-2ac754e83d4b", "comment": "Malware payload (Mirai)", "value": "44343b16991cf5028765ff0f18a90227", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671338, "uuid": "94ab9b46-ffbf-4aad-84f8-a3461a37a83c", "comment": "Malware payload (Mirai)", "value": "b66d9187bd6a23e5e886692a07e7154b0a18861b1d99ee6536239e65ad3eaf86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671338, "uuid": "80f48ab5-7226-4a34-8b57-e9d9ffb537cf", "comment": "Malware payload (Mirai)", "value": "b88f038e3ce08ae296622723b05cd0912285262a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671338, "uuid": "146eec84-12b0-4b3d-98b0-7c78e95885ae", "comment": "Malware payload (Mirai)", "value": "63f30a8818f52b80858de988f0ebc9102036c8e65deb9569800c3c4ad7d4c8ac12145af1d03bb2130384fd2cd14b53bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780671338, "uuid": "faad5597-2a24-439f-93dc-d3afec4ad2e4", "value": "T1FBB31A89FC818B11D5D526BAFE0E518D33534BB8E3FA7113CE145B2E678A86B0E37511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780671338, "uuid": "297ebecf-cd7c-49c3-a321-150afac2b8d2", "value": "3072:QHWRAv7+crKG41E+Fv/RYKrk79EL5Vv6CfNUQCHpyDI62Sw:Ji4ldRYd79IiCfNUQcpyDyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780671338, "uuid": "435b8cbe-d8d8-4906-9534-6ac5767909fe", "value": 116508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780671338, "uuid": "7f4cd3ac-cd54-4217-be52-07c457726dc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780671338, "uuid": "206ec9f5-4ca3-4ab7-87cf-fc0c938be63b", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033e8d0e-60e4-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780666784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666784, "uuid": "966b4b75-8e90-45fd-9160-4202b7765895", "comment": "Malware payload (ConnectWise)", "value": "632608734cf71e61828bb21fe20b337a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666784, "uuid": "eaa0191c-0d52-4bca-b80d-963db3965e73", "comment": "Malware payload (ConnectWise)", "value": "b7e412482ff1cf95bf48553d5e4cf09db454b1c9afd8781d26e8ac4397a9f2fb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666784, "uuid": "5d8ab5c3-ca9d-4ea9-9965-c5e08b045a97", "comment": "Malware payload (ConnectWise)", "value": "8f7695771b3b1272e044fee4bb790d4342da6179", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666784, "uuid": "d0e48667-84ea-4929-9aa5-15b284078852", "comment": "Malware payload (ConnectWise)", "value": "b826fb4497b44d88349b928c1be91a4a933ca7252a3f83d063ef85e2c2fc9cb35c0339798be890de4e11caa47072b06a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666784, "uuid": "70085727-da7a-42e9-ae8b-3bc72cc64a73", "value": "T1DB46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666784, "uuid": "824e7d41-301f-459d-a1b7-909bc7c05f21", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666784, "uuid": "70b56067-1ea3-42a9-82d6-798e8f21f295", "value": "98304:PzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:PhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666784, "uuid": "97f2107a-b210-4661-8f73-ec451ed0c774", "value": 5642968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666784, "uuid": "a5449f1c-8487-4616-8a89-92f1828bd9b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666784, "uuid": "d11b2bb8-78a3-42d9-bbbf-8941b305184f", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb998c6-60a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780637866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637866, "uuid": "31016ee4-65ea-4642-bf77-98134fe01d7b", "comment": "Malware payload (Mirai)", "value": "ae29dc808428e046c94be75ee9a21298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637866, "uuid": "21ab51a2-1183-40cd-aba3-30a8c98a709e", "comment": "Malware payload (Mirai)", "value": "b82702e81eb89974e79af5a2b208f27b5da51dc17053e5f27721a013383aa0ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637866, "uuid": "c65f273f-3e02-4271-b6c2-aaacc02bf7de", "comment": "Malware payload (Mirai)", "value": "d2b172ad3028ed5df04c74c2b6ff3f282ecde8e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637866, "uuid": "d4f39170-621d-46ba-b83a-c8dbee7cad7b", "comment": "Malware payload (Mirai)", "value": "bc17a14fc0cab5deff3973d39280ffa7bef7ba822c8d5e2ec1224e4c3b4c984d9c5315776134e3178c9a62f338561a21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637866, "uuid": "ac92f8dd-2ea2-45a3-9cc6-f98be2ff5fec", "value": "T133E32A72D81D9F76C012E0F0A1B99E350F126DD30E5B1AD86635F6A0457B8CBB14AFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637866, "uuid": "c7b58454-4c96-42bc-be6f-9a6a3460124b", "value": "1536:vpVSqldRZryElUJsp+dxdXhxHACCKZNZPBZQ5ZHzzWviP9G+S3a/:vzTlRWARpYjXhxg8Z7Q5RzWa1ZS3a/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637866, "uuid": "b8bd4a96-9c6c-42ad-88f3-6f7f17081c00", "value": 155672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637866, "uuid": "4d8c51d5-ee87-4892-95a5-f266e7752ab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637866, "uuid": "f22e140a-5a78-4d7b-be4b-feb145c8235c", "value": "b82702e81eb89974e79af5a2b208f27b5da51dc17053e5f27721a013383aa0ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adaa04c-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780636893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636893, "uuid": "8a0b1e64-85f9-4ab4-8108-2bfc4f8ee0b7", "comment": "Malware payload (Mirai)", "value": "30e559202c220fac37a9196327115527", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636893, "uuid": "58ac07ed-73c6-4464-9735-ee9486b47820", "comment": "Malware payload (Mirai)", "value": "b847130751c20bd5f4c6e4309d928dcee7620d4dc94bcdbc46c03bbc17543edb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636893, "uuid": "cf63811d-4e0e-4d34-80ed-136bc9c82bc7", "comment": "Malware payload (Mirai)", "value": "493e92dc669cba7386cf2c8aea22f3c12129ce7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636893, "uuid": "508d5c84-4fca-4735-9b8f-c8d761d6f756", "comment": "Malware payload (Mirai)", "value": "f1cbab60744029ca3ac2d8fbd403e9e5bb1b96b687367a0b8ef063c069db8f0e5a4f22595e5c58759a4c04a73d1a45e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636893, "uuid": "02af2011-fb92-4fab-8540-2aa37458ec92", "value": "T153143D5377224F90D365D6720BB38F565AEB01822EE298D5936CCB103A207D9689FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636893, "uuid": "3446aa1e-99ce-4f97-b550-f49e55a3180d", "value": "3072:1KDKjIzgnPUH4vZUlN6odRdyHVz36J+AdrEYOB4uDliP9MpfH:gDKU8PU4ClAo/M1z3s/dAcukP9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636893, "uuid": "387098ef-8d67-4aa9-b763-64bc4ea0f070", "value": 196672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636893, "uuid": "f38a1c28-f17f-41bf-80ec-cf3afa9e224b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636893, "uuid": "b744e4ec-4d7c-4764-9e1c-c6df3f38da49", "value": "data_mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5420cb-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780641912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641912, "uuid": "c4f1e7a4-dd2c-40e4-89eb-af03969e5c9c", "comment": "Malware payload", "value": "2fdc3d5cae341a38e0bd93abb5f2913a", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641912, "uuid": "0f52aa0f-9c2b-4565-9a85-8deedaa09be2", "comment": "Malware payload", "value": "b9d86b503482e6f2d3c0925734a950d985aa26d30ffde2defa5ea29077b0d4e5", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641912, "uuid": "c3b247b7-90b0-415f-84fb-8eb013efbdf0", "comment": "Malware payload", "value": "efb42e49b0826de5657ea006d7d69834801a9eb3", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641912, "uuid": "10004c2f-3d2a-4b19-ad26-45e4e8b32108", "comment": "Malware payload", "value": "56563448a50d1c895eece4d4216aedfb6b32d59c5495d02c9676b59f4135a9930265862e228618c80aa38018b432e926", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641912, "uuid": "93611df1-8440-4617-870f-fdf18f867c36", "value": "T1A227CEC4F364F548E7450570582976A409B62D303750ECAABE8B7AD269782E6EDF0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641912, "uuid": "b980f95a-9b13-4210-a1dd-1ddbee4ce7f9", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641912, "uuid": "210449c6-6108-4c0b-8218-db6e3fd8e973", "value": "393216:eJFXmhjx1n2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlkL:eJF2hjzK2OGfEhP0JqHOG8qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641912, "uuid": "838f6491-ecb9-487b-8fed-599b3a3458e2", "value": 21284018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641912, "uuid": "79f79be1-f413-4082-b273-51732667d994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641912, "uuid": "2d777dc3-859a-44b0-9537-d230a35290ec", "value": "b9d86b503482e6f2d3c0925734a950d985aa26d30ffde2defa5ea29077b0d4e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997fd668-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780638690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638690, "uuid": "65ceaded-5bd8-41b2-95c9-ff06ee35c9fa", "comment": "Malware payload (Mirai)", "value": "3f6dd5c05de15c6e1574abb733dd3753", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638690, "uuid": "e3b3c499-af44-434b-9c4a-72cefcc05f6d", "comment": "Malware payload (Mirai)", "value": "b9f773d7b0318d62c42764c84c27d7618b9268117cb2d8b85f084d3dab4d33f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638690, "uuid": "7dac6f25-3582-4dda-bc9f-16c8ce13f255", "comment": "Malware payload (Mirai)", "value": "3bd0a78d356f4437c913dd9fb1067f192d5bd51b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638690, "uuid": "a1b8b401-14f7-456d-9be0-710367f3f067", "comment": "Malware payload (Mirai)", "value": "da0bede91b9a79d5f8b3762df3021f7ca54511345dc80825ff421b471d3e18c3aedf72b348245a5b02d3d803a5d8d8f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638690, "uuid": "4c46311b-c94b-4a06-b8f3-35e84af4ed48", "value": "T1E0D3F934E4584B1AC2E322FAE75D964E7E231FEB93E630118B34FB5017F2A970665D24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638690, "uuid": "ac6ff776-4b16-4ad3-ad3d-5b3c323651de", "value": "1536:kZnGdmD/5uPaW5yYJFaqQBqC60SN2l/yOmiyPkvtyK4EuFY7UQ6Ljig:riu7cYJFaqQBqC7qPkv4vzF3Q6Ljig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638690, "uuid": "e35cc9e8-2363-44a4-be7c-9d18c2b2e344", "value": 130484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638690, "uuid": "ed187ae1-5eb7-44e3-86ae-fa498ab3c198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638690, "uuid": "bcbae247-bb13-4ab9-89da-9304d7109149", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311be49c-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780623912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623912, "uuid": "8f70f3b5-d576-4bb3-9de8-7044ff3c2760", "comment": "Malware payload (QuasarRAT)", "value": "7dbf1cd5241dd382d74ce86edd1f5950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623912, "uuid": "4cda13b0-6dea-4e88-a6b0-3e634c376f7d", "comment": "Malware payload (QuasarRAT)", "value": "ba8d38575e15f2a8a3c819d3f2e189acdf9249c99240236c8be4f96d7284530d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623912, "uuid": "b90f05f7-ea1b-4e3d-87ac-6fac738d4500", "comment": "Malware payload (QuasarRAT)", "value": "acbd14848a8421926f585b37cdffa70a6e4b9e95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623912, "uuid": "afb672d6-5654-4b24-b5c0-0e7ff06a87ad", "comment": "Malware payload (QuasarRAT)", "value": "a23efd256b8e887dd4586d7931c59ea4d3e29d5579c5269944eb19ff74175bab11ec93acfef1fa1af05a7e64339082ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623912, "uuid": "e68b0aa9-6874-4dc8-a079-001928c93aa9", "value": "T1F464455D4F6845C0CA4CAA388ED2DE1A637E1E73AC46D755AC183FC17632F4C2AA3356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623912, "uuid": "2190e2ce-12dc-4377-9d90-5dabdaa9947b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623912, "uuid": "4bf97659-1597-4136-b17c-5189478e6838", "value": "6144:adnzzkMHitAUXObRVAhQ6qOLayreVZUFQnmgn6aha3lkMMeNUFoEWOMscig8hnlL:SnzzkMCtAUXObRVAh8TYiTo8hnlgAZ6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623912, "uuid": "4bab7808-ad25-4e4d-88c3-071584e23378", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623912, "uuid": "d53f228e-8806-4df6-b54c-bb166e87ae8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623912, "uuid": "091143c8-4748-4d25-b97e-c4ee975423ac", "value": "Valosysinfo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732a15cd-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780667402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667402, "uuid": "d9123df4-69d8-4ae3-8199-7d13686759e2", "comment": "Malware payload (Formbook)", "value": "26dccc9a6cd39a9c1428194db3b2fad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667402, "uuid": "7ded37c7-5d9a-4dd4-bbe3-e0df139b9488", "comment": "Malware payload (Formbook)", "value": "bd1b6a05dbbb3958e921538acbd2765e3035cc63ef3e476c09805e20f8f9a1a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667402, "uuid": "f211e671-ace0-4d8b-8bcc-3c68407dd20e", "comment": "Malware payload (Formbook)", "value": "653d7ab22d08de136311157f5b3c07bd428f4bb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667402, "uuid": "4ddafb2e-913f-4866-b19b-ff0c69dc2fb7", "comment": "Malware payload (Formbook)", "value": "81eb7755e8641e44076836e35b6f2e3490fa11606e275cac5c777f0a5889c460d47d5e5985686e92a23077edc869a836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667402, "uuid": "1a17ce81-be38-44e3-a29f-7efba6de7f7d", "value": "T10945E0005E861F84D46F6FB0C176196073FAFC232E76CBDB6EE868A8B966745CE01513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667402, "uuid": "4f28badf-bc1b-4ec4-b91e-28c2daf53a74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667402, "uuid": "d30c117a-5512-4c6c-ac4c-0681fbc31eef", "value": "12288:lKizSbXLZBIouHQI2isCR4fHKoV4VGuIL8leSz9yy/noQBm07UvmjGM/HedtA5Zw:lKSZHQvlAVW07yyF4eKcedMZGR6kD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667402, "uuid": "144ae223-703a-4a74-bac8-3cf7f4bc42bb", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667402, "uuid": "79da27a1-4421-41d5-b7dd-6136209ff88f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667402, "uuid": "11fb8d96-d81b-4205-be8f-080cab99578e", "value": "supply_order.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b379b82c-6118-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780689414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689414, "uuid": "3d71e326-0495-4c19-9d9b-60f00a0c3ac5", "comment": "Malware payload", "value": "3f64d44ac326efc5fd40e987b9632935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689414, "uuid": "c4c0e046-c47a-4f0a-b0b3-92af722e1269", "comment": "Malware payload", "value": "bdf6f9515e41f43e99d29d762d5e8980a8ba7c971e98c2f49fcc6dd28413abf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689414, "uuid": "f176681e-0f24-4bc3-b714-3ac16572bcd4", "comment": "Malware payload", "value": "4d07f1ec7574dbfe7552bf95d1a8b29d5ddef784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689414, "uuid": "581f8047-9ebb-4da3-9eb9-f07c79bbb54c", "comment": "Malware payload", "value": "eb61cdeca75f5be73e04f79eee5ccd27787181f4c74e1d0f0709cd820082579791d0c5ec56de6e2190d10999ed1360b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689414, "uuid": "824c866d-b8d9-4da7-bb00-176319c73989", "value": "T1D5345B29B5540DB9D5BBC1B8CD878802E7327C454371EAEB17D19AA20E17AE1FE3ED01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689414, "uuid": "3cf029f5-4020-4d5e-8bd1-ce09fb18414d", "value": "e359793663a457ca0bbf2d556a288a44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689414, "uuid": "5c6e33ea-e2bb-4cc5-9ad3-1b3e33b8fc0e", "value": "6144:RqGwfe76PZZop+XGyt84TpY8C4EgdMoFxnigXM8DX:QAi2+XGyCCYWEgVnVdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780689414, "uuid": "7def3825-6b03-4a4f-a2a8-6b8eecd2ad26", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780689414, "uuid": "dccb76c4-3019-4835-950c-7aca657c2b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689414, "uuid": "47b69068-6b43-4eb2-a3dd-e50af3b91e93", "value": "Gamma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d10477-607d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780622930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780622930, "uuid": "49a1a1a3-b964-42b4-af56-ed5d0bfeea2d", "comment": "Malware payload", "value": "456b865d8078da1fc182d422f1c0d7b3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780622930, "uuid": "8bb45865-b01e-4ee2-9171-d54be3c10389", "comment": "Malware payload", "value": "bdf75914d858bbf80b69e34b2d85981a904d58a546006e2dce5d6951308c9e93", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780622930, "uuid": "72129b11-f78f-4dee-814e-ed00e9e6e5aa", "comment": "Malware payload", "value": "01953919c289edcd81ba76698a62f96fbbb62912", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780622930, "uuid": "7ff48741-4499-4573-882b-d39e40b7f265", "comment": "Malware payload", "value": "021c512b3bedf724eaf642d68dd5f78f53772e7e3c257730734e89185d20f92fd5e0fc36a38902b7deb692bcd692279c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780622930, "uuid": "ad5fc5ab-191e-4733-a642-eb261650452e", "value": "T14F137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C19B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780622930, "uuid": "b4d3741c-ed37-4382-8234-9f1c89d56d5c", "value": "768:N/+T9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:F+0co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780622930, "uuid": "f68fc463-3145-4f76-b6c3-a1b95675b536", "value": 45525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780622930, "uuid": "ad475b3c-bafd-4e6b-9027-6e03ed0ea86e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780622930, "uuid": "764ae8af-414d-4821-b22b-8fa315016e7f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53197db-6117-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780689068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689068, "uuid": "6be57ab7-961f-4494-ae3d-dd345fec715a", "comment": "Malware payload (RemusStealer)", "value": "0a66c4b8ccd2c84a115de3f3e7150ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "youngel-biz", "colour": "#7BCA82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689068, "uuid": "e2ca7319-2bdf-406a-baea-27173a19f696", "comment": "Malware payload (RemusStealer)", "value": "be11d5551412487117465ca46654aa45ee8ed3e1b273a8978843b87b6bb3f221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "youngel-biz", "colour": "#7BCA82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689068, "uuid": "e00d8a1d-7066-4606-b746-3934603efca2", "comment": "Malware payload (RemusStealer)", "value": "e723f18044c5d9eb64e85ee1e2bdead448cd752f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "youngel-biz", "colour": "#7BCA82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689068, "uuid": "16bd55db-dcd8-4835-8f0e-73b950caaec3", "comment": "Malware payload (RemusStealer)", "value": "d3ab4e606c433ca9b163b94385a829d896c923841f858c464bf93339a5751535eaeaff32eafcf742e495ce806f7391c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "youngel-biz", "colour": "#7BCA82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689068, "uuid": "8ce34019-ea3a-434d-86ec-777c16c59e73", "value": "T112855B42B88064B9C5EAE13145B5E291B7307C490F3527C72F51BBBA2E377D05E3A7A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689068, "uuid": "665cb54c-2b1b-4efe-bbd2-c5c616a4f8f7", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689068, "uuid": "7979c51b-6e4d-4a95-81fa-83aac1fc2329", "value": "49152:bEf3Hrb/TEvO90dL3BmAFd4A64nsfJhPHvNeABgLDYVZkZD18T:Q3aYfvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780689068, "uuid": "2910785e-7851-4ee9-ac10-716f426cd565", "value": 1873024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780689068, "uuid": "de4919ba-cfa1-4331-a9f3-0832fe14de96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689068, "uuid": "c8b33dce-e8f2-449d-b5d5-cf19b7ea69cc", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22512d8-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681654, "uuid": "dbc2f473-a2ad-4011-a91e-d3d1dc037b41", "comment": "Malware payload (Cosmu)", "value": "a3dac6f1f7a750b104ae167066e0729f", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681654, "uuid": "4ada6f60-be3e-488e-9169-114056e144c5", "comment": "Malware payload (Cosmu)", "value": "c0e9b60ad2d1a38bc1192e0d70a49a0e926caaaa7b5440a5a7f5b8626d77a9fc", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681654, "uuid": "118d8af3-fcfd-443a-91d1-c1b849754772", "comment": "Malware payload (Cosmu)", "value": "1b05e938092a1462ce0efc9b6fc06bc639bef7eb", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681654, "uuid": "d5769154-e399-4112-b2f9-45643465ec10", "comment": "Malware payload (Cosmu)", "value": "83e281378336ec3722925d4422342ae1e9d22dae5e430e30b06f303b1e33fe7f7510dbe85c9f865ec3ade1add928019d", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681654, "uuid": "74738be6-2f07-48c3-89d6-feeb4440c497", "value": "T1DE54D0493DB38473F0414D71CAE546D1ABBE6C0375E2E12FEF580A4B1EB029C4AA67B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681654, "uuid": "3a4fdc5e-252d-4cfa-baae-d02e3e0de60b", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681654, "uuid": "88d5f81b-00fd-4868-b833-e510d0189c9f", "value": "3072:fgV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBnr91W:o1XlKgzelZNQSBQGH/CSpWqT6mQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681654, "uuid": "4ab3fcff-7b31-491c-a199-6da8202fe8b7", "value": 295038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681654, "uuid": "33b5bc72-6ae1-4c01-825b-65e4248134d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681654, "uuid": "5cc409ba-3873-45fe-aa69-a6b45feb2791", "value": "AppVShNotify.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead75082-6106-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780681776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681776, "uuid": "4eb101f0-7b33-4e1a-9223-04e161d37552", "comment": "Malware payload", "value": "271646aee1af9eedc9b78bd94ef4673c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681776, "uuid": "8f0cdbfc-a293-4be2-99d9-4a6f584ca14e", "comment": "Malware payload", "value": "c1342578bd29097355959b1df381eaff339813880dcb9920493092b580aa2e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681776, "uuid": "3edc4ea1-3807-415e-b21c-7158fd084c0b", "comment": "Malware payload", "value": "773646b4630a247120cb67e0ee2ee29cc1378e1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681776, "uuid": "b80201e6-d98e-4b07-8589-b039dc164caf", "comment": "Malware payload", "value": "de1cfd8c6a2fc727174e4bbb776e3647094002e5d1feae6d78a80a9cbda3d02abe52cf908b937fa854084536ebbb0037", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681776, "uuid": "bb27f310-82ab-4fab-bfd3-9870c0b6a33e", "value": "T17D34E1443DB3C873E0414A3589B64AD1AB7F6C5779B2D01FFF6C0A4B1FB12888AA2355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681776, "uuid": "f4c685f8-7222-4b3c-a9a2-e4b7319d94e3", "value": "b6096454c0b0666c7e487d2e3e0cbf92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681776, "uuid": "4447294d-dc70-43c6-92c5-fb64b057ea53", "value": "3072:0myvMnbtGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB3Rtp+:ezlKgzelZNQSBQGH/CSpWqTjmQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681776, "uuid": "d9b84137-0bb0-43b8-88c0-027ba47623fe", "value": 245761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681776, "uuid": "53817386-7f38-40f2-9601-c70796e2ffde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681776, "uuid": "aaa3c63c-61ab-47b2-a95a-c1bbbd233eb8", "value": "AppSharingChromeHook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df0d362-60b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780645327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645327, "uuid": "4c49596b-7bba-4d85-a171-da25cb683255", "comment": "Malware payload", "value": "d3482aeba5d974cedb4a997a36784226", "object_relation": "md5", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645327, "uuid": "3d9c0f8d-6a24-459f-992e-c7aa4e569817", "comment": "Malware payload", "value": "c1c3ca45738027a8e2b520157bddf582c3b9b6795447cbe40aac65f1f409797e", "object_relation": "sha256", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645327, "uuid": "43284851-0358-4211-9c7d-ace9168092c9", "comment": "Malware payload", "value": "0f5598901757c4a22c080f7a65261a32eea872d1", "object_relation": "sha1", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645327, "uuid": "1bdc5743-9d1e-4c62-be23-033216934d6c", "comment": "Malware payload", "value": "93a06092d90083daf0ae426e05d3ba3a2e465071220fcdf821628a85d12c2c3e2e1b9fe980e9dea1015b9170efcf32df", "object_relation": "sha3-384", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645327, "uuid": "05ab58c9-d647-4ff9-97cb-1e4473631f6d", "value": "T12A6733A46CA0D473DA7FC23314A90722DB33105BAAB7CD5F64A9A0888DDFC911AF54D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645327, "uuid": "710f1880-0bc1-4772-9b80-4746eb7a7a8b", "value": "786432:fX7LWMFAcA9f+ha6EU09Rfm+I89dE2Rql/E9EIgEmJAwl:fX7LTzA9f+ha/U0y892OqSEJtmwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780645327, "uuid": "a8298f61-c9f9-47dc-b6d8-92abfad2a429", "value": 30067833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780645327, "uuid": "b7653305-0a29-48f6-80ae-1c70387d5019", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645327, "uuid": "886c46c2-cada-4753-a438-a080ba0f1bb3", "value": "c1c3ca45738027a8e2b520157bddf582c3b9b6795447cbe40aac65f1f409797e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98415ae1-6115-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780688080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688080, "uuid": "f7bf3045-dad3-45cd-8dbf-6edfcf59cf9f", "comment": "Malware payload", "value": "6883baf1144e27dd12e93a4aa0ff490e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688080, "uuid": "02bdfb91-9af1-4d31-b6b1-cb27d88fbcea", "comment": "Malware payload", "value": "c23f672216fc75e637c1b6dd66ee9753996d9d5dc123da23151fb99ba9814011", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688080, "uuid": "492d2943-6104-4d9c-884a-310094abacd6", "comment": "Malware payload", "value": "2255e4c02cdd8fbf0767182ec142026b3dcba460", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780688080, "uuid": "e53b0953-bbb6-4a60-abc4-674f8c7629dc", "comment": "Malware payload", "value": "ccec29cb63a14054ccbfb0e550ca3dc0b9b3c657c147d40ea71f9e55126f5f98453faa97de8739513b7ec5201b671418", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688080, "uuid": "1bc20163-34eb-430e-ab62-f87b5bba7d45", "value": "T18F163341BFDCFE30D8E7B7342B046A794D8CECA6075A0497619B7B35443BB9862CA1E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688080, "uuid": "cc38060e-9b67-40ed-b504-d20f4b3d0a41", "value": "98304:eiNRFiGoGV8gQ/vnk2/DEG3hrvzvfO4mWJiGGZt:eiNaGigQ/n/DEGRPHmWJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780688080, "uuid": "2857761a-f9be-4ef7-a663-d3a1159ab3f7", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780688080, "uuid": "47f5e2a4-ba9d-4c5d-a098-f4a1600bdae5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780688080, "uuid": "016f49f9-c965-470a-8b5b-ec21ce9736d9", "value": "ZKMTXIFS.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb42d4c-60e4-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780666804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666804, "uuid": "5007f263-d7a3-4ae4-b860-00ac7e87f10c", "comment": "Malware payload (ConnectWise)", "value": "7d35b9f6e9d46e444d80ebdebe1d08f7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666804, "uuid": "d5cff23c-b542-4a30-af7d-e6a29d8f7b90", "comment": "Malware payload (ConnectWise)", "value": "c2812c4b04421941d9d7910159ee7fd9946dbb182c5b2c24e6ca2f4172a501a8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666804, "uuid": "4a638962-c20c-4a06-b01c-2253b6416997", "comment": "Malware payload (ConnectWise)", "value": "1e82eaff49489cdbff6cc35afd2276ac2f1e5f91", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666804, "uuid": "969ffda8-e956-4889-b0cb-e574f603787c", "comment": "Malware payload (ConnectWise)", "value": "3dac559799c2957d4e29af5aa41507f0a43a313fa66ffc4f3f743ac74f07fce5e39c992a7c811b6e2c4574c904987cf9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666804, "uuid": "4a45c6ff-8c67-4cbd-a798-807e9e959bbb", "value": "T13FD61200B3D995B5D1BF0A38E87D82696635BC044716C6BF5394BA693E32BC09E32773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666804, "uuid": "cd87eddc-f1a2-4baa-9020-7fe5b827dd4b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666804, "uuid": "f0cdebc1-5582-47cd-89ff-ee4aad0c73dd", "value": "196608:SfefPnmXtv0A9JZwXtv0A4Xtv0APXtv0AUXtv0Ax:wtPZet6tjtOtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666804, "uuid": "09472a0b-7b3f-4bc4-97cc-b4dec8f90fd0", "value": 13419344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666804, "uuid": "52e1dfea-3802-488b-8eaa-be94e1e6c123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666804, "uuid": "61379ccf-a3b9-4a36-b33e-9de4000217c6", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9ca0e8-60ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780657514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657514, "uuid": "cfd0e112-1eee-438f-99a9-76033f279a4a", "comment": "Malware payload (Mirai)", "value": "fc4577844282ea1a5fe6db7f3446ed81", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657514, "uuid": "527c2499-0a30-48a6-815b-6cdcab74bb63", "comment": "Malware payload (Mirai)", "value": "c2fa0f3a4b1607c58bebd7cb21faa4d7c7f2162866b6c263c12303c05fef0bae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657514, "uuid": "11b7c39a-2501-4569-88ed-e8196917d01a", "comment": "Malware payload (Mirai)", "value": "4a55d22f21c3451b2ae39932a0c9294b67a60704", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657514, "uuid": "c57f1a06-bf67-4d3c-9548-01371434692c", "comment": "Malware payload (Mirai)", "value": "4596cf6c4a3a7119e84ba1a55e55809aac5d1a2f4fb34dbdf6852bff3d2936308f8d35c5a45b080cb47768b9ffad0dbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657514, "uuid": "e6a4e325-f285-44d8-9909-c81b3a978969", "value": "T1D3933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657514, "uuid": "04b16b49-dd23-4ea3-8198-e84e6b745fe7", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vMbnIh0vAi2k2xPSUUN4J+LjR:KvjLrKGG4syfcIhXiuxpUN48Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657514, "uuid": "4a90bd2d-cf95-498c-9266-1ed750994c3f", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657514, "uuid": "e7b5110d-4918-46f1-baa5-d84bffd88300", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657514, "uuid": "bfed7955-41bd-4ac7-baa3-211175253260", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304a1c3f-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780641520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641520, "uuid": "42d5fae9-4851-4355-a437-8c2b2e8289de", "comment": "Malware payload (Mirai)", "value": "c18600670cf4ac409e23f42369401d69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641520, "uuid": "6c8e70af-b96d-4a5d-8711-0c6625a93ca2", "comment": "Malware payload (Mirai)", "value": "c36009ec06f9ddec8169245089a07f7b69b7e7ec7ea0eef20acd04794e99441c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641520, "uuid": "5a11eb0b-8ad9-49d9-a8fa-e1a7e39c1a96", "comment": "Malware payload (Mirai)", "value": "2cd60ab99ea8e7cc3074f77683bcb9c275e3ddcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641520, "uuid": "88ea2283-8e00-4dcb-855d-3ccee2ca89be", "comment": "Malware payload (Mirai)", "value": "73061a943bac3410c501a6aa102d2e41480df4fb7ce425d5a198b67fed8ae4d08f607bd9a2d8a9c6cfb2294413557e59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641520, "uuid": "052322bc-e30c-43f9-9005-05dba5fae99b", "value": "T1432308C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641520, "uuid": "0b38c709-f437-4d33-892d-f79f745645e9", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AG+1pa/4Qw7bn2ine:Gv4QPfZfW5XTOeoEzG0AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641520, "uuid": "d9ef6d0e-4897-4681-8001-301266532352", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641520, "uuid": "8f84dde6-4eef-4aed-a9ab-5e8beee82fca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641520, "uuid": "01391615-974b-4d57-86e1-86aa3bab0a4f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a53ab3-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642284, "uuid": "368c73d1-b852-4fbc-839f-2be275b591ac", "comment": "Malware payload (RemusStealer)", "value": "ddb39476a40bb64efba7e38cca2ecf12", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642284, "uuid": "86677c44-4bd4-4eca-ba7d-3cd0be76e2ab", "comment": "Malware payload (RemusStealer)", "value": "c373be7fc265a86acea3f1ba5fe2b206aa8aecb988769b27a8af06bd9c2f10a4", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642284, "uuid": "504dea29-745c-4264-8702-f52b6c5d1609", "comment": "Malware payload (RemusStealer)", "value": "b759fb5d9d58095fd7a346c314c3c5621b4b775b", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642284, "uuid": "47dc44a5-4b49-495a-a026-235a40e0f301", "comment": "Malware payload (RemusStealer)", "value": "d67bafc172c1a0efaf6f8b20b3cdbf183c0da279bab7050cd0a3622ef292b9181ea32b8ef8cb7c873ffb757af5950d70", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642284, "uuid": "60012438-bba1-4734-9756-4124c97ee9df", "value": "T1A914386BD25371FCE553C07882667231B732B63907346EF742A2D334AE329D06E78969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642284, "uuid": "92d57c1c-28e4-413d-af1b-3470e119998d", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642284, "uuid": "603301b3-b36b-4740-93b3-7ac8b4c23e2e", "value": "6144:mpFJxVbqzn7nZsdAzjOj2lvF8EIuGKoyqYY:mtxVbqYQlvFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642284, "uuid": "757c238e-6fe3-443b-8d99-30081780006f", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642284, "uuid": "b1a53b14-c3d5-4320-b4cd-9b69565ac9d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642284, "uuid": "5bc51a1c-85a2-42c3-b300-516d7fe4174d", "value": "c373be7fc265a86acea3f1ba5fe2b206aa8aecb988769b27a8af06bd9c2f10a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f17487-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780648614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648614, "uuid": "3fb26f02-4c1e-4467-918f-7dee78d7c7ca", "comment": "Malware payload (MassLogger)", "value": "896b206156da8f60084b7ab9b8b86b97", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648614, "uuid": "dcd470e6-91a6-4a52-96a7-a565a64a4841", "comment": "Malware payload (MassLogger)", "value": "c467f98b65a67517e84843b671fa70ad1cfd15d478fff99934d2b9f0d8372883", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648614, "uuid": "f0d4a860-03ec-43d4-bd7f-857514653fda", "comment": "Malware payload (MassLogger)", "value": "ea897061cf51c2c8c9a9f53360334cfa62c5fb5b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648614, "uuid": "8bfea8b2-7bfe-4ac4-af7b-20c836a428ff", "comment": "Malware payload (MassLogger)", "value": "7a096a7ccda1b796d32d263790655376ecf18d1d0b604c8c28729ed7013b0975d75fc05382ea8842d3be6f6a6c8b7bfe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648614, "uuid": "e8599f9d-5891-497f-ab12-27eb20509b45", "value": "T1C6A521CBFAEE21BD76B135C64B4AA354764085B9CBD3C891EF2E109805C0721397DA7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648614, "uuid": "ae07ea55-6db0-4f25-b5b7-891bf5f0a545", "value": "384:7wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww6:GacUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648614, "uuid": "f876de87-eaaa-45b3-9f9c-36e166260744", "value": 2230205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648614, "uuid": "4b422662-93cc-4e72-93e9-684101e4fc70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648614, "uuid": "bdb51275-ec87-49d1-b959-cfa662a520b1", "value": "PO-2606-02.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6642c0-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667315, "uuid": "7196bd6c-726d-4b10-a1db-04113e1088d0", "comment": "Malware payload (Mirai)", "value": "2e43d40af65c53135efe26b222260e9e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667315, "uuid": "822ffaf3-691a-448f-92cb-625d3b0d55db", "comment": "Malware payload (Mirai)", "value": "c475cf4e7877b792544783d3edeb028882df09ee5363ab7f90ce11e14c41cb26", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667315, "uuid": "1bb1afa5-666b-470b-9438-38cd6785acaa", "comment": "Malware payload (Mirai)", "value": "771735db113c9d012be87898b925e0a2a1d72ab5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667315, "uuid": "71df2917-d945-4b45-bc2d-bc7db4d22261", "comment": "Malware payload (Mirai)", "value": "2d10d66232bf1e73c5ae5f68f0ae988e9d2901e9d722fed5970e3f8b7252974776f3a15df46c8f61f07126e71111fc3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667315, "uuid": "bcdf1a7a-7353-4565-b8bf-e3105c9c49b9", "value": "T1FBE3AF71C4786E99C16196B4F0F0CFBC4B63A55081871E7666E7C9A950C3F9CF20A3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667315, "uuid": "2d8b1210-56c7-4820-a89f-fb98c04fd231", "value": "3072:3Vk4+y6Cx7XLT3Eh43XYf0WHSZZMUra6y/t:3C4+KxrLT3EeXYf0l17y/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667315, "uuid": "97b753b5-ce2b-4ead-b44d-384340749d48", "value": 144976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667315, "uuid": "9fb25cf7-a0a4-4f95-a9a6-cd22947805da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667315, "uuid": "5f094ab0-1fdc-4c11-a910-16e13000534a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3ffb8d-609f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780637193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637193, "uuid": "5353d984-48bb-48e7-9350-158500f605dc", "comment": "Malware payload (Mirai)", "value": "10c44cb3baaf2d5af64d7a4d1e3dd7dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637193, "uuid": "9759841b-c4dc-43c2-bc20-533fbf1b8cdd", "comment": "Malware payload (Mirai)", "value": "c4b7349adb2e8fb25431c7f05dbff02eebe436ae6014d0423869c26969d406bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637193, "uuid": "7872d62f-4657-414b-861b-0325b43be247", "comment": "Malware payload (Mirai)", "value": "b0e26d5ca1e968daa68ad62f8258ee15251d3689", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637193, "uuid": "094c688f-ae89-40d5-a00a-de250550accf", "comment": "Malware payload (Mirai)", "value": "9a311410401d11edaf2b32a2d5e9848fc27fa937b47544d6be9b6c4be7feee983b7ae16b5877f3f6955f9f1eb98b382a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637193, "uuid": "c7fc2515-4a43-4c24-99a7-5713a7936593", "value": "T16EF3E836B589CDBAC45381F017EAED769C21BCFB0935704B27A0FDA15E3ADD11A88E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637193, "uuid": "51d879b6-c0d6-4e4c-91a2-139165ad711c", "value": "3072:1jW0Ae/mSXtNRtgJ6RuiCgA1o9y4RztbbA8s4L29/IH7L12MBSniz:1NRigdbQL9gf1gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637193, "uuid": "82a09b06-3326-4297-b4c5-721d18152a6f", "value": 171096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637193, "uuid": "972b3c4e-f57c-4a14-b42c-0f818a4bfdcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637193, "uuid": "ea19fd9c-98c1-466b-be10-1377d480b975", "value": "c4b7349adb2e8fb25431c7f05dbff02eebe436ae6014d0423869c26969d406bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea2a821-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (MasonRAT)", "timestamp": 1780638457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638457, "uuid": "4d7e3f7a-220c-4653-89d2-02e9963cc4c3", "comment": "Malware payload (MasonRAT)", "value": "a09db9f064e8e2a4ddf55fb157815a74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638457, "uuid": "9fbeca1e-d257-4351-b7dd-c0189e9210d4", "comment": "Malware payload (MasonRAT)", "value": "c55de6de46627616211a73d88908cbf9cd2dc64c12ddc31a1689f9b55f94ef44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638457, "uuid": "9468a32f-2da8-4e13-beb3-39228c24093f", "comment": "Malware payload (MasonRAT)", "value": "86755cd89eede96210d6455de3e68953c7fa5689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638457, "uuid": "23aab422-aa26-43a9-b253-a0701456c8d2", "comment": "Malware payload (MasonRAT)", "value": "edca68cb909140d87e65e5353aa6cca30f5f2d735764911e2bf649f216c4d5c32d9c31ef07c87d45deeb92286ba221e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638457, "uuid": "c2ee3db6-3b82-4a6e-9997-172e7972abf1", "value": "T155241816F35350EDC927C13487ABE237B431BC6A1230AE2A9B94CF763D16E505A7DE18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638457, "uuid": "b488637c-7cdc-4993-9ef5-0cafa5234897", "value": "1cbfc974ffc317a64ee112e5248e30a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638457, "uuid": "49e92814-bc6a-42e0-8722-61a5f41c2e32", "value": "3072:0JrmoCqfYTqc5NJoyzlobtk8jKdYQGUR8F28/ARDTLQWrQOUBk7sqh:0NmpqwTqeX/zD2URkYZLQaUBk75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638457, "uuid": "2ad736a0-d242-47bf-8da7-138fbcd6f9a0", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638457, "uuid": "b8d0e1e2-af74-43a3-b9c2-4c019c3388ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638457, "uuid": "e1c696d4-471b-47f7-8c10-f6b7535f1cc7", "value": "e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5a335d-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681535, "uuid": "0f40564d-6057-40aa-a412-765fd7207ae0", "comment": "Malware payload (Cosmu)", "value": "1bdb1a11c5a812b6031ea267af9fcf3d", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681535, "uuid": "a84640dd-bc2f-4c15-88aa-901e4700453c", "comment": "Malware payload (Cosmu)", "value": "c5837dc167fdf9498d4d9784b9c991d1499123fb336b3414b00a6f0afdae8ac2", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681535, "uuid": "f217b636-51d3-4a6c-a522-8eab2e08181f", "comment": "Malware payload (Cosmu)", "value": "4a8e4df33b8c1b89aaa243759639eeb3f1116d6b", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681535, "uuid": "d32d8629-0d01-48ea-906b-b345603f9d36", "comment": "Malware payload (Cosmu)", "value": "e769e4e6b2c4c7b5f7d3139246660ff7ffaa450b302f768bfac7ede4811f27928f42b742c01405a6e3029b24e0bfb4c0", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681535, "uuid": "0b6390b1-b69b-4d5b-a954-225066aa4786", "value": "T14865F1417EE2D8B3D0429A315CB68BA197377D13AA75D203F79D0B4B2E713849B7A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681535, "uuid": "5955d6f3-85f0-4e23-8da1-e89d5086b0da", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681535, "uuid": "85d26af2-7c49-4bec-b941-648e7e0b33a5", "value": "6144:iFlKgzelZNQSBQGH/CSpWqTUoAXjiU4bz:lfBQGH6Sf4oAX+U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681535, "uuid": "e5f5e45b-f83f-4b37-bd6a-50ab9c687771", "value": 1545755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681535, "uuid": "cdd6acd1-3b6e-4728-84d9-e72d4aa535af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681535, "uuid": "e4901a40-60f2-4f7d-b0f0-19a83a3baa98", "value": "WebInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9950ecae-60b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780647709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780647709, "uuid": "667aafb6-6c1c-48ce-a5d6-73c15b9f1c25", "comment": "Malware payload", "value": "b077401fe3d9642345d4c3deafa60aa5", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PixyNetLoader", "colour": "#1D6394", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780647709, "uuid": "a9f64705-bf39-421c-adb8-a86176aa3690", "comment": "Malware payload", "value": "c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PixyNetLoader", "colour": "#1D6394", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780647709, "uuid": "65ca4a4d-fa68-42c6-9236-ca06cbe996a2", "comment": "Malware payload", "value": "e457641615b548c315913fac7e8255519e50687f", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PixyNetLoader", "colour": "#1D6394", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780647709, "uuid": "37f9696c-d77c-4b4f-952d-75bf095cfd09", "comment": "Malware payload", "value": "a7cdf874ade3f4a6e104159200b4f266ce12954628656c237b07e06832159745fbd2b633a0277dd164eda6673a984ba9", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PixyNetLoader", "colour": "#1D6394", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780647709, "uuid": "a388a08f-196e-4b82-a23c-bc1f6541db64", "value": "T1BF346C0977A60CF5DDB7813D88530606F6B2B8610760DBFF07A086665F2B7E0A93EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780647709, "uuid": "26665062-0a2e-4118-bc68-a1c08c2fc100", "value": "40cc119b5dd0bab3e102eaf63c9d82f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780647709, "uuid": "6f3e5b23-3499-4cb4-8393-e802d360b785", "value": "6144:AJmDjDSHLICQj7/3hDoJJvmyLcPohnKp:xDjDSHsZ3fhcJePow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780647709, "uuid": "1d6bf527-1d35-4327-b283-10a8e6c85e29", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780647709, "uuid": "f757ca3a-a56c-4f1c-b813-615df7d7cd62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780647709, "uuid": "373e062a-5f1d-403d-9873-993705ae4119", "value": "EdgeSyncPr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40bafe3c-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667317, "uuid": "4ba87e81-c5bf-4183-9c54-ddc3f01a94c4", "comment": "Malware payload (Mirai)", "value": "63a8f2871a988e01d3e409550ba47e6a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667317, "uuid": "06a0ab5f-f246-479e-9e05-805cf7cf8df8", "comment": "Malware payload (Mirai)", "value": "c6f88f2467f3c799f7400c6b62ce0024ef2245eff4caa495f0419a2ead50cfdb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667317, "uuid": "eed74589-8df3-4042-b729-74e0ca199b07", "comment": "Malware payload (Mirai)", "value": "7316fbf16e6a4314ceec0ff013a371518486ec6f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667317, "uuid": "d1c9d86b-c661-4867-b6c8-ed2315e8c59d", "comment": "Malware payload (Mirai)", "value": "c25931b8aa54ecddf7a45daeb7615efb8d8e378177b5d7c04c1757095855dc6d1f98288cfa258d4032f768a61c627abd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667317, "uuid": "74f31e22-3730-493a-91fc-e71fa3671756", "value": "T108E08CEA641622524119FD08A077D8D93033EBD611118D4C7D9F24FEC4CCA297218A8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667317, "uuid": "87b76580-c145-4a80-a05f-e2ed69e107d9", "value": "6:L6F9NF5AASanGKTGWD6FnGj5AANaa67D6FTWX5AAvbTOzD6F45AAPk:MX5AAh2Gj5AANf9u5AAjTQ5AAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667317, "uuid": "380a00cd-d84b-4eeb-ac99-914fcd08f4f0", "value": 312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667317, "uuid": "d1268f76-f3f7-44d3-80a9-b157a24a3145", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667317, "uuid": "9e966bb7-8a5e-4868-9c78-9857f325207c", "value": "k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8ac067-60b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780645219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645219, "uuid": "d2c6b451-4248-4542-a6dc-6146a576072d", "comment": "Malware payload", "value": "b53298f48d730a75ab2966e3eca9728b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645219, "uuid": "4f362c94-7458-4c8e-8b6d-0e599bc7e80b", "comment": "Malware payload", "value": "c720437fc787ffa25f941d6169d12e29cf0aaf3b4cd61f10cc00dc024d5964b6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645219, "uuid": "171b5dc8-2fcf-4231-8c62-95e8fa018c2a", "comment": "Malware payload", "value": "94b6132f0fb036faeceb18cc25ada3166e588105", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645219, "uuid": "b38fca94-d8c3-44ad-9773-b24eae05f987", "comment": "Malware payload", "value": "a5044140258c6e1e3b9597a0028b32656afcc98f23059d253b0558ea0ffef943bf91c1abd3c8c88c1a1519475cff78cb", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645219, "uuid": "03ce3100-6046-4177-b460-a3188c5c9feb", "value": "T1D142C7285D9B3899982155D5C22130415FE2013F9C3ED446772D7E806B3E72EC7DEA8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645219, "uuid": "8b20922f-42c8-40b0-a0a1-cacdd4bac73c", "value": "192:Q8yE6miQsE2ne0vOfk8zdL5HgtDjzvF8xJnpRog0A9sXwhZZ3RkTDsVRu7:b6b5eMWFAtDj5S30pX8ZvkTSRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780645219, "uuid": "e6631425-6128-47db-aeeb-1a19c1827e58", "value": 12647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780645219, "uuid": "2178b08f-e9bb-46cd-89c7-7a92dd3a0880", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645219, "uuid": "cd5fa0f4-4695-4778-adea-29ffef888efc", "value": "c720437fc787ffa25f941d6169d12e29cf0aaf3b4cd61f10cc00dc024d5964b6.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6751199a-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780636887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636887, "uuid": "b903b530-11f1-49e7-b0bf-720270d9dca9", "comment": "Malware payload (Mirai)", "value": "d85b1d06973125c1779b6b548f80806f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636887, "uuid": "36b56b68-3fd0-4016-932b-ca6796858740", "comment": "Malware payload (Mirai)", "value": "c72fd954187659d1c9a9ac03c8711944061b26007d5f30f471ef148bc354aa00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636887, "uuid": "e6685074-456b-4df6-835f-64553cb5e645", "comment": "Malware payload (Mirai)", "value": "2ba0124ba5744b40997a5c3caf387d7e0a60b1bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636887, "uuid": "67b64f7b-a6bf-440a-ab7e-0c887da40f87", "comment": "Malware payload (Mirai)", "value": "d0b012ea696a57cfb447d2c77da568ace21f27c4340cda67fbad7d6edc7ab01b764033f44d97ee38e2f2e788d52911f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636887, "uuid": "13c30fd0-1e28-4596-aa9e-8d17cabbd24d", "value": "T189E3980A3F228F6EF269877047F38E31A75977E616E1C685E16CE5501F202CE641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636887, "uuid": "caab5a9e-a115-4f28-8bea-909ac77429e2", "value": "3072:PATaMm/IxG3hcXd0Y1ZAYPzETUly1VRbY0k:PATtAIxG2Xdf9rETgyc0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636887, "uuid": "cbab96b2-31b0-4754-ac0e-5c99f151d378", "value": 149772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636887, "uuid": "0c0d0e35-d77e-4fa6-9d92-047aa1841a27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636887, "uuid": "0a78c6b2-1736-4f5e-b057-ae5d28a3478c", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2b939d-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780636892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636892, "uuid": "12822ed4-4ed0-421e-8d60-974937a33fda", "comment": "Malware payload (Mirai)", "value": "afa550e775ce301b5b9f08a8f62671c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636892, "uuid": "6ebb5a81-5323-432f-993c-eb47c9de0670", "comment": "Malware payload (Mirai)", "value": "c7b379b588dcd3801157e0cfb817bf0484839be8a2e8515654e7a78d17bf3744", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636892, "uuid": "1272db85-2d2c-492f-9e41-37ed247d86bb", "comment": "Malware payload (Mirai)", "value": "c6067dae6784360860c8f2d627c7e29d94fb5216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636892, "uuid": "465dbe9a-1bbc-48dc-93c3-8b9ccff9947c", "comment": "Malware payload (Mirai)", "value": "eb2f3f9b1f5bcbb3ef6914c70778d5dfb6e2c57946f444375c77693dbe7669a30bdc299aa4caa0abd59466a8decc0181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636892, "uuid": "f82f5579-b69c-483d-9a7c-0e2a7130e4f2", "value": "T1C0E3E60AAF600FFBDC6BDD7702E90B1229CCB95716A53F797534E818B50A18B4AD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636892, "uuid": "5a0e55db-20fc-4988-a15e-84442258d829", "value": "1536:7ir3WAVCk1XGm3KtrbN/EEy83bJ7rRip0MKG1u+u8SwID4mAZgTvLfiZy48cyh6v:Wr4GGm3Ktrw8LV8wEmcifihvhIStIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636892, "uuid": "4c0287b4-d63b-4c39-a5e0-49d37f0a98ab", "value": 151516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636892, "uuid": "fa1c9ebb-f1d3-48a4-9205-b174b516b3de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636892, "uuid": "169d3f5b-828e-495e-ad1a-624a8a695dcf", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f32b26c-6100-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780678857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678857, "uuid": "76fb094f-b8fb-4257-a3eb-27b367adf9c9", "comment": "Malware payload", "value": "d1fe4ef024293edd4274be90c7da29a3", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678857, "uuid": "fceb49ff-4da4-4bd7-82c9-64b0b7cd6442", "comment": "Malware payload", "value": "c8ade7f7a8f1684e4ce322ebd6c3e5a1a4f1e7b0fc36a659be36f63fbfc52a6b", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678857, "uuid": "9a36822b-5c26-4112-a9f2-6fcd44d282e5", "comment": "Malware payload", "value": "66d4855739860c15625f5a82534cd850b93e2193", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678857, "uuid": "07631123-91d8-40b4-92f4-f4297490c7ca", "comment": "Malware payload", "value": "6a639a17c28a90877a6d1d58832186163fc45179aed0f94b38c59474db6905ed1948e01743379999d6f6204028ee79d7", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678857, "uuid": "9d4af557-5452-42e4-b3a4-89980b665964", "value": "T1FFC5E28D775D41ACC56244B210F10A92A7B9DB16A3E85E071BC6CC788E120DDBBBDBF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678857, "uuid": "137550ad-1204-4321-95e2-d5e87e7670c4", "value": "19945200808424dd61e24be83a91ce50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678857, "uuid": "84006310-60b1-4f6d-b92c-23edd28f41ab", "value": "24576:+Lksx0ml5c6yiHCPc/5vXL0pCC0gePvqC:kn0mZyHcWC4eN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780678857, "uuid": "d7fb8139-e470-4024-8605-bd329be24f6e", "value": 2641920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780678857, "uuid": "f40c2a4c-4a70-447f-a624-faa6cfe931a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678857, "uuid": "1ab159e8-610b-41af-a10e-9af86bf9d97c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b10363-60d2-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780659187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659187, "uuid": "14b3afdf-67ee-49b1-9146-2c2a2a895af1", "comment": "Malware payload (ValleyRAT)", "value": "47e57856a0675a38e7b8937d4ffbb467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659187, "uuid": "9c74210e-206a-4100-ada3-c2bd00dc3ecd", "comment": "Malware payload (ValleyRAT)", "value": "c9460a533e8f214768cbfaa68c486f454083be425e41e0df63777dd41281194c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659187, "uuid": "78f7d4b0-957f-436d-9ae8-af6aa5121107", "comment": "Malware payload (ValleyRAT)", "value": "788f69e61d640f2da5e59bd5c625c5455142637c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659187, "uuid": "681f1cfb-09a1-408b-93e9-5d6517fdf011", "comment": "Malware payload (ValleyRAT)", "value": "3c45801ebe760866f041f0077414757a5e27c9a07d2c9437e91c38c84558d2fd5157d65bbff1dd89dc44d4bfeebd1252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659187, "uuid": "1e1288ef-1516-41c9-976b-009e9ec5a3fa", "value": "T17C27333B724F203AD1AD4A76F5769140443B6E5168228C2F96F4BC4CEF7D0B25D3EA86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659187, "uuid": "758f8900-7625-4ddd-bc4c-9816b6eb0640", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659187, "uuid": "9dac5b75-93d3-4a01-8a28-b4050e14fed2", "value": "393216:FS2Qrk8oSvUxrmlDKetQiUKFtKoZ1GvTeOPYLabxJkHAxCggn:YdvblLtQiUItKoWvTRYLabxSAxCggn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780659187, "uuid": "53614cc4-d39e-4fca-8ef8-509e9e48737b", "value": 20667690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780659187, "uuid": "a8f2325b-f4f5-4912-8c6a-4df52b530b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659187, "uuid": "ae74fe58-c8e2-4444-9be1-2543532fbc81", "value": "HuoRon_Safe_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d78298-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780636885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636885, "uuid": "3e0a2056-f50e-4075-939f-3a89bd9bf292", "comment": "Malware payload (Mirai)", "value": "bd5dc40dda21e40fbd0b015e3f53b704", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636885, "uuid": "875d144a-eb93-46b6-9682-be2c8cc01da3", "comment": "Malware payload (Mirai)", "value": "c99bda9c36167aec7d2e0543eae7290a9e6f128da87b688559208bcb02938aa1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636885, "uuid": "c061cd95-65eb-42f7-91ca-94af337b361f", "comment": "Malware payload (Mirai)", "value": "f3f21baf170d006b8a1de45e7118925c1d764302", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636885, "uuid": "5b6a5bac-5e42-4355-9f08-9893852ccf90", "comment": "Malware payload (Mirai)", "value": "1fe2e9ed17979694a3b4bb807068715a87b665e368f03ea3194e249eaf28d4ac802ea9e78ce75ea56e921f4be71fdc94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636885, "uuid": "7e68a126-0916-4c9f-9c63-14c3bb4bd075", "value": "T1DFB31B427D419F13C5C221F6FBAE42983B126B7CD6EA7102ED257F91278B8DB0E27611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636885, "uuid": "9162d5aa-5106-4fca-aa22-0c557388eae1", "value": "3072:0x+yaDLL96IK2Zjdq5C394YEWzEj1lzsueo6:0xE96IK2Zj8a94YEIO1yueo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636885, "uuid": "0fc19f9c-3e02-41e1-9796-5e4cebac87ac", "value": 110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636885, "uuid": "4274b5d5-3dbb-425a-8c10-702fc120330c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636885, "uuid": "0279ffeb-90f4-4747-bfd1-9055216300b0", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36571167-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780623920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623920, "uuid": "cb92a878-a96a-421d-afdb-76acd5454a76", "comment": "Malware payload (RemcosRAT)", "value": "0025daec2c44a827f320893f82f433df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623920, "uuid": "da01e2dd-6452-49c4-95a1-56b10364e1eb", "comment": "Malware payload (RemcosRAT)", "value": "c9ecca312c46bc8565a82cb901d9b24a2ac136baeb390f1005a810673f49969a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623920, "uuid": "b720dc10-5ed6-430a-925c-fecd79c965ae", "comment": "Malware payload (RemcosRAT)", "value": "d22b6d987148d5cc924f39aaaed050712bcca392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623920, "uuid": "40d213db-9645-4b0a-bd43-f6279385b290", "comment": "Malware payload (RemcosRAT)", "value": "2da4036d4f0510cda91719f3fc769db3095035bb7cc4f43d5ae641133540af7a9cff08905aa98aef2b7849333f34a626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623920, "uuid": "8d4bfd48-db2f-4e8e-81a6-7c879311eaca", "value": "T1BBB4AF02B6E2C0B2DA7664300936E735DEBC7C31183699AB63D61D5BBD30151DB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623920, "uuid": "fd01d7db-35bc-4959-b3f5-16ebabd13279", "value": "7d5125df1b721f19e7f94988d3e3ee5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623920, "uuid": "3b7bb130-bfb8-4464-b2af-3f02b2b67043", "value": "12288:llQAiR49ckiK7JV8AuE4lKC/kPHM9/IsPZSXj/:ll0GcNUJV8i4mHM9/DZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623920, "uuid": "d5542ac5-1cc0-496f-a0f4-6881ee7675a6", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623920, "uuid": "aca91504-ece4-46c6-bb24-e6689fddf8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623920, "uuid": "4474f783-e75a-40e7-94f4-fcb99f0aef82", "value": "c9ecca312c46bc8565a82cb901d9b24a2ac136baeb390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f977575-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780641518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641518, "uuid": "a4cb8e23-f953-4197-bfe8-9299aad7ded6", "comment": "Malware payload (Mirai)", "value": "780fd005d5c13c1d945d8204dffefdc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641518, "uuid": "7b192498-9774-4c62-a5b0-9ba8f8c47d09", "comment": "Malware payload (Mirai)", "value": "ca13f541d85354a15463e66b4a63f0b9a646701472b45419feded338cc8c4623", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641518, "uuid": "d4116453-4b08-4c78-a4ba-c5cf5f338ad3", "comment": "Malware payload (Mirai)", "value": "ebd2b59ac416860d7f6b46b15af155ddd243d898", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641518, "uuid": "e3216e9e-ea84-43f4-b6b2-b1cc4082da25", "comment": "Malware payload (Mirai)", "value": "8131753e38a3cbf4b3562dd67973bc2924a0fbfdb8ecf0a557b790d1302bf40f8cdf4b6e9aecbf6f5d80fc15e694dcea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641518, "uuid": "dbf8e0f9-7825-4488-a854-02204554e014", "value": "T145630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641518, "uuid": "5aa56787-2a7b-4695-b9db-135038e12d11", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641518, "uuid": "7354868e-6bb2-420e-9efe-900d50172eb0", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641518, "uuid": "2b70f72a-d2de-4ca6-9af5-56cc5e783c8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641518, "uuid": "1a88afb1-6170-46a7-bfb4-b68dca9eedcf", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903707ce-60d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780660149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660149, "uuid": "57150cbd-fed8-4c86-9b4f-4b6b245b76d4", "comment": "Malware payload", "value": "4b46935a7bd16977cca1face70c2e2fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660149, "uuid": "78c4a11e-8b72-4182-9b86-daea7b461569", "comment": "Malware payload", "value": "ca31646f6fb177e9b433481f945a56733b54fc9b16f21bfce119396a9ecd82b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660149, "uuid": "eb28af13-b279-4c65-b1fd-d2c47c50446c", "comment": "Malware payload", "value": "bff3780638f6496f181810638d96944429cdcf2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780660149, "uuid": "d4136670-60ab-495a-aaef-0053937a29e7", "comment": "Malware payload", "value": "6050bd8a7d94d4b1d2374e6365df93b08e87570466b6a70d86e0bd060de954e3f01cbdca4521249d7ca1aedcf12c116d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660149, "uuid": "4d7e7e4f-9bd4-48ca-a243-f999466f52ad", "value": "T18254B017A66C50BEE1B3D678C9924941FB72785A4B71A7CF03504EBA0F76BD09E39302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660149, "uuid": "8ac22b8d-4f85-4111-88d9-6f9e8cd26c0a", "value": "53e4e12437621212a425d294842d0a96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660149, "uuid": "bbc732f9-efa0-4eee-8382-eac5faedc7ca", "value": "3072:alDJk88wN1QA7sxrYL1peQ3lOg9SkHNwG3JzaAT5RR2OnCTnsV0YGBYwjyHY2UaS:eAAwxrI14Q38gB/oOAh2uK9s0bkghj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780660149, "uuid": "dbd9b76f-906e-444a-a0e7-e631cc759997", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780660149, "uuid": "97d2ab7b-1c5b-4c78-8b23-40c83af561b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780660149, "uuid": "ea41e7fd-082a-4ffe-a295-609759113a1b", "value": "CraftStartLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c715e9ee-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649504, "uuid": "03accf3a-eaad-4d4e-b1cc-e0d2858cd27c", "comment": "Malware payload", "value": "78ba68466606f24ad5f3687845f0a052", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649504, "uuid": "1bfca1d8-084d-42f8-a8de-6390898ee16c", "comment": "Malware payload", "value": "cac0f583fb60e4d41173455e8e43d037cd46fdac1cf45ebb9a205b6c5d5ff858", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649504, "uuid": "09712e2c-bcf4-4227-bbd2-be4eb8996ae4", "comment": "Malware payload", "value": "ad5d2c89c5476cfb482cfcd707fd8d76e6eaeb74", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649504, "uuid": "eac6e1b5-7f0d-4650-8928-8150e050ba0f", "comment": "Malware payload", "value": "a294ca24f050915c072593433b02aa54be0899d0e48417ca6025e484d05522da385a5363c0ae89d31f16b25d02939275", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649504, "uuid": "75aa274a-d235-4afa-b2a3-c2aa18957e61", "value": "T1FBA17E9AC2743836C0B45BBDC5E8CB5695D457912AC01B5EB24EC57EC00D14B67921AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649504, "uuid": "c3f712a1-5131-4eac-a0dd-49e3b69633c6", "value": "96:ToumU624sGazn52m7Gn10J+BHa02IOpvEzmb1V2AUeaATrMRgqu:FT4sGXm7G0+ta02IovEyZVxHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649504, "uuid": "981183b8-464d-4eb8-8cec-a8848bc701bb", "value": 4918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649504, "uuid": "e267974c-4315-41b0-9f41-7db5d01b4007", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649504, "uuid": "3bd942c1-9f68-47b0-9117-d753a8213b9c", "value": "photo-747453657.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9494d59c-60f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780674759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674759, "uuid": "b9319cbe-b43c-4d7e-9d5a-ab79b493e757", "comment": "Malware payload", "value": "a113090d748d0dac7d488c97f1305af2", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674759, "uuid": "89aa0d37-ef25-4c1e-9143-75b577eb3b34", "comment": "Malware payload", "value": "cb65f5873c72d707371ec56fb8ba501a5c7f5940e9c5a2d28c9b379ce216900c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674759, "uuid": "ae789be8-9b19-47ca-ba8c-f468beccff6b", "comment": "Malware payload", "value": "1f34a8fad545554420650a8518d4199431fc2920", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780674759, "uuid": "8ac42b24-e416-499d-806c-b26040d0fe41", "comment": "Malware payload", "value": "eee3d68218c9b04038c0405e9454dfbfb1cfea5fb1c3043cef494d7d28e21d6118491f408e959b044c01c353b3832e05", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780674759, "uuid": "f3c6c277-a8f3-4d0c-a428-6173e517f482", "value": "T1040533637730D211A2EF922D74E04FB0969D8B661DFC80D4344609F78F63B7B24A9E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780674759, "uuid": "76920628-7138-4a83-b7e6-85ef290e17a3", "value": "24576:vC4jFYJ4EklJLWjLK24pc9BBb5SpRuWH7UCjQN/O:qUFEolNgGu/WRTjQN/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780674759, "uuid": "f6b3baa9-0350-4d4b-a6be-73b82961794d", "value": 845661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780674759, "uuid": "1be46513-2f68-404b-8045-354ffda31490", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780674759, "uuid": "884b0cc7-69d9-4aa0-80f4-9ee9c5575e6f", "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e \u0441\u0430\u043c\u043e\u0432\u0456\u043b\u044c\u043d\u0435 \u0437\u0430\u043b\u0438\u0448\u0435\u043d\u043d\u044f \u0432\u0456\u0438\u0306\u0441\u044c\u043a\u043e\u0432\u043e\u0456\u0308 \u0447\u0430\u0441\u0442\u0438\u043d\u0438 3018-4908.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394b7418-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780623925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623925, "uuid": "7cfe83e3-814c-42ce-8b49-ec30c298d324", "comment": "Malware payload (RemcosRAT)", "value": "74963623f61e0778211b34159b286dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623925, "uuid": "618a7eec-6b9b-47b3-83cd-719dd0af2ea1", "comment": "Malware payload (RemcosRAT)", "value": "cb8e562490eeab0ea9cec1c405f832bafa4e4a3aae0dcf56397b4aa36e5b1ca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623925, "uuid": "990fd85f-d97b-4c40-91c4-dbca23361014", "comment": "Malware payload (RemcosRAT)", "value": "f93e006b7dfe0c98babb422b6a0b5acb3e80cc5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623925, "uuid": "176e3d06-809a-47d2-a8b6-8a508a265a5a", "comment": "Malware payload (RemcosRAT)", "value": "26c451013f8254b5e71a5536891641ef0182bd5898b79d813f658716a104fd8d89a63ca1dbf5613ddfc0775b3e484e38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623925, "uuid": "4e465c5d-27e7-4918-a8a1-8c9568ddb4f5", "value": "T180B4BF02B6F2C0B2DA7664300936E735DEBC7C31183699AB63D61D5BBD30151DB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623925, "uuid": "f278eaa7-0db1-4b71-a2b5-def81de7545e", "value": "7d5125df1b721f19e7f94988d3e3ee5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623925, "uuid": "7e0d01b0-b5b9-4475-b954-3302beecb5a5", "value": "12288:FlQAiR49ckiK7JV8AuE4lKC/kPHM9/IsPZSNj/:Fl0GcNUJV8i4mHM9/DZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623925, "uuid": "835a6f17-6b30-4366-82a4-b630c5280ccc", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623925, "uuid": "1647c05b-5007-4a4c-9c08-fc19e6c31826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623925, "uuid": "75c26b43-d366-4e2c-ad34-30b22ed03d1e", "value": "cb8e562490eeab0ea9cec1c405f832bafa4e4a3aae0dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67fa2a6-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780642228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642228, "uuid": "848844b4-1430-43b2-b69a-2af73e34a502", "comment": "Malware payload (RemcosRAT)", "value": "467699238eebb0c09421df956c0b910e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642228, "uuid": "575d7fcf-6499-4c44-b7ce-6db32dc75ebd", "comment": "Malware payload (RemcosRAT)", "value": "cbdcf45881be99e1634dc5a1c401d5310662520e6fae3a6a57ca07f078ef97f9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642228, "uuid": "268f58c1-662f-4967-979b-534f026f4e0e", "comment": "Malware payload (RemcosRAT)", "value": "5a1aac88bfce7a3d3d638df37b888b200097d2d4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642228, "uuid": "7cb113b9-b9bb-41be-abb7-13c158298e3b", "comment": "Malware payload (RemcosRAT)", "value": "8a99ed7bca5e8adfc06711613c663225ac9e23cec9f76f19fc5dd909894efbf3a8b8ed0db47f130a1f82489aa1d434d2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642228, "uuid": "4e9896db-c654-4c9c-b98d-d74cb726303c", "value": "T18F91F8F21B9A086CCD4A7CAF6412AE479A293EC8839DD730CF84564D22D55ED0EAD4C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642228, "uuid": "6fb2f7a9-3f81-4710-a6e3-413de81bde35", "value": "96:d4MaTrrAnbQkWWc1eWxHhNkYSgi39hpbmrxds1XbGfWbWcDNmB/:d4MavgckYsIBSRgGcfp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642228, "uuid": "812489cf-c91d-4a36-833c-f99de7f5c8bc", "value": 4592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642228, "uuid": "a7d74e4b-4843-432b-bfdb-4f0d60597ffb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642228, "uuid": "15bcd13a-67f7-4ed2-a137-4905af880a02", "value": "awb_trackingnum#_commcial_inv_packinglists_customs_declaration_clearance_documents_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d10e6a-6120-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780692721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692721, "uuid": "c8c8c0b3-cfaa-4016-92dc-8715df6698ee", "comment": "Malware payload (ACRStealer)", "value": "f3306e122cb6afe36e746e4016743b7a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692721, "uuid": "00dacae8-f92d-4369-b7f5-2cd4f2391379", "comment": "Malware payload (ACRStealer)", "value": "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692721, "uuid": "951891cf-5b50-4bed-9cd2-f8b0a4416450", "comment": "Malware payload (ACRStealer)", "value": "fe0c5cd018947d777672520f0ce96a0a6701a6fb", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692721, "uuid": "26df66b5-d371-4951-9c89-27fe54d4fec3", "comment": "Malware payload (ACRStealer)", "value": "80512448f7b870b92c7806d68ee46c4bfbfb02ac58a762b2d30d14293c97fff05aba9cc3fe9978efc37d48e6db867b03", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692721, "uuid": "f6e0076e-e46b-424d-b034-79c3bd6b9830", "value": "T136666C43BCD109E9C49AA33189F66292BB75BC484B3623D72F50B7382E76BD06D36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692721, "uuid": "4db2c0b5-7277-4a98-b426-ac1fe1bc3983", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692721, "uuid": "f1b42ee4-53f5-4bbe-a6cc-be305c3a9810", "value": "24576:+A258vN+Z7PjzIVWik9OlE7BlxE/Ufkf3mJI8SYjKrt7q5/nBele7tKDyicnb//y:+AQ8vcZ7gVJk9Olgx8YOrtQnpm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780692721, "uuid": "83d0f4c2-07f3-4788-9ec7-9db70a4fd8ed", "value": 6837896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780692721, "uuid": "77daadad-a560-4eb7-b7db-b073d885c05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692721, "uuid": "d52eaab5-26aa-4eb7-b930-9ad6ca4109f5", "value": "jhgkuyyg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd70b3a4-60e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780668493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668493, "uuid": "d3583202-c572-455a-b591-85b0b9db7fce", "comment": "Malware payload (Mirai)", "value": "12d9cd13c72d8e3969d6956380eb9cd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668493, "uuid": "818fc8f3-180d-4488-bae6-3280d7ad8b01", "comment": "Malware payload (Mirai)", "value": "cc69486256de47dde43a8c5645edd2b9e102b7c3c62e0d1930ca3852bffd882f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668493, "uuid": "17c753a4-78f3-45bf-8f94-622dccc34a79", "comment": "Malware payload (Mirai)", "value": "97bf97232dd5657cf18e21cd68b84008c8b4318b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780668493, "uuid": "dff4db18-6feb-436b-a059-2c5e86c60fb2", "comment": "Malware payload (Mirai)", "value": "b4e897c1aab77726f11c543063a070de8ec883c959a30b289df664eb4938316cbd82e084f5208711ac6169d0a48b2455", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780668493, "uuid": "1e13423f-a1e5-459c-89f0-7b2f6f596d3b", "value": "T17D63F946B9919F23C5C222FABB9F419C372277B8C5EB3106ED217F9037868DA0D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780668493, "uuid": "17ac61f7-6031-4216-9870-fa9251f58330", "value": "1536:zqTg+kuRkcL5lZP2KDqDLCKfOIODZVpwAnBbth8f:zqtRkcLzZB4LbfKVVJnBhh8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780668493, "uuid": "8a1d3264-8faa-408d-8603-876fb4f92466", "value": 72364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780668493, "uuid": "dcfada0f-0364-4fe4-9bc0-89a935f3dfd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780668493, "uuid": "623948a8-3ccc-466d-8718-122970c620d0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3682d97-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780638814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638814, "uuid": "7f1081ea-37cf-466c-a8a5-be92e93cfce7", "comment": "Malware payload", "value": "3a1a78c0a6fb852b420593cd1d96de91", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638814, "uuid": "665f275c-83d3-411d-a9ac-ce8ab52a3b4a", "comment": "Malware payload", "value": "cca1727b36e0a9d0b6b9473a56f8f511f7fee8c8b1d2e5c7d3543792dc12e7f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638814, "uuid": "811e59cc-2f65-4dd5-893b-ebade5a3e634", "comment": "Malware payload", "value": "ff1b509f3162694ac560b68304d5d5e91cbf009f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638814, "uuid": "c8a6bc8e-cde1-4c12-952a-1337c89fcfb0", "comment": "Malware payload", "value": "513260c2d89dfc91e8f2e0c62a69303c4d7039f342251591e20dbd9d5dde39e7eed443c8dfefc7b0f5c8f3b56eb4350c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638814, "uuid": "1810ecbb-7793-4fec-95f6-818488cfd3bc", "value": "T19C0144CAC521976051DAE89E629761807821C38B1A864BEC7E9C443DDBB974CB0A5F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638814, "uuid": "fd7eabc3-65e3-4db7-80cf-6ec54401bea7", "value": "24:kXCKysE2hi0ziQvZohaUiAleuE8jD8as7:e9Qp+MsUEuE8jA/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638814, "uuid": "cb552130-6634-4008-aa08-d572caffaebe", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638814, "uuid": "be096228-db65-4c34-83dc-f6b7b2a650d9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638814, "uuid": "db00dc40-100d-45ef-8b7c-294342bfbd2b", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652436c4-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780636884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636884, "uuid": "8487b723-e0cd-4001-bc27-ba4b2e52f0ba", "comment": "Malware payload (Mirai)", "value": "5b7855a541bde94266a1fde2894fec2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636884, "uuid": "dd2f1c7b-77ce-4fe9-a77c-cc1d91306c8a", "comment": "Malware payload (Mirai)", "value": "ce30abebd7c1e9fe5b016ae13bc72a9ab154d9293b5df8b0f45904e05dd5d89b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636884, "uuid": "d5076227-a9f4-47df-b3ea-20922a7f8c6d", "comment": "Malware payload (Mirai)", "value": "e292ed93bdabb30432a3ae80416a50882d4fb12b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636884, "uuid": "15739fa1-e48d-4173-bd75-ad6ce5efd85d", "comment": "Malware payload (Mirai)", "value": "278e083e2df7a98c142fb58dc478faac5b07bcc99b7850a315bf8ed057c49e2d4630dacd4352ec8c1f3fcea75fed5be1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636884, "uuid": "4999d20a-c61b-4cd5-b85e-af32db48d2cb", "value": "T136D30956B9919F12D5C321FAFB9E814933136FB8E3F93102DD206F50638A9DB0E76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636884, "uuid": "b0df1c71-14ae-478a-92a7-ae0e9bd78ab0", "value": "3072:xP6vJeuJmBJGI4S+Xuh0PLaFhbIzoFIBYl9IBO9/MY+mB2:UBemmBJcu+LaFhbIzoFll9h9EXmB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636884, "uuid": "8f9c1451-f8b3-45e4-abb6-3b051b3c2d8c", "value": 141524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636884, "uuid": "25db20f3-bbcf-42e4-8216-dad3095772df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636884, "uuid": "d0f46a33-b34b-4f32-83d7-7899452cc59c", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30584ee9-6119-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780689623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689623, "uuid": "2de80090-3451-4673-90fd-5c7b5af14171", "comment": "Malware payload", "value": "7731184c419399fee142811019d3a1dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689623, "uuid": "5cc9f54d-9b86-4cff-b470-e4c293e2c11a", "comment": "Malware payload", "value": "ce50291dc85eec24d282ac9876640a85627feaf24d9064c0e6fb3aaa6d7134f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689623, "uuid": "4c3cbe0f-67b1-4da6-8632-93496f5cf9f8", "comment": "Malware payload", "value": "f8fc69ccce247c153ec33c2950a9be1272950f8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689623, "uuid": "84acbada-89eb-46d4-bc7e-c39eb49d27a5", "comment": "Malware payload", "value": "7cafa75b12dd58831669004e1df3907dd14dae4bc1d245cd152c181c82c2ec3208f8a59fd28c9bb86ea8a0c67c78bdd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689623, "uuid": "603f5d3b-32ce-4f5e-8867-a0b140f1bef9", "value": "T130F32A45BD418F13C5D721F7FB9E428C371A6B7DD6EB3102E9257FA0278A8D60A3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689623, "uuid": "acd2e1a1-b574-442c-b46f-bd4727f75740", "value": "3072:cOj1h5xllCTvuXUb4Z4z4sUqoK5l/h8cIfBu0D:xj1hCuo4Z4zBUqoIZ8cIJu0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780689623, "uuid": "f3f378e6-e44f-4d76-8b18-93b8611e72e9", "value": 158816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780689623, "uuid": "443b6863-f05b-4a96-8e44-1c3a2f288a73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689623, "uuid": "02d61b2b-2de7-4049-ab75-98d7e73055e3", "value": "nova.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b50ba92-610a-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780683334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683334, "uuid": "6c4ebe6d-f7f9-4b98-91b7-0f6c41e2e0a2", "comment": "Malware payload (WannaCry)", "value": "6925f2d479cffea0c14706e5acd1894b", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683334, "uuid": "c69d634d-a172-4dd3-bbb6-0bb358e1cdf7", "comment": "Malware payload (WannaCry)", "value": "ceaa4bf36125d1d0c88e29187b2897b9ab2131c4cfc7bd03d84e89a4cad4ed0f", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683334, "uuid": "ce445943-856a-4dd0-9d6b-78069a28be47", "comment": "Malware payload (WannaCry)", "value": "bc09a5143e94870436976265f241983d3b2d077f", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780683334, "uuid": "33b45ae5-947c-47a7-ad6a-e72a9066036e", "comment": "Malware payload (WannaCry)", "value": "47dc61bf714d6c60f6690456c0cd743d110f3151f71cb30d33591b0906b6a34dafdb21bfdc4bf4770780190eddb417de", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780683334, "uuid": "a5dd2ddb-b889-4130-a9e9-185952f7ece9", "value": "T1563623A171EC80B4D2061474C4B75E25F6B2BC7A12BB5A4FDF908E292F63B42F624753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780683334, "uuid": "9bc2f44d-99d6-4eb8-b587-390118127f93", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780683334, "uuid": "3c0dfa73-c815-4b18-8e0b-96d828e5cc5b", "value": "49152:jnsn5MSPbcBBwSqTdX1HkQo6SAARdhnv:DM5PoBiSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780683334, "uuid": "61262c0f-04d5-4163-943d-0d60f17ac1f7", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780683334, "uuid": "cc234232-9192-4927-ad49-e0b90dccad16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780683334, "uuid": "48d8d796-7968-401c-8554-9f12435035d2", "value": "ceaa4bf36125d1d0c88e29187b2897b9ab2131c4cfc7bd03d84e89a4cad4ed0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca859c3-6119-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780689778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689778, "uuid": "cbed5047-e620-4d6b-81b3-0fa6c293e99b", "comment": "Malware payload", "value": "98dc2fbe2d628292a1ce97d251381d2e", "object_relation": "md5", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689778, "uuid": "335da7b4-cf32-40a1-b596-f6082cd17777", "comment": "Malware payload", "value": "cee673395ef5ae40ddef1bb32a9187a08e184888feced2fdf1804df9841029ec", "object_relation": "sha256", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689778, "uuid": "7e586552-1679-4229-806c-4f51f54b5b4d", "comment": "Malware payload", "value": "1b847e47dc503cdd6135cb7d7498528dee94de1a", "object_relation": "sha1", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689778, "uuid": "8b7668f8-ccd4-409c-b533-0e8ac0d1000f", "comment": "Malware payload", "value": "0dad72f466f77af65900357a1f245f298973d2dc714d3c8fc453e92a627943c82e2ab15b9057545aefe5c705d4717331", "object_relation": "sha3-384", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689778, "uuid": "fcd861fd-d375-4802-98c5-809c8b63c2df", "value": "T14E97335E1D6A4BF1612676F030C2AAF98D11D59CFAC03F9E0C1CA56FB46806D37AE493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689778, "uuid": "fb1ef52b-2d3e-4aeb-956e-897cfd0dfade", "value": "786432:4sB+spKKDLW1qkdN+uZRCPkaVvonWo/2rMblL93HrxYw0TzzZ:4/D2LWfEPhonWo/9JXrxYFTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780689778, "uuid": "aecf6b8d-86d6-421c-9d55-6b487bc32b7c", "value": 43240083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780689778, "uuid": "44f1be76-3ff6-4233-957f-8c563e589fde", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689778, "uuid": "0ba798ce-8b31-4dcb-8b5b-a717b7db8bca", "value": "Setup_File_41.700.92746.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c86e5e-60eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780669815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669815, "uuid": "9ef95053-d521-4364-b2c8-c17adb4ee2f5", "comment": "Malware payload (Mirai)", "value": "b968459dd8f90501d3fccdd43404fe31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669815, "uuid": "ca3665b0-af69-44de-a734-21ee51a844d4", "comment": "Malware payload (Mirai)", "value": "cef8624111cde644de45a9359bf8fc98eec3af0208f82d9a52a168693f617b44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669815, "uuid": "99dff649-1108-45c2-9e29-e226da5e3fff", "comment": "Malware payload (Mirai)", "value": "a239fd7a7250e378e0921c5e3ddcd1573d69d9ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780669815, "uuid": "a6c4ba29-7189-4dfc-87fd-dbadf5748573", "comment": "Malware payload (Mirai)", "value": "3205682db3a4eab7882ed7d7c2ea16e62547ebd4cc00a603dab55c51d9e8f349dc42ec8f31deb746027e78ad8b710850", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669815, "uuid": "06e72305-a5e1-4732-99dd-ccfca7cb9de2", "value": "T121A33A11EC751837C5C0B13A51E34631F5B6539929B8DA1E7EA31D9CEF18720323BBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669815, "uuid": "b2f962a7-3d6f-4e4e-b54a-722607ff99cc", "value": "1536:vrd8Sg9xeoYpgG/hfHPM6qPl1ZI9Upb7ysNWxqgSMIog:zdcMpgGFWBNFJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780669815, "uuid": "d293b3f8-7ce8-4d6f-8a1f-f7e646a751e9", "value": 99980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780669815, "uuid": "4ee5a5b3-6010-4b88-8bcf-54159d3cb9a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780669815, "uuid": "277fa4a3-5377-4c6f-a81d-e1421e554fce", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2d4844-611c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780691064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691064, "uuid": "d7dc111e-6a7f-4abf-a033-6ae4a931cb45", "comment": "Malware payload (Mirai)", "value": "7990c9204017b8911394f24ae7995fd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691064, "uuid": "6664b225-80e5-42d6-b4f2-ad29ae615f7d", "comment": "Malware payload (Mirai)", "value": "cf4a792cc9f2b038c1ae40ca3ac3cfbecfcc1a5978ded68a9f18c6d381386ef1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691064, "uuid": "5c6d47a9-f2a4-4252-8210-ab8a57fe0083", "comment": "Malware payload (Mirai)", "value": "d46867323618c717a3c9593c1971fde8382e8893", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691064, "uuid": "0f466605-d17f-45d6-88b0-84b0627c4176", "comment": "Malware payload (Mirai)", "value": "ee18c4944c96614fbfddccaaae289223eee1ba0efb83225c430f7993a284f0734aa57d2e158fc166e181179d71eb66f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691064, "uuid": "153b87f0-6e71-4ecf-80e3-c7e0df4826a7", "value": "T1A923E17617C3FD22CBF218BB85BCC787A29B0469E46E72A219880EAC718F44717F5547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691064, "uuid": "e5087e89-0639-49c8-8263-3f4c5242bcca", "value": "768:76GNKcmXydcOa8l1AAV7otmJo7mMYFqK9uqV5Qm87ZhKFJBvAaAbDkxs3UozYK:uGN5Kc1totmMtIuqV58qFoa27zB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780691064, "uuid": "016a3c12-5622-485c-90ee-bcd5ef0f8826", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780691064, "uuid": "50156fb4-7fd3-45da-b8dc-c840a5dc86d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691064, "uuid": "322e08fb-4597-4e3d-b4d5-c41a9b63822b", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d08bee-6121-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostPulse)", "timestamp": 1780693208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780693208, "uuid": "76e881df-3878-4ec4-b10a-729d648a6918", "comment": "Malware payload (GhostPulse)", "value": "e84953543e7aa22a26759c520ad90b8d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780693208, "uuid": "09970b1b-19d4-441c-bac2-6f787ee72a32", "comment": "Malware payload (GhostPulse)", "value": "d0569afbe1bada2bcedfbda4a5561353595629bd2e018133e35e078db201e063", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780693208, "uuid": "90e671f3-ad4a-47aa-91a0-fdcd986893f5", "comment": "Malware payload (GhostPulse)", "value": "2eb336d6c22d73c28285e0e57aa30d708ed30baa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780693208, "uuid": "37a44ff3-cbef-45d3-8901-607bd579378d", "comment": "Malware payload (GhostPulse)", "value": "f4c10a6f9106196c129030049c1c337e9418705b4bfd6386186eb0755c2a93423d7c7d76df434f911f8ceef1dcc43f75", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780693208, "uuid": "b3ab3d97-1092-4810-b9e5-167e311a5902", "value": "T17F063352B7C0B4F1D625CE30EF4BAFA210BAE3D57A421E4782D92E452DC3671931B1E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780693208, "uuid": "ee602843-ccfc-48a7-ae58-5dabf186b651", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780693208, "uuid": "aed4675d-2237-41e7-9acb-69ecb676bd80", "value": "49152:+pz3QpEQDdtLU0Kc3DeXQsi5YXQx4Un6OlQ246+p4pyCWaGmmYIAxHX2xszZ/Nx4:+pEVDfyhXQxLfFHM4Oa8YDcxszZ1xbGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780693208, "uuid": "55a0ed5a-31d7-4b62-a266-60266e9650dd", "value": 3804040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780693208, "uuid": "19bcdcb2-357f-46c2-9540-f74aa76ec324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780693208, "uuid": "c73560eb-43e9-47e6-b017-ed1e3fd18f74", "value": "KFUMZTOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2bcb91-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682213, "uuid": "108e2fb2-14a3-4988-8b6b-7623a44585cc", "comment": "Malware payload (Cosmu)", "value": "1a66a2012d0afcdb03d3d513b8e42ad7", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682213, "uuid": "6f44e84e-939b-41b6-ac69-0dcaa197d996", "comment": "Malware payload (Cosmu)", "value": "d0c6b3f89a68af7d0037a2f70d14039d894c3a8eadb61082605debe74db89ff9", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682213, "uuid": "33dd3543-b39f-442d-bfa1-7bde8d8bf5e0", "comment": "Malware payload (Cosmu)", "value": "57fa63f43fcdb3c620272a464d94d2a362605dab", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682213, "uuid": "7884ef43-9b99-4bfe-b3ba-b7fc9236b8d8", "comment": "Malware payload (Cosmu)", "value": "d4fa9ab3f62995e3936805ca324d4ced1e167da580f8431144cd9c35c02d429030eab790921a070671f3c73ef7984f93", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682213, "uuid": "0008e57e-9f36-4db9-990d-13a3740b64f3", "value": "T19534D0493DB38473F0414D71CAE546D16FBE6C0379E2E12FEF580A4B1EB029C4AA66B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682213, "uuid": "40db17ef-4fa1-4291-b4cb-fad7442c4ce6", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682213, "uuid": "2a97e150-b401-4832-ab9c-99ede8a3e227", "value": "3072:DgV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBiI91V:E1XlKgzelZNQSBQGH/CSpWqTWmQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682213, "uuid": "e63d540f-bcff-49fd-8d98-06dfb64195d5", "value": 241665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682213, "uuid": "06b102cf-201b-464d-a170-6d5e3fef26dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682213, "uuid": "f9c9580a-110a-409b-b6cf-7cdba3dcc290", "value": "jaccessinspector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e23d282-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780641516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641516, "uuid": "f7377d22-d377-413b-8fdb-93570a281418", "comment": "Malware payload (Mirai)", "value": "1c967e3c3cd75165f4bf7ab59c520630", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641516, "uuid": "d4ceb474-456a-4342-a022-b324a3993be4", "comment": "Malware payload (Mirai)", "value": "d0e9d27e816854d2a32a252d83112cb05ea210190b661eb8eab5555a63b1bb2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641516, "uuid": "32f23f45-a067-4d42-a4c8-cc2d56d69258", "comment": "Malware payload (Mirai)", "value": "366d0496cb101a86dda2d37c89f8802c53adcc67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641516, "uuid": "c9315ce1-05b3-4f8b-aba5-aa1ad9aa0393", "comment": "Malware payload (Mirai)", "value": "48cebfa4ad4c929da190546793ca313428a3d7d8f89547b0c1f3ef8e72ffac6aba1b0c8604ad746efe769ef57fab2143", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641516, "uuid": "5957fe89-bd75-4d61-982d-2cc2e57aaec8", "value": "T1E3432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641516, "uuid": "73031e0f-b4cf-443c-bc83-ae4dd588f8f3", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwp:RqtmZPuutfbltZFBSJsBcfDSTFI+BEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641516, "uuid": "503c481c-70e9-4a9d-babc-51ef42cbf7ba", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641516, "uuid": "d289a854-9147-4160-9061-ccd33b6283ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641516, "uuid": "af9a1609-5c6e-47c5-86a7-a4e607636692", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe7bbc5-60a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780640519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640519, "uuid": "2bfc7569-ded8-4a71-983e-06cada6d77f9", "comment": "Malware payload (Mirai)", "value": "3c710558e2172d9452b89a7649e88aed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640519, "uuid": "2b82bfe2-f3a8-4462-8ff3-8709cf6ddaa5", "comment": "Malware payload (Mirai)", "value": "d1271cf7a36f682a368772028a1fea00db7521fc2f290fdbb688fa59b63f6f27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640519, "uuid": "637ae5db-a46e-427d-b0f6-f7326f6337c5", "comment": "Malware payload (Mirai)", "value": "a08baa90cc6c4707a8baabeceab4638d8a9139ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640519, "uuid": "20a0424f-aa0b-44bf-990c-919b34325118", "comment": "Malware payload (Mirai)", "value": "b34475044ff74b4fd78b63b681e6aaed7f1f9dd74a0f470bf311d9778e1d07908935f39e594d3f8ecae0dfd9187d5b2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640519, "uuid": "786a767d-79e2-4e0b-81ee-e3f653cd8232", "value": "T10AC33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640519, "uuid": "e120fac6-6796-4479-987f-eb053de91e28", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPQO:LzhWutxBaORaebXQd+mzBzlkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780640519, "uuid": "4f9f6062-f8f1-4aa4-b775-9d87be92dadf", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780640519, "uuid": "48d911d5-a55b-455a-839c-8e2a35362bb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640519, "uuid": "fae71a8d-75e6-4743-ac60-341159606c41", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c91efe-60b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780645319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645319, "uuid": "47a69be0-f088-4817-9854-61083c7377f9", "comment": "Malware payload", "value": "307452ec5c2b08d14ba99f8c0db9f14c", "object_relation": "md5", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645319, "uuid": "ec86d44e-0cb0-4f15-89d8-b9fa975f8db9", "comment": "Malware payload", "value": "d219672c98ca55de848484b7b78a06d68dca5f105024e6615ed50abf58a165d8", "object_relation": "sha256", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645319, "uuid": "bd743da1-25b2-4e88-b46a-5f4c62eeac11", "comment": "Malware payload", "value": "01b881dc01a60af3ec8e97dcfb7a8756f616fe1a", "object_relation": "sha1", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645319, "uuid": "2ed08711-f761-4a53-94f6-0139ffdef540", "comment": "Malware payload", "value": "11e1e59bff0e23fb4c9802f06bb98a9ecfcee323a68118427f3d8ac079e307d65822f74c2ddd6d37176009ac9d2f7f03", "object_relation": "sha3-384", "Tag": [ { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645319, "uuid": "363ac9c2-bb87-4a8c-92b9-feea10a1e2d0", "value": "T1976733996CA09473DA7FC23324A90B62DB371057A6B7CD5F24ACA0888D9FC911EF50D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645319, "uuid": "6f496d18-c154-46e8-bf29-96b608ed01d0", "value": "786432:L5AwoX7LWMFAcA9f+ha6EU09Rfm+I89dE2Rql/E9EIgh:SwoX7LTzA9f+ha/U0y892OqSEJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780645319, "uuid": "cbefea46-375f-47a6-bfa5-d4ef86200a6b", "value": 30067844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780645319, "uuid": "62f09a1a-44ee-4813-a241-48db40f2f848", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645319, "uuid": "23bf57fa-a1aa-4884-8881-dc73dbf0b155", "value": "d219672c98ca55de848484b7b78a06d68dca5f105024e6615ed50abf58a165d8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b28fc43-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780667308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667308, "uuid": "2d44bb66-52ae-41a9-8178-6147bfd9f636", "comment": "Malware payload (Mirai)", "value": "161cbbdbcf64050659a47e2109f96cc5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667308, "uuid": "fc47d1cf-2aea-4820-9b1a-f1a16e0696b4", "comment": "Malware payload (Mirai)", "value": "d28497be1e202c09e56ae3e91aa0f486f728278bd60cc0c5868df562b4973830", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667308, "uuid": "5d8d2c07-4616-4a3c-8268-88f5033f4d4f", "comment": "Malware payload (Mirai)", "value": "47bfdf35fb5314e5e98d4172dfdd7e2742e04981", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667308, "uuid": "b836e72f-419d-4ee6-a503-a704e2bcaa24", "comment": "Malware payload (Mirai)", "value": "fd505faf954cd23808c01d0c6d4790c8d842e8865565814a9877d14ae671e26ec7a3b080dc121c703aea6ce55155ac2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667308, "uuid": "fd562ffb-4116-4fa3-8243-61af14b8279f", "value": "T1DEF33A55BC928B21D6C613BAFE1D528D331327B8D3EE7213CD146F247B8A56B0E7A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667308, "uuid": "74ec71fb-2fa6-4672-bc1b-f8583c6a4b60", "value": "3072:Qz1+Od/OM6JT9jfI2+HmFPlHkIemYyhdjYO7jQiP7LaQD9UrhZc35OYb9Q4W:QRj/OdTI2+HmFPlHhef6jYKsiP/a4GZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667308, "uuid": "c2c521e2-a84b-432f-8f58-343b6f2d956f", "value": 161300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667308, "uuid": "a40289e3-d115-4c08-bacc-1c0d64652a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667308, "uuid": "d377fb30-ccfd-4374-b32f-838502c5216b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f88def-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780641521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641521, "uuid": "6d197c89-f907-4b41-8292-6560f222c109", "comment": "Malware payload (Mirai)", "value": "203c37daaab7d672c9ac0bd2ed6b7fa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641521, "uuid": "d6266779-09e5-4f85-a51a-039ea800f478", "comment": "Malware payload (Mirai)", "value": "d299b3d6d12a57c1af95b364e4808cfaf70ba3169206594d0f29316e3a35b849", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641521, "uuid": "a7e137d6-32ed-42b1-a86e-e06d5e815725", "comment": "Malware payload (Mirai)", "value": "5378701c33713ad508d2ccd19af6a61d274830d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641521, "uuid": "23c61578-5eb5-4ad1-8a5e-f266a9a10d39", "comment": "Malware payload (Mirai)", "value": "81323c95b52811774a49a1b6ab7672f1da48ea26c28038b8911ec1f697c11e081fdff166a3edefee1a52d0310c08684a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641521, "uuid": "884736e3-96bf-4b8a-bce8-c4608517a737", "value": "T173336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641521, "uuid": "fcc94612-6e0f-4ad1-8422-1e473be75867", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641521, "uuid": "e037eb8f-a70f-494e-8228-6edb735f24e5", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641521, "uuid": "cc79e65b-f39f-44e5-bad1-8aac0973685c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641521, "uuid": "23ad8685-e764-484e-a598-e3b166380be9", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c299752c-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780648637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648637, "uuid": "a37394f3-1e6b-475a-a7db-e2214c97512e", "comment": "Malware payload (AgentTesla)", "value": "c1cfaa5608a6977caf69df8639f2ff02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648637, "uuid": "1ab5643d-0673-4c96-8ffb-208cc5790346", "comment": "Malware payload (AgentTesla)", "value": "d2e177262faecd9865d780723c92fa5a1a642ba802703e0ec893db360b012635", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648637, "uuid": "a71ac72c-e0f6-4fae-852c-87ad7da02811", "comment": "Malware payload (AgentTesla)", "value": "772b9e059aa36dcd78a732cc5953c8f842c26986", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648637, "uuid": "2bcab35d-b4bd-44a6-983f-625f6f089fd6", "comment": "Malware payload (AgentTesla)", "value": "96f7587bbf670634373b988e9dfa068f8b60549efe63f5e3f000007345ee15b9a3c6cdb7e875767e31b3d4e0fb34490e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648637, "uuid": "abdcaa42-6e2f-4573-b24b-03074b6e7a39", "value": "T16CA55B17D66E974D180A7B61106A5D9AFE89CAFCEF727BC4E0CF90B510EE1110B852B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648637, "uuid": "4969513f-d9ae-4152-ad0a-ec33d7521f1d", "value": "49152:8y5hjvoPrNu7MqHHFb1JcEdrnHb2Bpnu5xYjzKmiE6eVH0:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648637, "uuid": "e04d6fcf-2eb8-4222-985e-bbd38bca06e9", "value": 2168852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648637, "uuid": "f3ac1511-c1ee-4a69-b896-616939bf19af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648637, "uuid": "850d8690-6b4e-4063-9bb7-6946f2206d99", "value": "ITOCHU Items Listed - 20260506HST038.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f517b4f9-6104-11f1-a769-42010a9c0008", "comment": "Malware payload (Koceg)", "timestamp": 1780680934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680934, "uuid": "843c29b0-4eda-409f-be9f-fc2082dd0259", "comment": "Malware payload (Koceg)", "value": "f2f3792753ec8efcfaa191c32c7af94c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680934, "uuid": "feb88d92-a0c9-44d7-a7ff-0e36682ed53a", "comment": "Malware payload (Koceg)", "value": "d4bf23afb7a9ceec28c766dfea93cf0cab3d21c8dcab9c02de6f8cca3d97578b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680934, "uuid": "8755d79f-ce6f-4dd6-be00-65de3ce3cf1c", "comment": "Malware payload (Koceg)", "value": "1bfcebfecd3a135134f2c8ebe74005fa84d6d4f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780680934, "uuid": "9ecd3d3a-9217-47ea-8340-641913755ebd", "comment": "Malware payload (Koceg)", "value": "25556f55107a12639ab583bbb8bc44b60012ee0134ae183eaafd81f666afc30c8b28b36cca44b6d05a4ceef3e7298b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680934, "uuid": "204eeb7b-6171-4dc4-8961-c7db18301114", "value": "T123C4230011E6DED6E092723107D32BF13E552F3785E5AF950BFA6AE11BA39CC48C249B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680934, "uuid": "94ebf563-2fd9-4dd0-a42f-169b72aaf234", "value": "08b656407b8d307979dc72c3fcc683a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680934, "uuid": "240a2ae0-e167-4f4b-8022-19a3e86ff24b", "value": "6144:ACZlWG0GN7xOz2x23dNs4U1JOhtpWhkPWPbGkOCqAQbgmYblg:ACCs5xOKx2Nhfpn+jGBCqAQb7eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780680934, "uuid": "84243e35-742b-4988-a3b0-34111188f198", "value": 551115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780680934, "uuid": "7550382e-184e-4936-98dc-749014a1f90b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780680934, "uuid": "a07bc069-18af-4c72-90f3-1a644193cd87", "value": "autorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4af342-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681971, "uuid": "8ae74b74-631c-4938-bccd-95c915ee9412", "comment": "Malware payload (Cosmu)", "value": "7aca7e29faba438bbaf6738313624c37", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681971, "uuid": "ef732f06-9532-454e-99dd-c31b8acf9ef9", "comment": "Malware payload (Cosmu)", "value": "d4c74c2a12f556db3efc266af9c1629d30b97327a61c5cbdc06c87f562764cc0", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681971, "uuid": "f5a72710-12d8-4280-9d5e-77b2f9e7d788", "comment": "Malware payload (Cosmu)", "value": "caf607930d46a9e0c4a8e17e8ac14495032d45ec", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681971, "uuid": "3e087194-aad6-4621-87a9-1dbae0db4279", "comment": "Malware payload (Cosmu)", "value": "9ce242f82cf2cef6eb9fac5941d9baad40c394334b2fc09094e12f00f684d771cc3d42020b06edbba4a6fa86fc9401e7", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681971, "uuid": "195a9145-f621-4a0e-b3a6-5097ddf44889", "value": "T14044F1453D93C4B3D041497289E58BD18B7F6D03BAA1E15BFF9D0A4B4EB02984BB7361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681971, "uuid": "151c903d-77de-4392-a887-ed6288af4cbf", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681971, "uuid": "f9a3b653-e61f-4add-92e4-ae65d7db021d", "value": "3072:zQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBV:e9lKgzelZNQSBQGH/CSpWqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681971, "uuid": "d9e613cc-dd6b-4a8a-b8a7-6daae479fab1", "value": 265088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681971, "uuid": "fb95cccd-fb7b-41f4-b922-8002b1a6c93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681971, "uuid": "02ceb500-89c6-4286-ba77-e9c08654dbe3", "value": "AppSharingChromeHookController.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b168ef-60c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780655210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780655210, "uuid": "ba44953f-028a-4f5d-8775-157e52210a44", "comment": "Malware payload", "value": "47311097d3c5866b80f61d1b6e99b711", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780655210, "uuid": "2ee52a2d-798a-46e8-9ea7-808dd5dc3b8c", "comment": "Malware payload", "value": "d4e2fc9946830fa27ea397c7dab7ffc56501f7b75df4deede18bc2708fa23f1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780655210, "uuid": "5c2a6ea8-fb44-4244-9521-f72087b6eb1b", "comment": "Malware payload", "value": "1b1ebd0b8b9aafc5b30b9b341d90f9a9432cf974", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780655210, "uuid": "12354739-3e58-41c3-9e14-a04b5106ebf0", "comment": "Malware payload", "value": "c5b13473f177c025e3667589267fd2db78ecf1cd4c2971e788b3f75b2b9ba2bfbd0bb75b99fd8bc23dd442f7bc7f0b85", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780655210, "uuid": "37451f29-4416-4166-8a6f-e93b0f9b0768", "value": "T1DB05D53DCC54012EE132D529C5AA049FE893660B633CE81B50CE7B5BAF63886779739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780655210, "uuid": "b934d189-23f4-4dc8-b92a-04eead7ffea4", "value": "3072:UuSVcBb0QMQ556UHsum2XKWpiBzHO1Kk5o78qdSel1/0df55MIwsxQWOzsZGO79X:JP/6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780655210, "uuid": "cdeeac4d-ebe4-4fcf-b06d-56a9af45fb5a", "value": 823312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780655210, "uuid": "22aa4f4c-471e-4a1f-9a36-96654fc6a1ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780655210, "uuid": "259f9251-6a62-4fa2-a5f8-a19efcc5ad17", "value": "Payment_Receipt_Swift_50%_Against_Order_Confirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339fc34e-609a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780635083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780635083, "uuid": "15b34268-5481-46c2-8d9e-01d266b7f03a", "comment": "Malware payload", "value": "3a4e29fecbc834c2192a51f2c10d66b3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780635083, "uuid": "0fdf9f21-b8c6-47a9-b9f4-88a05a3489b6", "comment": "Malware payload", "value": "d58fea3df011e3434ac8d727d933e9220cabaf805ea5de89f475f9f1e84dbfd5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780635083, "uuid": "1e5908f1-80e0-4324-9eec-a8d0741b6990", "comment": "Malware payload", "value": "9c64107dde991e41d3140a0b9cebb79b8c483228", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780635083, "uuid": "6d7ccc75-7c07-408f-bc23-7096e56a316c", "comment": "Malware payload", "value": "be17b6f6510c1178369f790e1ea63e705c2e366cd2e75d61a4af0fe7e31aba42f8eccb4baa5476afc4f75a6b0cb00f43", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780635083, "uuid": "297d3a74-2c81-430c-882e-e5fd7771b39b", "value": "T10D018CDFC106DB6091C5E86D22E76244B42183CB29418FB5BE6C94BEABA9B0C7075E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780635083, "uuid": "504e3c0f-1ccd-4980-99dd-cb5dc447d941", "value": "24:kXCKysE2hi0ziQvZoha1+fNb6mXxeEOLdjWeX:e9Qp+Ms1seeYEcj7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780635083, "uuid": "e6b629bc-7b34-4235-9811-095829480f5c", "value": 851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780635083, "uuid": "a3533a3c-6372-422f-899a-c2b1af0c35c3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780635083, "uuid": "44cb59d8-da31-4903-8c7e-d07f4cf23a67", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b46811-609f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780637185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637185, "uuid": "414d1fcc-151f-4e56-a9d5-672f77a93272", "comment": "Malware payload (Mirai)", "value": "44d6ad643ad711263c90ee5eac4c113d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637185, "uuid": "9e15f999-c2a2-4cb7-903e-60831d6f75bc", "comment": "Malware payload (Mirai)", "value": "d6181fab256865b24e4a8926786083b1476d1f39b792c6126535ff87526a67c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637185, "uuid": "4a330792-3f1a-4240-b6fe-dba21a8fb93e", "comment": "Malware payload (Mirai)", "value": "328b7125b910bec2f8bc4c101d6d2ba3f7beac01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637185, "uuid": "582dbeb5-1759-4608-a026-2c6222ad0287", "comment": "Malware payload (Mirai)", "value": "c767cddc0187f8b46993de23f2ce1ac2c38bd464507b964270423158cdfcba85c9022452fdac08dda56748119582d36f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637185, "uuid": "e82204bd-fbf8-42a7-9910-0e1b382b708b", "value": "T17F34543A7A12AF7FE569827107F39E708F5925D736E1D284E27CD6084E3118E184EFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637185, "uuid": "4ca1a9c8-342a-46f8-b081-7efb6c927a33", "value": "3072:/3XLK5SBbso39DmT+HXFj7qmbtQZ+KGMjfe2:/Xo/qHRqQSZJGMbe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637185, "uuid": "6550d984-56f4-4da7-b5b9-dd9cfe9dd26d", "value": 244436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637185, "uuid": "f47cf90a-7aae-4c29-b298-6bbb0cb6cd4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637185, "uuid": "1a78dc20-421f-4626-b575-c427a42df18b", "value": "d6181fab256865b24e4a8926786083b1476d1f39b792c6126535ff87526a67c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398d8cbd-60df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780664728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664728, "uuid": "39b9d7e4-1256-4c4e-872b-7558ee94d900", "comment": "Malware payload (Mirai)", "value": "e391b07343d78b29355efa1d98aca83f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664728, "uuid": "1bc0f4e9-d3c4-4ec3-b213-4f61458f64a6", "comment": "Malware payload (Mirai)", "value": "d66fce565de64d2c8cc970e357c7e0eef3dbd930fb4016cec469ff50c1112c2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664728, "uuid": "d776fb70-b631-48a0-9de9-dcdc7116503f", "comment": "Malware payload (Mirai)", "value": "21923794d7178c27823011ab113b0885ced42a37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664728, "uuid": "943c6616-5bde-4115-ae71-1e7d3e200f33", "comment": "Malware payload (Mirai)", "value": "f665d24b26dabf7435f684cafa0be318444767e5981a05377ff35ffdf1f46359531d9d23f8efb396cc49011f8d46ac60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664728, "uuid": "4965a4ec-21a1-4899-871d-ab77846900c2", "value": "T171539E77D9366D98C44942F4B8B04EB81B53B144C6A71EBB1A95C13B4003EBCFA5A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664728, "uuid": "2c7feb56-3b00-4c30-9329-c607e06bf655", "value": "1536:nabwt4pgPKqV34kyKgaMit7gJ3nCOGg7nqMX:nsTgPKquiguM3nX7nqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780664728, "uuid": "9156057d-db7b-4370-8273-9857f91538fb", "value": 64744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780664728, "uuid": "7410a0ed-5665-47da-8498-c409714992d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664728, "uuid": "cf9ecb77-ec12-41ac-bd68-e7822702d69b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8cce6c-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642428, "uuid": "6b7e69f9-9463-48eb-a3ab-52c702c0a46f", "comment": "Malware payload (RemusStealer)", "value": "e06f6fc576974fef10a730630d18a94f", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642428, "uuid": "d13ec50a-c1d3-45fc-8e01-ab8fbb8badac", "comment": "Malware payload (RemusStealer)", "value": "d6f83255e60538c44c5de7979e0ffbf2846102221b395e1405f3c8a02f5b2d47", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642428, "uuid": "8571e0e8-872e-4cee-a623-19b64eb45003", "comment": "Malware payload (RemusStealer)", "value": "57b538ac091c875bf77385df3bef8d95ed931a34", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642428, "uuid": "0614bbd5-ae9b-48a1-8f86-d8d16ac9bf32", "comment": "Malware payload (RemusStealer)", "value": "0b46b1dd44b5c237198f5de98d4a32265c089fddda36fb5a92040357265b8795fa0090fb7ef4025148559b61e2fcbaf1", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642428, "uuid": "24f3bb0b-4f24-4a5b-bb0f-8589bd2c2542", "value": "T13B26D025253C5062F98962B2D000600A18B4BDF9469F04BB69B4FD493DFBFDB3B5F866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642428, "uuid": "93b9156d-1860-48d2-a8fa-8e9b139fb964", "value": "4fdab10359a081f74b3e821db34c941f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642428, "uuid": "24c76717-919e-4058-9fdf-65bbb780186f", "value": "98304:gFYBDHNOQFbpFiUgL/AjgjCDe9Id9V5zfJ/AdyAGnhIv:eaDbTFiU7Az9qV51qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642428, "uuid": "d5259723-f39e-4741-b57a-1d7ffc2ababe", "value": 4841472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642428, "uuid": "5914c008-17da-42a4-8efd-3387dec1a8b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642428, "uuid": "5d6cc2a3-7e29-47c0-affc-88c7afd7b592", "value": "d6f83255e60538c44c5de7979e0ffbf2846102221b395e1405f3c8a02f5b2d47(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8e597b-60ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780671682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671682, "uuid": "6477606e-88a0-4f0c-a1f1-27b850de02b1", "comment": "Malware payload (Mirai)", "value": "c1945cd9e36c31cbcb1b3c092958c55b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671682, "uuid": "8da49651-ac46-4ce3-8c6b-c7d665ae9630", "comment": "Malware payload (Mirai)", "value": "d72c5a38f10b32b6cc34080a2f6579972abeff741f3402bd83ad0b2dfef22e90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671682, "uuid": "f257eeb8-8b8b-485e-9f2d-34ae8ea44473", "comment": "Malware payload (Mirai)", "value": "7850565c8ad7886741aab50a12a9a07849f57770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780671682, "uuid": "ed31fe9c-25f6-437b-917e-2b09ced6433f", "comment": "Malware payload (Mirai)", "value": "35516a8105897ab5479c27a68413d176dfe2118199387b4755037956f3af2a1ad52b16694cb85475d9e1d334abf95bc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780671682, "uuid": "8a0f645e-1260-471f-a129-46ead8675e96", "value": "T136A31886BC81C612C5E061B6FB1F91CD3B5643ACE3E67103CE19AB19775B86B0E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780671682, "uuid": "f3f4cb67-553c-40de-b10b-52a1a1933e01", "value": "1536:+fFCqt+BdZY250V0//d0PwetPoioBBTIm1JSNXpVvW:+f7Udq2Vt0o6gioAmjot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780671682, "uuid": "d225d0eb-1ffb-43ae-b73a-17932107c758", "value": 97860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780671682, "uuid": "c88fe248-bbd1-4298-ad9c-73f9cebc6e62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780671682, "uuid": "02d2e669-0db5-40ec-a61d-417c73e6e12a", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34de968-609e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780637095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637095, "uuid": "1777e34a-8f6c-4aaa-9a35-e7d9c215765d", "comment": "Malware payload", "value": "7b25f646028fde68644f9ce536d66a27", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637095, "uuid": "bd64f3c3-799a-4abe-bdbc-f2087059441c", "comment": "Malware payload", "value": "d74ce4aaa48d5ccb1452dbfd01a374b77b88e8305725dcdae917588babb9e7fb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637095, "uuid": "e151afc3-5b46-4be6-bb9f-06524989ede7", "comment": "Malware payload", "value": "ee6591cedcfb3831cf0fd7c596d3ac3597baaef0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637095, "uuid": "2e6ccf10-a12e-4415-b70a-4c3220b1002e", "comment": "Malware payload", "value": "b395e0e2b1ad626edf2013cf2e355eada24df8470d75e4ba2ea544f5afa429482ab2e6c9a74d43977c7801833aba9d68", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637095, "uuid": "ec8e9ad3-d73e-4bda-86b2-f68067206e56", "value": "T158136C6526953C25AE99883B5D7F2F0CBDA983E2304491DDBF8A3CF18C15A9CE318719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637095, "uuid": "d924abf7-a6b6-4dcc-b743-a687f8c0d111", "value": "768:Pr9NyXsZztC19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:zHusZTco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637095, "uuid": "2cde04ce-f053-408e-9398-d32b79e15758", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637095, "uuid": "f2021397-c4bc-46f6-a5e3-161953775ddd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637095, "uuid": "ce85c207-e97d-40a7-891e-96fe418912fa", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a562b167-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681659, "uuid": "9761a7df-8ce9-4bb9-8945-4815d9bd66d1", "comment": "Malware payload (Cosmu)", "value": "ecbbc276e44d9ba436b86545aab1e7e5", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681659, "uuid": "a39b3791-aca2-4361-98e5-2c18db21ead7", "comment": "Malware payload (Cosmu)", "value": "d81b99dba481fb74fc34aeb3479686bb878af1f359752e7b3c3f09240abdec97", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681659, "uuid": "21a9ad83-60c4-4d8d-bf64-db20f38bcc49", "comment": "Malware payload (Cosmu)", "value": "e93e038854952599803f83fe9c257b2bdae3bf84", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681659, "uuid": "2c73e087-c34d-4939-ab43-18eb4efb02f6", "comment": "Malware payload (Cosmu)", "value": "a835d35eb419acd8a2b01d5b2e1df42273e178f50db5c6b352db6f553bee6c398fae44015873bbe708b84e6672ca04d4", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681659, "uuid": "1096c536-6e03-4cbd-9051-8d6e65f1ba9d", "value": "T10B65AEB27B93C26BD4EBC23DB5848557A7F29B024D5392A397A0DE3DCA391814DDCC42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681659, "uuid": "4851c853-3e90-46b0-b7ea-c3457a073f2a", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681659, "uuid": "5455038c-2896-4567-a148-521406b19330", "value": "6144:u9lKgzelZNQSBQGH/CSpWqTPueF/mNyB:BfBQGH6SfKCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681659, "uuid": "b020697f-5621-4982-9195-6b51c8fd4449", "value": 1541014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681659, "uuid": "d6d53771-45bc-4275-88fa-ab517c06f077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681659, "uuid": "69a419dc-28c0-4bf7-b279-4bcdd79797c8", "value": "node.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64375419-6119-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780689710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689710, "uuid": "926ee7ce-82d4-4428-8ec9-a20fcabdf57e", "comment": "Malware payload", "value": "09931d251c5cd7de85d6da51d8217fdc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "gsk-scriptlattice-cc", "colour": "#CD2BCB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689710, "uuid": "defbd6e3-a9d9-4652-93e8-e7d0f3e31248", "comment": "Malware payload", "value": "d88efdaa4d897576e5e7c8aab16068386ca4b9a4de0a1e4d17a0c4d59b48b25e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "gsk-scriptlattice-cc", "colour": "#CD2BCB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689710, "uuid": "71a08e9b-7a9f-478c-bd49-ce80783c4398", "comment": "Malware payload", "value": "94303bd37704fe1fe5d21393c64f0691f65e1945", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "gsk-scriptlattice-cc", "colour": "#CD2BCB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689710, "uuid": "83e4e28e-0db0-4b22-b0cb-644d895e63b4", "comment": "Malware payload", "value": "e222d238d6b1874ff0c8bec39eb3ed532bccfddb8469f0551bda7c1765fc2bb8967f2487853070500202b6b9f033d21a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "gsk-scriptlattice-cc", "colour": "#CD2BCB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689710, "uuid": "314307a5-7b72-4248-98a6-d01030531fbc", "value": "T16227338A50B61FCACC8B1939D4D3254387ECB326530565BF5BA8D7B72EF53B1906C882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689710, "uuid": "dc1ec9bc-7c8d-454c-a843-732fd2ce3a31", "value": "393216:2lbzJRDTHu+ST1J0JfLJdDsLV3L5Wh1ozktAFNwqghhp6DcK/qTZ:UbzJdLLST+f9dDsHWfozWAjTap8V/kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780689710, "uuid": "2d9761eb-77c4-4842-8390-36c43f3c86e3", "value": 20972558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780689710, "uuid": "521aa229-e240-4a9f-b504-9db6720fb288", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689710, "uuid": "27ba918c-5561-4fcc-b5c0-ba28232574ae", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5af0bb5-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780641851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641851, "uuid": "f114ca6c-b4b8-4ffe-b274-692000b0e9e0", "comment": "Malware payload", "value": "4c93920d47ba196d99e2f62a78b854eb", "object_relation": "md5", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641851, "uuid": "00bc7c93-f9d8-4e95-a322-4cb77aaa7c11", "comment": "Malware payload", "value": "d95b3a9cd2504cc39d26aa91e0ca26c6dc36ceb0cd228cd7edf20f9ed615dba5", "object_relation": "sha256", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641851, "uuid": "d3a765fe-d9a1-4a9a-abb7-bab6f70d5546", "comment": "Malware payload", "value": "f5153bb66321e7235e573bac29ede7917fdb2381", "object_relation": "sha1", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641851, "uuid": "9e42dc06-c064-466d-9327-47f2e4a57eb7", "comment": "Malware payload", "value": "2d7b83fdfc2c617571c908c7b9512259b3861cf8dc7b0c78bb8379b35a806192da8db45c25ac5e6f497cc0975a18ccf5", "object_relation": "sha3-384", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641851, "uuid": "ef2f5b90-b21b-498a-91a5-0e16d8fdd9bd", "value": "T1E627CEC0F228F548E7550570582936A849662D303754D9BABE8F7AC259782EAFDF0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641851, "uuid": "0baf0780-f9e1-4a75-a8d1-0eeac075128f", "value": "47188af6e564b6d35063ff93cb623f42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641851, "uuid": "1987d70e-9026-4f8a-a12d-b9219253b5dd", "value": "393216:oXVxcaTtqnn2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlkr:olxcaTtqnK2OGfEhP0JqHOG8qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641851, "uuid": "eac9e1fe-60fc-4501-b5f3-757ca6ee5004", "value": 20968520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641851, "uuid": "65a23f6e-b581-435a-96c8-df29713086a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641851, "uuid": "db820cbc-5d8b-4a9a-b112-cd75a9be16e2", "value": "d95b3a9cd2504cc39d26aa91e0ca26c6dc36ceb0cd228cd7edf20f9ed615dba5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f95719-6119-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780689554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689554, "uuid": "a4173b82-f26f-441f-b021-7306d61565ad", "comment": "Malware payload (Mirai)", "value": "a09511f30c92e57850ca0eea9558800c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689554, "uuid": "c0cd0f91-10a5-48a5-a7e4-d22590e1500f", "comment": "Malware payload (Mirai)", "value": "da7ab267f5b8679dadb8ee815d534a5c7d46effaeb853de7d4f7724013607ff8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689554, "uuid": "fa6fac03-1a88-4067-bd9d-65527a7b65d6", "comment": "Malware payload (Mirai)", "value": "e0a920b952b46df13cc3b1d20afd0199f866842b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689554, "uuid": "9597cad2-190d-4421-9675-f926035d2e45", "comment": "Malware payload (Mirai)", "value": "21397072f361695f92f9bf9cf496598cc90f7d9e110deb55852b3e8752834bff40c0da57126d989771a8db24ead3db00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689554, "uuid": "20dad5e0-01f8-4aba-a09b-f0672af4737d", "value": "T16BF32902770D4F43D2932EF02B3B2BE1979BFD5228B4E544751EBEC982719B2504AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689554, "uuid": "bf54f11c-4912-4430-9c58-b51fa59ad295", "value": "3072:8lCXhsbejJV/0J9je33ixWpyvzs+w9xaDkOAab5CT8:qCRsajJUjenixWcvzs+Kxy1b5Cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780689554, "uuid": "95bec134-c14f-4588-923b-ae75f78eb3b1", "value": 158964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780689554, "uuid": "31a19798-a88f-4e02-a411-fab72726ba33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689554, "uuid": "35fd70e9-725d-4296-bcd0-4f07ec283097", "value": "nova.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2e31ce-60a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780640518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640518, "uuid": "06b6aa9a-f20d-419b-9fb4-6e9ae4306a34", "comment": "Malware payload (Mirai)", "value": "e00f8a30f1f5343bea17aa40e91d2af3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640518, "uuid": "3c91a4fe-b8ca-4b48-93c1-4d6424a847c5", "comment": "Malware payload (Mirai)", "value": "db081e4040a7981720795754b47df6f53aa45abdcae2d1a2f440a4096c8284ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640518, "uuid": "c40cf9b3-48cd-4daf-a61e-3e5fd915e005", "comment": "Malware payload (Mirai)", "value": "01b9d902817bdbb6a58c09173137b1802dd4854e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780640518, "uuid": "393bc8c9-4aea-4b3f-80c2-d54ab340502c", "comment": "Malware payload (Mirai)", "value": "0ec91147e7bb63e196d929b6a7a2e354ff8e9f50c9e9e6b5e6b552d4a3ee4910a956b9d823b05b37504f5ea78257772d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640518, "uuid": "75eeb311-f293-4fea-b72e-8492f4665308", "value": "T140932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640518, "uuid": "02a5182c-f235-4913-9e3f-c19ee799183a", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2k:AGUJtkyYEETn0T32TDBf0nsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780640518, "uuid": "c391a983-196d-4bbc-b546-0f2bce937f99", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780640518, "uuid": "0938efdb-c4ba-4b1a-87af-c5247b21d1f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780640518, "uuid": "311ada7a-1067-4339-9ed2-a6813745810d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34344eda-60df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780664719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664719, "uuid": "76964b48-4990-4b51-93a0-f7dda341b6d5", "comment": "Malware payload (Mirai)", "value": "fdff04770b0a26a806634f00747c54a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664719, "uuid": "0930ec1e-684f-464c-9dc3-f2eae069bce2", "comment": "Malware payload (Mirai)", "value": "db3ae84801abde88f8bccd5928a7c5eb719b3d145eb8e630e93fb750b8bd5094", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664719, "uuid": "0a75999c-5c94-4812-ac4e-f638f9c2cfef", "comment": "Malware payload (Mirai)", "value": "19058a86a128623530280c04a684e06a1977c429", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780664719, "uuid": "449b341f-7018-4964-8e60-431c2445cdca", "comment": "Malware payload (Mirai)", "value": "577118d48ca7c897f99fbda7304508f27b45f594725a8ee1daff3958d7f272ad4f1c0eaa3d863242537435ac8e824a0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664719, "uuid": "65c2315d-8909-4f35-98b1-52babc6df4b5", "value": "T1AC734B9BB400CCBCFC5BD6BB84530A05B678B74A4F820F36B76AF9A36D710944D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664719, "uuid": "fd440d19-20bc-4bdd-acad-0e1a00f6b8a6", "value": "1536:/OV9Li0E9aQTHWKcZAAcOyJ2l8h8/+7RTC0Qwye7bcVX6PkV4l:/OV9206THWDpc9J2h/aCbwZB8ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780664719, "uuid": "d006ae7a-e04b-4eca-af93-829e59cb1cbb", "value": 77732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780664719, "uuid": "ed76a1c3-266c-44ea-8948-84afda433e21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780664719, "uuid": "75e9f3b5-ee29-432e-85f0-221ae0d23e61", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2d3172-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642162, "uuid": "5a5ffa0b-5a44-4969-8cc8-1fcf3c0a13cf", "comment": "Malware payload (RemusStealer)", "value": "5925f0c68d9c8b42f8b40596eaac26a4", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642162, "uuid": "58510e69-a431-42cb-9da0-dfa662ed2a0b", "comment": "Malware payload (RemusStealer)", "value": "dc42010e65be814db0efb9da71b28c28c555f391b7a053f21fcd74729f55289b", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642162, "uuid": "72ad0a34-f810-4498-b691-2c0c806f335a", "comment": "Malware payload (RemusStealer)", "value": "adb063f9534836ac231afe675764aea4d1792f6e", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642162, "uuid": "c0a424aa-ef04-4629-9e5e-a15b77cb0fb0", "comment": "Malware payload (RemusStealer)", "value": "d353ca61082fcc7ca6d88b4a2d5e33f75d5842a42bbbca6b89092af10610e2c4a56e0dd045870d197f4b435703b18903", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642162, "uuid": "4967ce84-744f-4c68-88e5-75f7789855a6", "value": "T1C505C534D9A7E95CF8213CFB8AD9C3A6E4E41D2EC8070416223476995B72193FEC947E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642162, "uuid": "1e3a3e83-5bdb-4781-bbd2-fcb7a3cad33d", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642162, "uuid": "ad230a83-5ba5-4061-8392-fc21d96ae50a", "value": "12288:R6QEA5TajpOerbgAjYi6xiA3qDtbo/vSKdsSl300BVpCR7uF7rJ/bp:RdD5WDUBiKOy6K2Sl300YkJN/bp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642162, "uuid": "7f73351f-70ad-4b6c-a97b-c032003986e9", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642162, "uuid": "683a49ba-db0e-4f43-b85e-ab8b3b827f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642162, "uuid": "bdfcd5a5-243d-40f8-83d0-faf8e655ccdd", "value": "dc42010e65be814db0efb9da71b28c28c555f391b7a053f21fcd74729f55289b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdbd71b-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780667309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667309, "uuid": "379f024d-0a95-43dd-bc88-758b4a120590", "comment": "Malware payload", "value": "4eaccd315fb556663a8e6768c7dc3bea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667309, "uuid": "4785aa17-ea26-4bd5-ae26-0329226ff5f5", "comment": "Malware payload", "value": "dcc985ab11f44c12b8ab988a623c8933e64a94cc399ae5603cf32ef32f621df1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667309, "uuid": "1311fa4c-5733-4bac-a9f0-b9788d907127", "comment": "Malware payload", "value": "270e5f44fe6154e0dc9281d112bdd79867745acf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667309, "uuid": "9bc36bb0-e7b4-45be-9bbd-bc845d2b7577", "comment": "Malware payload", "value": "78f80bfb482d500c69178c1a3cb9d908f8dba793a8b56c251343da15718ea481d36289104d117d04ab7ff2515bf7a75a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667309, "uuid": "668ebddb-0747-4dd3-a94e-586e265f0bea", "value": "T18AC012EAA00621528018FD04A036EE59B03BEBDA1810A60829AA20A9C88881C7128A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667309, "uuid": "35cd41e7-6616-459e-a6d5-d1e7b117ebd8", "value": "3:L6FnSCAj5AXwgiaGN3zSIMKFR+Yg6FT7SX5AXwgaaGBzSE8KTZiXg:L6FnGj5AANaa6Yg6FTWX5AAvbTZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667309, "uuid": "67733e8f-e5f1-445f-87cc-b8a9ca2ad537", "value": 160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667309, "uuid": "c7701385-f819-42ed-8f56-d2f7a1120178", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667309, "uuid": "0ab0db53-67f0-47c6-8c42-063b2bfce908", "value": "dlink", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471c0bee-60c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780653584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653584, "uuid": "d00e7b2c-979c-4131-a5d3-f73a040f920e", "comment": "Malware payload", "value": "6ddf868dc2e687534053cdc81129fc4e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653584, "uuid": "84723a67-d6df-4df2-93a6-ccd71a0e565b", "comment": "Malware payload", "value": "dcfe2b3280cb913673590cfed98ed5b481ab6ef34c87b9629f2c91b954307b51", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653584, "uuid": "26e35e50-ce3b-4609-99b3-ec297a0e4449", "comment": "Malware payload", "value": "2a691c3d2dffd6ff9cac10b040711439a121d5ea", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780653584, "uuid": "a9f04450-bb91-4587-a03f-4dcda630bd97", "comment": "Malware payload", "value": "0fc7b02b8029717dc655ca37aa926dd972609a53708f2105842020eb49aff9c760d7339329e59b02f55a1ba021179fc5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780653584, "uuid": "47b799f3-eb30-4dee-a3f8-6dd10305a748", "value": "T1B45733E58C63826F1C8CB6619522F93E60DC61EF957FEB803CC43F5D2F4586684A918B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780653584, "uuid": "75747d43-b85f-4565-82c6-e5bffdd24686", "value": "786432:27kLoQd3YXJWeOFAP54jWMVmWzyGIX8/jw5S:jLo+oMFE5yWZnGIMLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780653584, "uuid": "b0c6bb11-eebc-496c-8215-70b44a4f11cb", "value": 29376441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780653584, "uuid": "533f990b-3a4c-4ca0-8588-47e2b051b33d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780653584, "uuid": "fa0d0d9d-2312-42b6-8475-e58ba9a83773", "value": "pdf265290000001026905011_setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfac274-60ab-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642534, "uuid": "3598a8be-9149-4cc4-b853-43b3fb42fabc", "comment": "Malware payload (RemusStealer)", "value": "575caa2ef7e618d4b57b6bc3dd96b431", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642534, "uuid": "c0a75c16-c13f-485d-87b0-87fcd5998bce", "comment": "Malware payload (RemusStealer)", "value": "dda2c347c7e109775f28e5b3f90f9f10766b974e795b4a8ff1c45b2b377ac007", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642534, "uuid": "7a972be6-0114-44df-b911-8ce6083bf5c8", "comment": "Malware payload (RemusStealer)", "value": "54abf301bfe8b8d3cf36872abe8b0073e791af69", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642534, "uuid": "4d029cbf-4748-4057-98da-b99b6ed26491", "comment": "Malware payload (RemusStealer)", "value": "19e6c195e64d46e30eb3dd28ef11f6e9b76125dbdf82e2c6eb269fa786834f038c44424e9ab89c28400c282d96ae40dc", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642534, "uuid": "5211013e-ee36-4eb8-9596-b2295cc148da", "value": "T18224186BC16331FCE553C07883666232BB32B63C47749EFB02A2D7309E619D05E79969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642534, "uuid": "198839db-82b1-43f3-95d7-619df68255b7", "value": "20c08c2c4fbe56b4d08586185a84e7e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642534, "uuid": "9a418554-06b8-4417-b5a7-cb35992a52a9", "value": "3072:+uasQyBVshtd+fOUIA1qwMpfUkwMU86O6iy5JuRw1pdvbL:+SDs7BlDUkwmn6iy5JTdvbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642534, "uuid": "7555bc53-947d-4820-82e2-9b1a0bf649e5", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642534, "uuid": "d084cef8-497f-49f4-8b5b-e1622d9bfed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642534, "uuid": "6753f211-f725-48fe-a3b1-cb5bf2b71edc", "value": "dda2c347c7e109775f28e5b3f90f9f10766b974e795b4a8ff1c45b2b377ac007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf202be-607e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780623338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623338, "uuid": "853ab992-de75-4dbb-8f64-2132e6551377", "comment": "Malware payload (Mirai)", "value": "e2660d66a3ee1e85163482df282f3087", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623338, "uuid": "256fa8c7-f391-4398-924d-3c639184ddd4", "comment": "Malware payload (Mirai)", "value": "de8f5ee792888240242071cdce94bd1cea732cf4ec022032d22b53dad4d4ccb8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623338, "uuid": "10a1c1c0-0c2e-4133-ba2f-18bba1b79e9b", "comment": "Malware payload (Mirai)", "value": "15ed3b5028c5c9232ac3d064a7fa3d93fe3259f5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623338, "uuid": "833466ca-4183-44f7-adfc-6ad7ef43f71a", "comment": "Malware payload (Mirai)", "value": "e35e5d66db2d23ab7f71059da6cbc2cc26904d3908ea89215913cc067ef5c74b3632d4794cbbd99f21de872bf80f7fd3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623338, "uuid": "0e416a3b-1855-4da1-8030-b6054e594421", "value": "T194E09AD9B0BB28A0BC00BE4378518C947941F29B6A994F4978449F61CD86AB63038B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623338, "uuid": "8bc381b5-7fc2-4120-b0cc-fef52eed86b3", "value": "6:NdXrINu0ab0XrIU00a0B5LK+XrItLL0atLAtLhPXrIXGL0aXGAXGhkn:StCXWTM9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623338, "uuid": "4bc5eae9-5767-4f50-b8ed-8148d1b1b4bb", "value": 352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623338, "uuid": "aa7b2f32-903c-4b62-aef6-bf7e18670b71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623338, "uuid": "a401a777-c6db-4aa0-bd5b-cbb4fb33cab1", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad271815-60a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780637864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637864, "uuid": "38a201cc-6249-4961-9d4f-6141202516da", "comment": "Malware payload (Mirai)", "value": "1a6a7d4d96290c5cbe525f588c32bfcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637864, "uuid": "7eaf67ce-48e5-4133-82b0-11ba828eedf2", "comment": "Malware payload (Mirai)", "value": "df8041500b9171e974d574b7ff867cebf72ce38762486b1c6dcef760933db778", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637864, "uuid": "b3b92705-203f-4cba-baef-2448b71e0cfe", "comment": "Malware payload (Mirai)", "value": "281f79fb1fce1c639c60ccf15383616d2089695c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780637864, "uuid": "df8edad5-ff4d-4502-b095-fec894780bfe", "comment": "Malware payload (Mirai)", "value": "faec9951bcc063b0914c7d30683c7683de5e16ac99e0962b9b9df2cd94cc4861ced63bcda81e79b72d3b3adfb9de51b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637864, "uuid": "4dc8e5cf-7991-4929-a28a-ea846d520309", "value": "T19D3484366B519EB7C81ECD7301E589011CCCA5C712A92B6B76B0E65CF76B84F09D3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637864, "uuid": "44b29264-3bd9-4021-b5cc-e118f5cfa2be", "value": "3072:5m0rk1QwBggebi1y4nbQs+7yVfJJpXJqZzDeM7Hk6eN8Txv:w0Q1QwagNfEZzKMzNNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780637864, "uuid": "8b5e9c2b-6816-43ed-bdea-65af95c03df3", "value": 244468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780637864, "uuid": "3fa6008b-9ed4-4e74-bbcd-acb43b6a6695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780637864, "uuid": "287d347a-55c9-4d06-9c0c-ca25e51906ed", "value": "df8041500b9171e974d574b7ff867cebf72ce38762486b1c6dcef760933db778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c5f259-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780642114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642114, "uuid": "5c95484d-ab81-4fc1-818b-2d931e0680ea", "comment": "Malware payload (PureLogsStealer)", "value": "cc615b9c3187ee765af0bdaf7f942bd8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642114, "uuid": "a2efa383-f40f-4b53-bf13-b7a6575ba1a8", "comment": "Malware payload (PureLogsStealer)", "value": "df915ff4a85619f377c321e2a2cfd3d53051380b971441f117ddf16c8786a022", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642114, "uuid": "a0557fa4-7974-41f0-a39e-870513abbe41", "comment": "Malware payload (PureLogsStealer)", "value": "f890a94b69b80dee010423ea959332894cb9c519", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642114, "uuid": "cec066b7-22b3-4985-b5b2-beffb03babc1", "comment": "Malware payload (PureLogsStealer)", "value": "74292fc4ca331698bf307ddecff2a36a52784d7cf526822c3e05b8374de7d5b38734527779db97b7efe7f47684b07aa3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642114, "uuid": "71945e8b-e23e-4e1b-81b1-37a7cbf1ae19", "value": "T1BA05E93DD924422EF172C518C59A081FF8A6298B522CEA5721C3374F5EA384777D27AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642114, "uuid": "0889795d-446c-4191-9763-f3a43602d360", "value": "3072:7PhG0gjme1una8vcl6QnSIYORZRYsCT5IXrKwSYOpJBnSSvR46QSTQKBPZecieob:M0gjme1uO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642114, "uuid": "096cdb5b-788d-493f-9e81-cb609a4e980f", "value": 831844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642114, "uuid": "d3ffa65a-ec22-4310-8a57-4e6ba5f16acb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642114, "uuid": "35d0d4be-01ad-47bf-b413-54f4c1a6a1ff", "value": "Urgent Request for Quote-87653234567765423455_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ebb659-60d2-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780659217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659217, "uuid": "8dd4591d-99c2-48c3-b8c9-ebe381101a1a", "comment": "Malware payload (ValleyRAT)", "value": "c6bf31791ac11ea2d1602fe6a5764532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659217, "uuid": "556e76ac-125c-4dd2-b972-8bc0fb282caf", "comment": "Malware payload (ValleyRAT)", "value": "e02635368a39ba90646968a41cce5e827e6b88dc4d5c048d26434c1571539135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659217, "uuid": "933fb8a6-4df5-42b7-9409-29cfe31ab30e", "comment": "Malware payload (ValleyRAT)", "value": "6259454a130f8adc8a98eff703fa4a083ce20b33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780659217, "uuid": "6e73b6ba-16ca-414d-8597-40ff1c8ec378", "comment": "Malware payload (ValleyRAT)", "value": "6cb9339f23de60fa213f671e8c2ecddcc10de4244307f141ce153fe92e32c15dabcbe13bdd78de97e792d00c7d644e99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659217, "uuid": "da551a3b-1f13-4ea2-9b0f-d49a69f9d518", "value": "T15FA6D0E0A477BF1BFB73AE792038F61095A1A019D713D4397176DE3C6A96660283C336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659217, "uuid": "54b4cf8f-2335-43bf-8660-fd393d212d26", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659217, "uuid": "26d3793e-7022-46e6-b54c-bc3f74c894a0", "value": "196608:xAWbFiGxAS4JgChCFuY7hWc00Hh3U3wUDD94kCeMlJ9X:xAOFihJgqehWc9HtU3FDDKkGJ9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780659217, "uuid": "bfd5fc8f-01f0-4b18-9d51-5d81894400ce", "value": 9829547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780659217, "uuid": "2bc74c41-0271-48fb-9667-8bb3cbaf3ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780659217, "uuid": "7d5c5d1b-ca0e-4745-91f7-2e8bb58d01f3", "value": "SMS\u5168\u7403\u8bc1\u4ef6\u4fe1\u606f\u63d0\u53d6\u5e93 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ca7681-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780638688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638688, "uuid": "91442660-eca9-4743-aa90-8b7ce1527c8e", "comment": "Malware payload (Mirai)", "value": "d00e3b89d244848c3baac00b53166182", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638688, "uuid": "976d4f18-9f36-4def-b060-291c9d0f3b7a", "comment": "Malware payload (Mirai)", "value": "e0c87ef7802f4c48d6f8a51349006ed9f2c5759cdff62288316f678e8b7d676b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638688, "uuid": "147a4128-55fc-4882-bdcc-baf12e35afbb", "comment": "Malware payload (Mirai)", "value": "b47d3f7e91af25715d73fac21aa28dc5f72beb98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638688, "uuid": "49fbee3d-45a9-4667-b17e-d781244cf641", "comment": "Malware payload (Mirai)", "value": "f1bbe9f25dc551c86920d46f14389f4de0438e420e87a0d07dc02c9eaeba5ec337a566907a2f94ac0a459c5d4d2991b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638688, "uuid": "de0b5636-46de-4334-bc10-f2bfb01f7a2e", "value": "T1B6F3C574F8088F1BC2D322F7E75D468D7E2A1FDB97E631029A34BE9027E65D21A25D10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638688, "uuid": "dd0b08d2-5829-4047-97b9-42eb673cd139", "value": "1536:JxXvmGbCFo2gHZFqKSa0fu9A2KCg4VK8H6TqXkqRPvms76UmllsLwywLpUGMY18e:JQGYH0Z539AR4TaeXk7OTea1Rvj3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638688, "uuid": "4647092c-3de8-408e-9573-a223f158fa18", "value": 166472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638688, "uuid": "9ddf9d5b-ee76-4e9a-8d9f-569f23957079", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638688, "uuid": "d11c4ab9-7d46-41a6-ba80-ad1ba5c27318", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0d7a60-6106-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681642, "uuid": "e64473d8-7900-47bd-9967-bb347ada5ce2", "comment": "Malware payload (Cosmu)", "value": "b23ec425f99bd28cade1821b19611732", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681642, "uuid": "1ecbfcdd-ea4d-4d6b-b038-d94264eabf0d", "comment": "Malware payload (Cosmu)", "value": "e1689f1c099d3de142ec73131daaa0fef229d0c53e941f26ab0f66270e989a93", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681642, "uuid": "59157f03-469f-4100-82fa-839e40b4ec12", "comment": "Malware payload (Cosmu)", "value": "e80fe1cf9d019621647b02609c83f9366e8b99ce", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681642, "uuid": "65712506-4f16-414f-9eff-8347468d89c2", "comment": "Malware payload (Cosmu)", "value": "8bad348aca3c291e72a0bce7e6e77ed9f96a4fe8c68ae3e2e3523a5617e374db65ea3b0d58b3ac3ec1e5603c5c446e54", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681642, "uuid": "6031a978-e8fb-4449-84e5-9d0a8cb5f4d3", "value": "T19944F1553C93C4B3D44189328CA6CBE4977B7D03AEA1E107FBD83F4F5E712888AA6251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681642, "uuid": "f1c7b947-06c2-46d3-9601-66576c4e9b67", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681642, "uuid": "44f83423-b204-41de-a309-3c58e2367c8c", "value": "3072:nQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB2:y9lKgzelZNQSBQGH/CSpWqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681642, "uuid": "2ba839a0-1d08-4e6a-98ac-22f141847d91", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681642, "uuid": "da069669-1761-4a5a-84d3-18235dc474c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681642, "uuid": "a9cd060d-495f-4d65-b340-d424a4bbca2e", "value": "7zg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e8ed83-60b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780644876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644876, "uuid": "e032063e-37e8-4b35-b2af-89ffbefe4ce1", "comment": "Malware payload", "value": "eb063b444667bbc12b149c88054fc868", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644876, "uuid": "8edf57bd-caa5-44d3-8fad-8ba74516e622", "comment": "Malware payload", "value": "e1e0f3ece12b9128689fb8962ae10075e574e467dbeceb9983deb11ccf0c3132", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644876, "uuid": "0921ca61-a713-4914-b875-5328da87ddbe", "comment": "Malware payload", "value": "155386d67a7e8f26d6b02db83f41d06ceecdc798", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780644876, "uuid": "db5451ee-7ed2-442a-b87f-7ec10dfea60a", "comment": "Malware payload", "value": "3dd5d7d83d863178e1a7e862408ea6c9f8dd9997f350a6c7f90e747248e14ed717fba5ef6ec4d394aac6e0adfdfd2b82", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644876, "uuid": "a10d1b83-b5e0-4668-8488-68e00a580705", "value": "T1D401AFDEC1169B2090D5E89C6297514CB820C3CB25558FB8BEAC983D9BE9B587019F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644876, "uuid": "7ea8f1e3-ef72-40a7-9ed4-469271ef61cb", "value": "24:kXCKysE2hi0ziQvZoharqKMj6V6X+N8uX:e9Qp+Msrqnj64+NzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780644876, "uuid": "24d67323-1730-4fb6-a739-d75e4b1fb135", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780644876, "uuid": "3b9d7dca-1a56-4bf4-8530-b92868841bc2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780644876, "uuid": "d9bd0ccd-648c-4b1e-a8f5-9c26fc1c7e1d", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3c9af3-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642155, "uuid": "eaa32ce1-6848-4eba-8f39-3752617082ff", "comment": "Malware payload (RemusStealer)", "value": "8306255c14a11a4b7c33db1759d0c733", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642155, "uuid": "ac5a92a8-9970-47af-a0cd-75b3bc33e04c", "comment": "Malware payload (RemusStealer)", "value": "e276d6a50789ec5096af5f0535e401999702ec589547332f855331286f9d95c8", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642155, "uuid": "a42f2bb6-8dc3-4b3a-98a7-c2800943f592", "comment": "Malware payload (RemusStealer)", "value": "f47b5c00c64a256bd2652e477c066327a94f6075", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642155, "uuid": "0b03f380-7203-4ae9-8ba3-fb7edb3b78b1", "comment": "Malware payload (RemusStealer)", "value": "78e9c139d2df6cf73ef5ed9cec941990078a9c80eb50fd84dde6bdc55bc74be5ccea072ba16a401a5ebd38b3991b47e8", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642155, "uuid": "9325384d-a1a6-43bf-b8fc-4dbbb5fae61f", "value": "T1B334286BC25330FCD553C07892662332AB73BA3847754EE70692D7358E61EC06E7BA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642155, "uuid": "35a5cff5-a0a9-4ece-91b3-41602cd5d26a", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642155, "uuid": "689ff9ce-1155-4b3d-a0b3-dcab20f6faba", "value": "3072:nMkiQ0Ti78ZGAttez2m7sKNqQNmTVm9he0xoyW3k9NnLwBsYC:5sG78sATmZbNmhQa38nsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642155, "uuid": "bf18d876-63f1-4ecb-ba88-8eca332db43e", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642155, "uuid": "28174bb3-3c77-46f9-b3ae-c6c0937d7681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642155, "uuid": "b77dc423-c924-401e-944b-189021e46d38", "value": "e276d6a50789ec5096af5f0535e401999702ec589547332f855331286f9d95c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697c57cd-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780636891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636891, "uuid": "d112cd3f-bcf8-46ac-b0fd-0ccd5fdb939f", "comment": "Malware payload (Mirai)", "value": "5089445cc5a5b2a1d64d07954700b187", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636891, "uuid": "a1cbe3d8-1ab8-4451-bbd9-675dc63f6cb8", "comment": "Malware payload (Mirai)", "value": "e28a394b2e5c3d1627c75b81af09c2b0206905f168b55b6722a303b52022d815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636891, "uuid": "8689becb-b439-4472-a77c-93955ee53a97", "comment": "Malware payload (Mirai)", "value": "18b85a98d7394b63a52c85ed87f38f57d1467cb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636891, "uuid": "43c3fdb8-0836-42a4-820c-f845b8c9b32e", "comment": "Malware payload (Mirai)", "value": "58d9c5730d57a999e707b91064edd674d3c4d6bb2c28d71b8c62ba30d901262513cd1018f8434816462502385fcf37ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636891, "uuid": "76ce3f3f-ec82-4257-87c4-77f1f00a81a4", "value": "T171144A87EE880EDBC467CEF086AF836B19E3659B4DD2F6F5543C8C0C355D18A4693688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636891, "uuid": "22ff213f-5df4-4e45-ab49-f5fff9a5321b", "value": "6144:dlb13PGNZpfCOK+kIbvCkh8tksLYvsqd:PCZpCOK+ukuMvsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636891, "uuid": "f686a118-d08b-48ff-92ef-d849e4d57f16", "value": 200772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636891, "uuid": "09747244-5033-4891-a905-a7149b1efbef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636891, "uuid": "4284137a-2f0a-4e19-bd3a-d37650517585", "value": "data_mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022b113c-60b3-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780645737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645737, "uuid": "55978a38-8aff-427e-a860-125ec5109386", "comment": "Malware payload (ACRStealer)", "value": "807bed803da2f8b6feabd0dd71b007b3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645737, "uuid": "4fe781b0-308d-48e3-8bb5-3bb95c8f6f32", "comment": "Malware payload (ACRStealer)", "value": "e28b5039e20e060c491f25bac383187ff798b17bdfc44ae5ee406f5ca2bd781c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645737, "uuid": "f7f39cb4-7ad2-4727-80f2-01b98da8e9ea", "comment": "Malware payload (ACRStealer)", "value": "a01f214678001ec5ec280d7e8ec6735a0581b432", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645737, "uuid": "bff622f8-6eac-465a-8bbe-b6e847f765aa", "comment": "Malware payload (ACRStealer)", "value": "2220ea140ccc87b2874c6c04b14281a91bc2f9a1c2cc9beb77b1e44cf850d4a21cb42a044f9bf18a185c74ff8947bb0e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645737, "uuid": "ebf448f6-bbe8-4808-b4f4-81163a9958da", "value": "T1BC45BEF990844598E88C787421257F76B33BFDEF05CA29D767A37260742CED11A2E3A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645737, "uuid": "c18559fe-321a-4a77-9c7b-23fc01e4996f", "value": "24576:8Qs0bLZk6iH2DjWU4XWzsVcv4URceiWMdId2:1C6iA9dYKvHiWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780645737, "uuid": "be86d1d8-2925-4174-948b-6dbe4e7fe6ed", "value": 1234424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780645737, "uuid": "cd68442d-2d87-47c1-a520-cf86adff04ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645737, "uuid": "b1e1195d-0bff-4c7f-92d0-603f9a9372c0", "value": "SecuriteInfo.com.Win32.MalwareX-gen.24962153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb52225a-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780643068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643068, "uuid": "372ee800-16b6-4417-a189-e8a5ea53dab9", "comment": "Malware payload", "value": "abe588ec4d1d0b91a8b3584117510244", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643068, "uuid": "c74b219f-c805-4b06-9ea1-60b86daec5b2", "comment": "Malware payload", "value": "e3461a49869ae3ef5452f781a9dfdccf3733ecb569117c1ba34e670c0a3e026f", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643068, "uuid": "3364de89-a7b5-40c0-8291-7ef5192ea153", "comment": "Malware payload", "value": "9f9f4f47e9a65123c73919582d137901696b557e", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643068, "uuid": "d4761c4f-738e-49e3-8e8b-047526512c70", "comment": "Malware payload", "value": "a679f039254093273b287de6f317f8ac867fb063eea95be8bd2d01dab5d9d78d8e45c932f74de3bcb43446a90d58f553", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643068, "uuid": "0b209737-aaf5-4e8d-92aa-8010662859f9", "value": "T1D551008D34F360C282B77068013BB996FA285A95834CDB24863D97BDBC715E96317F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643068, "uuid": "da4ac054-859c-4039-8b50-cbcf96123e5c", "value": "48:olEDIXRrwrmjcSe82epc1n+5+6Fw3Fbl50+14WcC1TmWazLlB8KyVxlBuLUjgOtV:olwIBBIecRY8oWcC1TmJzLlBuVxH9RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643068, "uuid": "452613ad-df34-4921-b874-31f37fcc5f91", "value": 3049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643068, "uuid": "12a21672-2c57-46ff-802a-cccadcafb625", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643068, "uuid": "8b4dcfa0-a472-491b-b0e9-4235fc27e86d", "value": "e3461a49869ae3ef5452f781a9dfdccf3733ecb569117c1ba34e670c0a3e026f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d783b93-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780636817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636817, "uuid": "670dd3c1-e80a-4ee3-9297-7cdc17a86653", "comment": "Malware payload (ValleyRAT)", "value": "fe8ae85d8f72346043c5d40990bb0949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636817, "uuid": "81fc9621-11eb-4a98-a42c-ca4389d7cd9c", "comment": "Malware payload (ValleyRAT)", "value": "e34a4bbff465e5e42ca76e9ef5e61223238ef93d9db038807da696e727de97f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636817, "uuid": "e359d817-fc59-4fc1-b1db-2e9a39e8aa13", "comment": "Malware payload (ValleyRAT)", "value": "97e6aae6a032b3ec73534b083bacda1d26721f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636817, "uuid": "e6c1fdde-120d-41ad-8c2b-65c8b7e66162", "comment": "Malware payload (ValleyRAT)", "value": "8861e82c90864dd1a923d5c921e2591f5e07878928fb55048af8e383b72c56642442998c0486a068e88dcb9a669250a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636817, "uuid": "5d2fb29e-0783-445b-aef6-15dcb12c1b43", "value": "T103C37C02B4C1C072D9B61435057CDFB14E3DF9700F549EDBB39826AA9E346C1AA36EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636817, "uuid": "88a0a4be-d224-419b-97b7-c9899bebf71a", "value": "7bf5edf52a68d812cab5f44dbf929ded", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636817, "uuid": "2d095a66-39fe-4de7-9e26-57a2127c8932", "value": "3072:pAVLeuZePGHRlkaqvbTRe6as9/2cx+rD1Zu6xl6ghXncBSZ7J2mSpmOZo+:pAVLCPGHI5TRe6//Dx+7zVcisLZo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636817, "uuid": "94bd7cef-5761-4b41-af93-9ace21c18fc0", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636817, "uuid": "44ea5c24-c2c5-4bdc-ad84-2d0eb04b99d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636817, "uuid": "3358608c-9dd9-4f6b-b9d9-74b2a1f245c1", "value": "FE8AE85D8F72346043C5D40990BB0949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65442f63-60f1-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780672532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780672532, "uuid": "2d5320a0-9742-4465-8b51-85fad3f1f4f8", "comment": "Malware payload (WannaCry)", "value": "094a00cba5f48e7946e673e6ed758095", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780672532, "uuid": "cff4f486-784a-49fd-a245-2cfa55e679c6", "comment": "Malware payload (WannaCry)", "value": "e3d9ad7e13273601ad4efb060f8e9c4f57c6bf08d62916453f0fd934b8caa3a5", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780672532, "uuid": "6d3b612e-74b2-404c-bc1c-7cc9cfece2c3", "comment": "Malware payload (WannaCry)", "value": "51c2433f6d390352f0e7b1408a6b335dfc8605e9", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780672532, "uuid": "037ec373-a76e-4919-8b9d-860fdd94f079", "comment": "Malware payload (WannaCry)", "value": "81649bc445d5d88591172fb5b0728617caf6138208e831438420c72353275c3b91894ac60c43628efadf268605d94ccf", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780672532, "uuid": "522ad690-9086-44d1-802a-722b13ad3cac", "value": "T15436E015A2E42B64E6F25FF2217B8B10477A7E45C95B925E1660A04F0C33F5CDEE2F28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780672532, "uuid": "a5ee25ee-a8c5-46de-aefe-caa502cfcada", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780672532, "uuid": "3629422e-700e-4380-99ef-a92ddae0aa8d", "value": "98304:DBDqPoBhz1aRxcSUDk36SAI593R8yAVp2:DBDqPe1Cxcxk3ZAIzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780672532, "uuid": "0b52b2ff-cf8d-44ad-8bd5-4dddc7f09cb9", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780672532, "uuid": "2314ecdd-fac9-45ce-a5cf-b376d4d893ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780672532, "uuid": "d7e0d7de-1eb1-4d92-bf32-d552780c6387", "value": "e3d9ad7e13273601ad4efb060f8e9c4f57c6bf08d62916453f0fd934b8caa3a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2da2b9-6080-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780623905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623905, "uuid": "51c25816-d5ff-4993-877e-d807226892f5", "comment": "Malware payload (NanoCore)", "value": "5e7dcf5da70e254d71505e843af5f8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623905, "uuid": "125425b1-6586-4ef0-819d-5315003ba193", "comment": "Malware payload (NanoCore)", "value": "e4aa993ec28ad0b38368b9e29c5f714f1791ea771a504b5f84d73d63a14950f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623905, "uuid": "0ea7ced5-034c-402b-aebf-926d60498d10", "comment": "Malware payload (NanoCore)", "value": "a8862e5973ad8f3bcebe80123bbfc0b58ed503c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780623905, "uuid": "ed5d67f2-b05b-445d-9084-593cd3bb7b2c", "comment": "Malware payload (NanoCore)", "value": "7d9915292039d59ccc1c3108611f56abb85406fd2d2dbeb1419478c126e7b740286121af24905d4c3eb9803e39df7717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623905, "uuid": "cda73910-6845-4406-9f32-e209bcc0c06e", "value": "T1EB14CF1677A84A2FE2DE85B9611212129379C2E3A9C3F3DF2CD451B75F267E14A0B0D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623905, "uuid": "2f0bdba1-0ee2-4b0b-972b-045f20908fef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623905, "uuid": "8f622fa7-a9e0-416c-b717-8c8035d443aa", "value": "6144:MLV6Bta6dtJmakIM57RytPfyPxvc3sNrd:MLV6BtpmkMAPKLNrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780623905, "uuid": "357493a8-89e9-4ec9-af27-f7df0a9bdc68", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780623905, "uuid": "6b445683-751c-4bd3-97ba-acabf81bcc50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780623905, "uuid": "8c2c2d86-c45b-49d5-b376-2e0f1660c7f2", "value": "metalioncircle.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc73189-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682180, "uuid": "97815c97-94ca-43ad-8374-bf1874346fd1", "comment": "Malware payload (Cosmu)", "value": "94b890bed9e8b9b3b6445ef5ab0a5d66", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682180, "uuid": "12533e7b-8baa-4e83-90be-a66b385e0761", "comment": "Malware payload (Cosmu)", "value": "e4e9d5a26ab08576f9b2d6a716a2dd0d19317d6e1f87fa68cb1204ec38e97f5f", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682180, "uuid": "021e45e7-c413-4552-834b-2f1d9ad0a135", "comment": "Malware payload (Cosmu)", "value": "71261752d166e4f83f8b770b6e670e517f41423d", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682180, "uuid": "01ad1a0b-5398-431e-9bb1-6b5fdaebec6d", "comment": "Malware payload (Cosmu)", "value": "cadc1cadc9a23398cf9c0c57fe1e70b52c9c107fc8fd954529f3c2269f3c0cf48e6cd04b5845a27b5963e1e5546bd7b2", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682180, "uuid": "c713114b-282e-42bb-aa70-3bf1e83a935f", "value": "T14124F1553C93C4B3E0414D7289E58BD18B7F6D03B6E2E15BFF990A474EB029C4BA72A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682180, "uuid": "f739866e-82c9-4757-9dfb-ac083c6afd65", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682180, "uuid": "8055d317-805a-4f2a-81ed-2c25e83f728e", "value": "3072:sQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBs6:V9lKgzelZNQSBQGH/CSpWqTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682180, "uuid": "5edd7129-5876-4c66-8b51-381a39e34801", "value": 221185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682180, "uuid": "72f6283f-386e-44e8-b190-38c5f07eaf48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682180, "uuid": "20e7282d-c147-429d-a84e-0038491eb85a", "value": "7z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791fc806-60e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780666123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666123, "uuid": "f9f91a7c-c11e-49d5-9cd4-97a129778adf", "comment": "Malware payload (Gafgyt)", "value": "b0b7e8b773cd0f954dbaab24cd58301f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666123, "uuid": "158713c6-1fdb-48db-8127-e07c1e6832b7", "comment": "Malware payload (Gafgyt)", "value": "e58aa90b2033031f393276706e63d83cd42764263a8e004eda380ba19377f55d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666123, "uuid": "00e8a2e8-96b6-477d-9f61-2b2084e50e82", "comment": "Malware payload (Gafgyt)", "value": "e601df7bcb339eb6736c13c4d059cbd0947f40bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666123, "uuid": "f6ee9d6d-cebc-4228-9ad2-dc11ee1559c7", "comment": "Malware payload (Gafgyt)", "value": "1c0b1e7fbe1a24d81531c87eabf4c482d5fbe53b6c4ab5903214b743229a985b45f6877c6c934ac8102613abaa870b53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666123, "uuid": "69e40d48-ce5e-41f5-8eba-10d3ab84f843", "value": "T1ADF33A05E6408B17C1E2277AE6CF824D33339B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666123, "uuid": "829903e4-b3c4-49fc-9c1a-a1b8357e975a", "value": "3072:f1g2iIFdVzqKA7Y6ISag0/RPqnyLRM/9lzNmFwfBxKQodn:tg2VFdVzBA7fISanJqnydM/9/mFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666123, "uuid": "51e5c361-5e53-410c-bac1-be131818f74b", "value": 159896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666123, "uuid": "3b94422e-06ec-4a40-8849-66a25e0a15a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666123, "uuid": "e4eaa70e-ccfb-4d4e-8e74-bd5f1d2ec5cf", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d90d559-60e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780666131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666131, "uuid": "ee62b25c-0fc1-4fb8-a917-5373032e87fa", "comment": "Malware payload (Mirai)", "value": "bfa428d84c5d334fc316f5a26a749449", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666131, "uuid": "a937c98e-a653-43da-bdc6-f728453832fa", "comment": "Malware payload (Mirai)", "value": "e66bf0e1b28c66db32a286a64ee6b2ed5927d9a8409ed0ceefb65d8f54c8ebd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666131, "uuid": "de80853c-5457-454f-899f-c5b73c51a811", "comment": "Malware payload (Mirai)", "value": "59ebe4d9ecff87b6dcd18c1fa42f094d16fe5855", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666131, "uuid": "9938472e-c461-48ae-9b56-542a83d70010", "comment": "Malware payload (Mirai)", "value": "a6b363c5d78ef6e459fdd5e6360faa4d975b7c7202a99c8bf8331d1e3cedc831ff89d999fe9d11d3f6c117fb4ccc10bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666131, "uuid": "e361403b-fc2b-40c9-9423-f7102cdf2900", "value": "T1A6C3842E7E12BBBEE668863107F35F70879521D237A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666131, "uuid": "7d2e18b5-a131-41db-b49a-25877c564663", "value": "1536:g7je1TYGq+f+A02rKXzeve1eTe8p2rKXIeum9Y0GAzQj1l72HBeLERLWfRZrmW+i:/a1UW0MZQHrB6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666131, "uuid": "1f0c5d53-3187-4137-ae69-f04e0ba468e4", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666131, "uuid": "29f1920f-afdf-4dd0-815e-ac0b41a6e8ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666131, "uuid": "c4c1aeca-2b7c-4f60-84b7-9f249bcc3345", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49ec953-60bc-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1780649956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649956, "uuid": "d47fff11-4451-44c7-83a6-1ec8217ce463", "comment": "Malware payload (CobaltStrike)", "value": "c8d85c3dbc504c68098c07383c145a7a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649956, "uuid": "b5a6821c-88fb-4772-b5ec-a1ecd602fce9", "comment": "Malware payload (CobaltStrike)", "value": "e684c5aa42e21bc9c833dbd50d5d3da4e3a603259d612b426a1e9d7c01ce5444", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649956, "uuid": "91961371-697e-40d9-9ab6-1f45acb91ef6", "comment": "Malware payload (CobaltStrike)", "value": "d4a2a6ee4a4b3394b410ae496228c4a68e145ee6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649956, "uuid": "e9190b35-779a-44f2-ab26-07e50445aaaf", "comment": "Malware payload (CobaltStrike)", "value": "f7d1db5afeb21279ae14b713e71fc4b489ef6019f3a9388eed0ef0a1bdcd0a66cd9ce97496c4ccb5ba2d6521a41014f5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649956, "uuid": "fb855dc3-93e8-4d19-9f91-7eca546c34d9", "value": "T127658DA3B5858A6DD312F03985A7962A753572C422B2AFB31C9F9E301F63DC90F14F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649956, "uuid": "6bfb2729-cf76-4b08-8541-ba44bc77dc3a", "value": "089a800e5ab2449c3a378b15eeb0c710", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649956, "uuid": "eded5b9c-b9aa-49c1-8d1b-79b5014d3940", "value": "24576:CSLWjYZ/Wjz8PZohzZkPKivwn/rNgueDc8tnGdhncg3rYvH:CkiYZ/Wjz8PZ0eii4nDNgBc8hGdhncga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649956, "uuid": "17a038c8-0d27-41d8-9435-8a7e3f543c3d", "value": 1527258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649956, "uuid": "1de5d234-0e89-4a47-91df-a5634013c237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649956, "uuid": "eeb58c92-07bc-4e2c-827e-c7c19efec4b4", "value": "vmtoolsd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecc325c-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780641705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641705, "uuid": "f6947afa-533c-4207-b38b-64c1cee1a82f", "comment": "Malware payload (Prometei)", "value": "a9b58f1d883d5f6ec994fc7a59ba106b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641705, "uuid": "c6f3ba8b-70a5-44ff-83db-4b0e05086011", "comment": "Malware payload (Prometei)", "value": "e6b1f991875a9d116502fe9d33a0efecf4fce86bfe1ded722ef045a667e7b8e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641705, "uuid": "8d8070db-09fe-4936-ab4d-ff1382d2c83a", "comment": "Malware payload (Prometei)", "value": "391de66aaef24d2106e3c0219c09b2d9ce667268", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641705, "uuid": "82adb887-12db-4d18-bc4b-a83cd85c71fa", "comment": "Malware payload (Prometei)", "value": "07b7abe1f7b1c37de7a5b1b2ccd381c3eecacb7854c5094209b2af833b98e36591dfaf920faac2301bfa47cf0b4723da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641705, "uuid": "b2de9c99-3f30-4267-9f39-97c1ccd8385e", "value": "T199A423B4F9229E9F6DD769B91B24831DE181C172589D4C1313AE94A34F3D732BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641705, "uuid": "0440bf27-bcfb-471d-a574-7c92a4e6a645", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdu:Fs6pyCC/Ya2hpi6T6N4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641705, "uuid": "289f176d-2532-45eb-998b-ed4ad03fddcb", "value": 449081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641705, "uuid": "130f3f40-157e-4f8f-bccb-04cc318af37d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641705, "uuid": "c78c2850-5c3b-425d-9008-72b451b9e6db", "value": "e6b1f991875a9d116502fe9d33a0efecf4fce86bfe1ded722ef045a667e7b8e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5332f8-611c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780691152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691152, "uuid": "4e2d509c-0bb5-443e-ac2e-a3c4baf45ab7", "comment": "Malware payload (Mirai)", "value": "52a573f0a58068baa1dba9480b04991b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691152, "uuid": "2a7feda4-99fd-47d3-802f-aa45554d2478", "comment": "Malware payload (Mirai)", "value": "e6b78f132e2f23e657c1a053aa2f359bd075e22c035bdfa89ef6421b86528b3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691152, "uuid": "dee41519-f8a0-4748-90c7-96b3e920f6f8", "comment": "Malware payload (Mirai)", "value": "4f8c504fa3f0e72bec634e26c3cfdef013e4b6f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691152, "uuid": "68b67454-0a6c-4e57-b057-2493d8aca0ac", "comment": "Malware payload (Mirai)", "value": "f25c912dc310aa14a89c1dad9bea0bb741f08b774ca6ac95bdda46523c2af628f7c9428c98e6f383c44c2af9e4b5edae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691152, "uuid": "1429eb48-fd65-4d7c-8cfb-570346b3ca99", "value": "T15DD31A45BC804E13CAD512BBFB9E42CD372517A9E2EE72039D116F2137DA95B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691152, "uuid": "88014b5c-294e-44a1-8c3b-cc22da5bb083", "value": "1536:hq92v3aAJlXTNMMlYytapXX4WFjEj2C7JhMx0AD4y7bhP2Q0I4VKgy7vuEA8xl+H:hq9WsCm084yvhPR4rypAh0vHRxEuSeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780691152, "uuid": "f8ac24e9-fc51-402b-a4c7-4d519398d258", "value": 141676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780691152, "uuid": "87aafd90-5759-4d6f-b8ab-927e60c56a31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691152, "uuid": "cf83a0d0-7677-4dc3-b629-c92109f49d85", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073b1e18-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (MasonRAT)", "timestamp": 1780638444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638444, "uuid": "9cd81de1-7e8a-4de5-b9f4-982a828de653", "comment": "Malware payload (MasonRAT)", "value": "0f633c027eb2417d68250cc9c91895bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638444, "uuid": "81df5665-db89-413b-adcc-b4ee9d64f87c", "comment": "Malware payload (MasonRAT)", "value": "e6cf212a418e8ed68cb812ac28d3623fd8b6a5ece317606b85df8d1883a806eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638444, "uuid": "dbf3d2a7-853f-4d2e-b78b-b9de6a69a0c5", "comment": "Malware payload (MasonRAT)", "value": "968984905f437ad14919ba997072cb43e46fb801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638444, "uuid": "3f3f4c82-8aef-4f8f-84c1-ca9138574a25", "comment": "Malware payload (MasonRAT)", "value": "0a36ee1b1631756e54f7c9870a9b3a75678efdc652342b7d002f02d5fcf1e958cdfca421903f3227c32acd12b2ce0222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638444, "uuid": "3317055b-e69b-4d9f-b3d3-6bf1feb79ff0", "value": "T12A240806F35354EEC927C17487AFE333B531BC1A12306E2A9790CFB67D15E506A69E28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638444, "uuid": "6ef778e2-3a7b-4b36-9404-6fd534414cec", "value": "a56d8cc5d691f2bb77ba228caa6adecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638444, "uuid": "4da7e399-aa9e-47c9-8e47-cd93b422ca71", "value": "3072:pKz4UTSO8wsC4fVcPwk8jABCNZm2VgWyNN+S7LD2rQzUBbOg:pg4UTz8xZ+Om+IjLDnUBbOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638444, "uuid": "6accfc66-7eed-4f71-ab96-6f64661339af", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638444, "uuid": "f663a738-fe8c-4170-b4ab-ff8b4769e3da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638444, "uuid": "a7496aca-bfba-4c07-bc37-a877acff5b91", "value": "0f633c027eb2417d68250cc9c91895bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8655d8-609c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780636069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636069, "uuid": "dacfff2a-cf95-46a7-8ec4-cdb9e466d3e8", "comment": "Malware payload", "value": "412c141594938817ea67ba337a22cf14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636069, "uuid": "1e6d87d8-e5cd-4b8d-b989-e7387b7dcd95", "comment": "Malware payload", "value": "e7748a6030e89390d51fbaf575962c378074143375202be9c42b917ff4da98fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636069, "uuid": "991abc12-cb93-4f56-812e-de47139b5b0a", "comment": "Malware payload", "value": "d8b74937481653c13db780f850dbf20e2eb8d1dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636069, "uuid": "0d481326-e6db-4491-849f-2db8f73b0769", "comment": "Malware payload", "value": "908a94b9a569cffadff217f9f1bff422313dc80e9f771f62ca8ce20b8c71979cc21e872aee457b3ea204991580130507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636069, "uuid": "f37ed883-d8d7-4fb9-acc2-992e337f40ad", "value": "T1FEA64A47F8A549E5C0A9D63189769223BA717C480B3123D72B60F7786F73BD0AEB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636069, "uuid": "e99f1518-750a-4967-9976-81b47909f082", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636069, "uuid": "06951fc9-eec9-4b57-a4ad-122d6b612f9f", "value": "98304:iKh0qb7I+Q0wU49MttOpH89/nBycPGCkl/TZZp7tEjN:iaU0Q9Mkc9nBycPxkb6jN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636069, "uuid": "1b213414-4af4-4bc0-8e29-eed808aac07a", "value": 9666048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636069, "uuid": "b945f86b-1449-481d-ae85-4029010d681b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636069, "uuid": "07120dcd-63a1-4cee-93eb-63be01135f08", "value": "Soundpad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe599fd-6109-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682992, "uuid": "1484c0df-28e1-48be-99a1-982ee1e26b87", "comment": "Malware payload (Cosmu)", "value": "9ffcbecb6774df5cb0520c9721f428ae", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682992, "uuid": "be91819e-29f6-415b-b34a-ec9879890250", "comment": "Malware payload (Cosmu)", "value": "e81db925b7aca66b5ef2b396e0a216afc17aeded7db9df6a6e94c2e7b17f8052", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682992, "uuid": "be1eb5e0-3f1e-4ad6-a2f0-e5450ed38b02", "comment": "Malware payload (Cosmu)", "value": "ec57a197b019e482fac37b5dc523f9850a9c5c60", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682992, "uuid": "d98209a9-c8ed-49e5-9273-3f922368a431", "comment": "Malware payload (Cosmu)", "value": "d96cd4c21b624b2017f25740bf502ccbb31212c956cd771bdce9c4faa256f3f1b87cb2c0f6ff8dcd2567ad524c20d3a0", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682992, "uuid": "9dc8290e-4a47-4817-a62c-d46677d066a9", "value": "T185C429023785CF71C11F15B6C8A6C6F8532BBE02DD4097D7B7C9BF1A39B22AA5A51183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682992, "uuid": "a26cf9c4-59d8-4a31-8f8b-08a083560cf4", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682992, "uuid": "0c9cf77d-b16c-4e72-a1db-1a2ce9d9904b", "value": "3072:CQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBt5FPX:X9lKgzelZNQSBQGH/CSpWqT1FPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682992, "uuid": "611f9c36-02ba-40f9-bcf5-d6dcbb3f26d8", "value": 589825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682992, "uuid": "9f59b2b0-17e0-4130-a8a6-5ddf036dd530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682992, "uuid": "da5404a1-93e2-4e14-a869-2411010a54e0", "value": "dotnet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132803b9-608c-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780629015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780629015, "uuid": "44318c40-f425-4c18-9b39-f9dea8a0f722", "comment": "Malware payload (ValleyRAT)", "value": "309ac4bb05aad73136d271e22d3e543f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780629015, "uuid": "6ca3c9b2-3d34-4855-9a84-17d45328cfb4", "comment": "Malware payload (ValleyRAT)", "value": "e9bf0c399baa38d7adfd001b1a5b22e849e1c209144629aba5a0aa036bb4d97b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780629015, "uuid": "e0504c6f-8f81-4e56-8fd2-4ecb8d16aaf2", "comment": "Malware payload (ValleyRAT)", "value": "4535d8121bcc2705b3dab0f5f42a0acb5cefebb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780629015, "uuid": "f10bfffb-e31e-496b-93d0-0df6e27bcc56", "comment": "Malware payload (ValleyRAT)", "value": "4e58f0d76a488ff2ae262875ff9270ce55633acf99a08f9635982bb3f2c3f4a4d74386ed6923a6e200f36113b84c890d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780629015, "uuid": "ceccb519-d2cb-4b17-b258-a01eeca7d547", "value": "T16133E73B63E88054F2AB92B56E79717658BBF47C50B4B10E03218D2D2F22E795ED432D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780629015, "uuid": "6a0b63c6-0abe-4d93-9527-54ff7f76878b", "value": "a66ac84db6116999f6cded522d9f3b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780629015, "uuid": "3c6e1248-395b-4ded-9e9d-a235732a2994", "value": "768:kPWZ6PRcrS+DR/4a1eTity7oe7iBTpUr0EDYr3Rlm/pZ+r3ZV:kgHuyRAgH07oPkDYDbm/pZ+r3ZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780629015, "uuid": "25b026e0-1924-4820-816a-3b503db6b7b8", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780629015, "uuid": "6d737003-6d24-48ae-bdfa-67f9e5c38063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780629015, "uuid": "be8210a7-ab1b-40ac-95de-0b8152850e9b", "value": "309ac4bb05aad73136d271e22d3e543f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d9f82b-6100-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1780678818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678818, "uuid": "d201bde3-db59-4528-982d-8adba7b04316", "comment": "Malware payload (Stealc)", "value": "6f08c03081b552076dc428d861601235", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678818, "uuid": "2e12aa0e-dd01-4ebc-aafe-27094c09b69b", "comment": "Malware payload (Stealc)", "value": "ea40264823faac3810f68a4a57cb6c80befe79e051de7a32fce09edfc9b4ef3d", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678818, "uuid": "a0df582c-4d40-4370-8baa-94be23cf9a63", "comment": "Malware payload (Stealc)", "value": "a1ec860f857dd40f6665049902c329ddb7165387", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780678818, "uuid": "04e75f4c-15fe-48fc-bc6a-cb30e612e6de", "comment": "Malware payload (Stealc)", "value": "2eafca50546990b2ba06be919d99a35ddb9da70b76fa3def8fcd9ceb8b8db251950c0ee5ab33a22b93e81a4570b4ec97", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678818, "uuid": "7a9d9034-d66e-4eb9-8617-4dd5a29a34c4", "value": "T1F474237F413050A9F0985EFA5800D428E736A6C8D88729DEFCC7559B39013FC6AB759B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678818, "uuid": "7c9db9c1-d370-41e5-9b20-24d068055bc8", "value": "6144:PAxUY8CWtaCQ6CdAuIHrZB/Ohh4A8sHP0a/QLk2LtsXOWYEjb/m19DxORVm:YxUY85MJEu2dZahmsHP0mQLtqOWYa7mT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780678818, "uuid": "3a826fbd-0611-419f-81e1-bbc66b4a62fb", "value": 363697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780678818, "uuid": "8cfb5c75-a0c3-445d-bb24-8b69baafe634", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780678818, "uuid": "512fc29e-8e7e-4449-8b3f-fb5667d884ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d162b592-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780648662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648662, "uuid": "e5413427-507c-400f-895a-47cfcef4230e", "comment": "Malware payload (PureLogsStealer)", "value": "fa2f993f548222fc8b48556afd9184e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648662, "uuid": "947ac05e-5590-48d2-8d72-f5727c3ac57c", "comment": "Malware payload (PureLogsStealer)", "value": "ea56213fa9cddb08dae3b254c36665d44991f57dace4afe578c1c8f0079187af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648662, "uuid": "2e5aac93-a59c-49f0-b5d1-be84e5a56eb2", "comment": "Malware payload (PureLogsStealer)", "value": "5adc2ab58db0e4047eb19825ef701dfdb96ec673", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648662, "uuid": "ae2fc2ac-cd03-4948-94ba-bda442ad74fc", "comment": "Malware payload (PureLogsStealer)", "value": "a347fad81c55ca4b28cb677f6e3c5e8c710a944bc961ba17b89cbcc072bbc87222b1aa374bb39fa17245cb9f2882aaf3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648662, "uuid": "4d1b07ed-21bc-45b1-9391-84c92918eb6e", "value": "T1AB05193ECC29412FD177DA29849A499FF8C25517223CE94B60CB3B5BAF63442778239D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648662, "uuid": "4e7da759-bfce-46f3-8343-4d2967792d36", "value": "3072:Z7BYjpB/fCq5FLif8ESCmMX2Sobkq005jRUehdLa6oSq2hYeNykrHb1mp5wvxxQd:cTbCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648662, "uuid": "adc7b62b-9904-4e9f-b7b9-26de12586130", "value": 846172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648662, "uuid": "a0cf83a4-32cf-4e1b-b434-514d4519b4b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648662, "uuid": "a400b62d-3545-437d-bb63-a525c6e8d39e", "value": "PONo 34VIVRES5052026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a94414-60a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780641522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641522, "uuid": "5c84040b-3629-4a13-a643-3faf7cca6c2f", "comment": "Malware payload (Mirai)", "value": "33c808caa09d8052f33f30c48e04d8e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641522, "uuid": "faf1ba4d-52ac-42b6-988f-fc69cb2ce547", "comment": "Malware payload (Mirai)", "value": "ea63e11d2b8eb36a31b79301accdb645683a446763ae983872dbf9419d1c00a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641522, "uuid": "e4066e72-4552-45df-a293-411bab0cb9e4", "comment": "Malware payload (Mirai)", "value": "ad283a97244c10965153e7c5b87ec5fe0aea92d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641522, "uuid": "3ea3d95e-c05d-4033-ad4b-1e2cb9e9bb9a", "comment": "Malware payload (Mirai)", "value": "014336d3fa4206f768f5a6c197bb2a5d2589703071f48d70dd493a4afb16dbb418f367e8d4f35c20c0f4aed6f8f3e032", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641522, "uuid": "fcd9ab8f-24cd-4e4d-8b35-4176d3b7d8e5", "value": "T1CE73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641522, "uuid": "031602f5-33d6-4470-bd56-e0ea32e21c28", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerESt/:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641522, "uuid": "78cf4ef2-706a-4aef-a33a-1481971e803e", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641522, "uuid": "9c8b017b-2a7e-4fc1-a658-5631a32b9aca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641522, "uuid": "de0d86be-83a3-4640-85c0-0de7c7b6e99d", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3818c691-6109-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780682764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682764, "uuid": "c4465944-0344-4673-bbe6-aaf6f85de631", "comment": "Malware payload (Cosmu)", "value": "9a53709a2e8b33b977e9668c6d629111", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682764, "uuid": "71fc3fa8-642d-489c-aba8-62c14b4b209b", "comment": "Malware payload (Cosmu)", "value": "ea7e449035530dc1cea8c506dd4ac580e37472f428515fd99a4bc997c0a3f034", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682764, "uuid": "cbf4f7dd-9512-497a-8a6c-842eeb36ac58", "comment": "Malware payload (Cosmu)", "value": "afdc6ae6963b40866906b709387799da2212a879", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780682764, "uuid": "0ef429cd-2b7f-48f5-b2ea-05fe0336578a", "comment": "Malware payload (Cosmu)", "value": "943e5374fe051df994845a22d59adb85dac148e61f285d48ca4c3f6e0f99fa1044600daa781476a25233f92f8e590706", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682764, "uuid": "757873ec-c5e1-42a6-993b-8735234da741", "value": "T19624F15179A2C4B2C48289764CAA8BA197377D138A64C143BBAD1F8F5F713D48F7B302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682764, "uuid": "fc45fcbd-82d6-4737-9f9c-133ef7da75f9", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682764, "uuid": "68e2be4c-5586-4c5b-bfde-d85c044fd87a", "value": "3072:5QXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBEKh:I9lKgzelZNQSBQGH/CSpWqTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780682764, "uuid": "a232931a-e031-4457-bc4b-352d53719e9c", "value": 221185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780682764, "uuid": "4739b98d-7cf0-461a-94bb-1350641a23d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780682764, "uuid": "c62675f4-e04f-46c8-8eb2-ff6c03819e60", "value": "acecnflt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2b035b-611e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780691796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691796, "uuid": "d1dd40db-d181-4971-b18f-21102c144824", "comment": "Malware payload", "value": "166cd028ca2a92e6c5693d0e2a5e4ca9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "webfloweu-com", "colour": "#3070D6", "exportable": true, "hide_tag": false }, { "name": "webupdateflow-com", "colour": "#046F26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691796, "uuid": "7e4ecb6f-672f-4644-8369-d5ff76469b04", "comment": "Malware payload", "value": "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "webfloweu-com", "colour": "#3070D6", "exportable": true, "hide_tag": false }, { "name": "webupdateflow-com", "colour": "#046F26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691796, "uuid": "fab4e6ec-216e-4fa8-9d2d-71aa6800febb", "comment": "Malware payload", "value": "2526109458a55672e3a34e5ee0328c98601f3fd6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "webfloweu-com", "colour": "#3070D6", "exportable": true, "hide_tag": false }, { "name": "webupdateflow-com", "colour": "#046F26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780691796, "uuid": "475d5fc8-3acd-4eaf-9a5e-3440d5b1606a", "comment": "Malware payload", "value": "8fdd28371f62eac0b6cbb6ab6b42f95955e99099674337ed00af26fc4d4444c95c4fe45e2c758ca57db5ae830c14df45", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "webfloweu-com", "colour": "#3070D6", "exportable": true, "hide_tag": false }, { "name": "webupdateflow-com", "colour": "#046F26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691796, "uuid": "1be2fda1-4602-4123-bb3f-318fd6ff9c7e", "value": "T123563331F3C205B0FA924933C428E0554E277D796DFAA01E3E77C26D6A3898159B7B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691796, "uuid": "4b1dc2da-9ba5-4131-931a-f46117a56fec", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691796, "uuid": "a7f8f116-016e-4f6c-91c7-2a9f1ecc2ebb", "value": "98304:JXZ4rizz195jSMigjO6esmpvsbbc7bJrPVOMmYl5HNyfQYZNSmZHYE7tPxLxE4d:tZJz5T7lz1mpvioJrNOacZp4E7tPx9Hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780691796, "uuid": "cffbed7b-3d16-4687-b9c0-4a69e96112d8", "value": 6375214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780691796, "uuid": "16bb0a7e-7c57-4afe-88fd-0dd2a4e2e7eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780691796, "uuid": "4099302d-05b4-431e-9b5f-fd918e8536c9", "value": "QRKVINOH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5e9339-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1780648546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648546, "uuid": "07bb6569-4615-4cb0-83c8-fa704d8cc15e", "comment": "Malware payload (DonutLoader)", "value": "e2d5359aa4ffb96553cafa7d03c1c532", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648546, "uuid": "e8fa3f48-0030-4663-9ec0-a64d7cb6e802", "comment": "Malware payload (DonutLoader)", "value": "eb247dd4cc01dc4d84a1e0bdfc7186b0d1b0e38cb7d9da38dab1386ec8aab562", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648546, "uuid": "6da98981-a398-40af-9e58-5bddfcea1f6f", "comment": "Malware payload (DonutLoader)", "value": "8b24d749bdb7f7c55b0bb0bb08c7ec43d83f7b34", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648546, "uuid": "77405e78-2b89-4ca2-93e2-6e48a81d52b5", "comment": "Malware payload (DonutLoader)", "value": "f90401b229cb5e23605d428be9b24405670eba4e68becb942d7bf12f866b242580935a3549060c33d9fc200224038cb0", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648546, "uuid": "50dc0dc2-97ed-4d46-8cea-2dd48600a627", "value": "T169410E1C634DA3B2E3F34637468AB325CB62BC07A991AB1724E4168D5C136007A34D6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648546, "uuid": "8b8c506d-8b69-4b9a-9a29-72bf1adb7ae0", "value": "24:8kGFMSEzogW1P8wJB3U/+/F1DQ25l4o0F1EC5gqyDOF1tlB5Cv/MRht1d/5zm:8rrEZW13JhjxQvoSl5gqyDq1/Vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648546, "uuid": "e93eeccb-605d-4502-92eb-74fbf77ff830", "value": 2310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648546, "uuid": "378a4bbd-23e9-4175-b121-13ae4a299b3c", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648546, "uuid": "ffbe92a6-bd7e-43ed-871c-edd3e11323e5", "value": "order number is #702-3181059-5929828.PDF.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68073cb9-609e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780636889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636889, "uuid": "8cdce2cb-d597-4340-b3b7-ba8155e8000d", "comment": "Malware payload (Mirai)", "value": "6829a509b5eef0f315103bb811f1dd84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636889, "uuid": "2a4caff9-4a45-4bfb-b66a-f9adaf2baee9", "comment": "Malware payload (Mirai)", "value": "ebcbc9ed3fc243326104277396da19e8a96927936e1d48c2b79f06385f80e93c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636889, "uuid": "dacc556f-e80c-4245-aa84-238b83605938", "comment": "Malware payload (Mirai)", "value": "b96a0d1dc2e3f28aa704d49d429ee614443267df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780636889, "uuid": "211d9383-b982-4ab8-8e2a-ad2aa2640c5d", "comment": "Malware payload (Mirai)", "value": "fbbedf42cedbd984502060804c313ca7b5c2ae9968eddb2c9b11bd6fc33a9cb91f9c75679c6f9ddb8bf7229ad2f17c9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636889, "uuid": "54da19f2-bc3e-45d7-a5df-6b530d2bab2d", "value": "T17CB30A427D419F13C5C322F6BBAE42993B126B7CD7EA3142ED247F90278B4DA0E36551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636889, "uuid": "53c81497-c2af-4be7-b30e-9659abcee522", "value": "3072:GYcMjsOVVNZKayvT3lS0oJJP41vdGUOnu+xh6:XVNZKaqVS0gP41vsvxh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780636889, "uuid": "1ab46948-23e6-4b00-87ad-70e50eee5369", "value": 114036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780636889, "uuid": "7809dea4-569d-4c35-ad51-28170fd0f013", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780636889, "uuid": "bdb6b27f-bee3-4d4a-b2db-4102ee6923d9", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54beac96-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648453, "uuid": "054ec8f1-e8bb-4d61-8825-e6326549083f", "comment": "Malware payload", "value": "0e69b2282c0d6cc065c7a9079fdeb6f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648453, "uuid": "be85d5d5-95c6-4131-8d67-7d8bb8088fcb", "comment": "Malware payload", "value": "ec742d2c50916f18314e2142b5ff73a5242451e3e6775937261c57898ddbe8cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648453, "uuid": "3f4d2eb2-c294-488c-b942-243f3cedb9a3", "comment": "Malware payload", "value": "334bc5264ba80df02bb348576b49b4551612bdc2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648453, "uuid": "03022d7e-afba-4c77-8b91-d61c95824255", "comment": "Malware payload", "value": "234bfdc1ae19e9a35fead8935c7848e799cf5e914a918194b54b73865b38a0692a3a65cb556427ba05c60ad1b18a33af", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648453, "uuid": "cae1afe2-dd95-4033-863c-9848f74337f0", "value": "T159D2DF34D4C82FBDEEAA2A1C06FA6620D7D68B1E9498860637477D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648453, "uuid": "ef914530-3caf-4e7e-8788-f0e50eee570d", "value": "768:6umWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:6u+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648453, "uuid": "d2edf8be-5a1c-4a95-850e-466c9423c6ac", "value": 28650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648453, "uuid": "1b4c8e30-2828-4dd8-a4be-4d68b172d059", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648453, "uuid": "83b6e101-76ab-4cce-bde2-a1245c356e26", "value": "23.94.110.24_1780648378060722_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bfd746-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648421, "uuid": "30eb481b-ef5c-49f9-8698-6ae613d09221", "comment": "Malware payload", "value": "fbba4bef7d881cc666ab35856549852e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648421, "uuid": "54d835fd-3ef0-4227-baa1-15e32d9d4777", "comment": "Malware payload", "value": "ee078c1c983e1ffedc6221c81c8cb69896d073b157d08101cf51c9ed36dd131d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648421, "uuid": "bd4d7546-08fa-4cc9-a555-bb19865091a3", "comment": "Malware payload", "value": "dd63659dbe85ce7a236e0a2066c0b7e7c6d0f13c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648421, "uuid": "0953c6f2-be83-472c-9411-fd17c86f32eb", "comment": "Malware payload", "value": "9562e496ddef7f36cbc4269f50d6bb3e82ee938f1ccd703a2ec95b21356a24bca93d67c52bdfd74a124b2d2d3ce219f4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648421, "uuid": "dba9ba83-8b67-4787-b653-b28f206ebfe7", "value": "T1E705193DCC64412EE173D629C499085FF8D25A1B532CEA0760C72B9BAE7388677C729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648421, "uuid": "3829625e-0783-4073-946d-7ed25cb18dd0", "value": "3072:IRoxBr0wrWyrGIrulMHjSJQ8lYtWj0hUDb+6HpMFmfwHX45wILV9X8jV2da1uvnr:pIwrW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648421, "uuid": "918554c5-545c-4149-803e-1a4a648778d9", "value": 802404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648421, "uuid": "e28d81db-fedc-456f-8c78-29d33af3531c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648421, "uuid": "79b768fe-0b5c-47a2-8d29-2718f1bc0c48", "value": "Kindly Requesting Your Quotation at Your Earliest Convenience-876543456787654_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cf150c-6107-11f1-a769-42010a9c0008", "comment": "Malware payload (Cosmu)", "timestamp": 1780681977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681977, "uuid": "97066554-d112-40f2-b92a-b0b1b2852003", "comment": "Malware payload (Cosmu)", "value": "f2c126e7a53cdd481dc58f2b7bbafba9", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681977, "uuid": "50fb3104-c1ce-45f7-a319-e7cb37be3579", "comment": "Malware payload (Cosmu)", "value": "ee0b5cd5bf05a4f9643d57da4345838c47a02187fbf8136df522fd83da4177d1", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681977, "uuid": "e1142e33-c731-4e0f-86ba-a68b79daf8ee", "comment": "Malware payload (Cosmu)", "value": "90fd40e33da467492ba9fc0ad30144bf3953d3a9", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681977, "uuid": "620aa944-7702-42f3-ba23-a00a17d76f02", "comment": "Malware payload (Cosmu)", "value": "fd20438f397d72ce0379e5e5833c87d82ca7add6d3443c0eba2abcaa0aedd06a5f0b4ae303c354a35739b9ffde3acfea", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681977, "uuid": "ad1edb4c-9440-4cd1-b59b-4e5bd4bca997", "value": "T11E75D0493DB38473F0414D71CAE546D1ABBF6C1375E2E12FEF580A4B1EB028C4AA66B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681977, "uuid": "9c565e7c-8c45-429e-99b3-5cf95f879d35", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681977, "uuid": "1452dc9a-333d-4b8c-b52c-b4bf4fffa158", "value": "3072:PgV7qR3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBiu91W:41XlKgzelZNQSBQGH/CSpWqTMmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681977, "uuid": "6a462a99-d7d8-4f17-8dc6-3ce5a72d1215", "value": 1553449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681977, "uuid": "682411de-79b2-4fc4-8f70-a23a9516be66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681977, "uuid": "dff39d34-5be1-450d-b53b-8ce440b86f6a", "value": "AppVCleaner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63e5254-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780648670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648670, "uuid": "74f7fa6d-1f40-4044-81ca-43d0e2dca0e6", "comment": "Malware payload (PhantomStealer)", "value": "6b53a580cd1181e260556e0f8d86f265", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648670, "uuid": "9f9b1f60-587e-4bdb-8376-23761fcea366", "comment": "Malware payload (PhantomStealer)", "value": "ee6c3ba0a21813421acac232fdf102fdc8111e366c87a74d4504b9a229a49d59", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648670, "uuid": "fb64a3cc-217f-4151-80ec-20082b0796f1", "comment": "Malware payload (PhantomStealer)", "value": "7148683a7196f0eca8aae8b3b22a989e933cb703", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648670, "uuid": "925c5505-32da-4cfd-9e01-e157e86bc184", "comment": "Malware payload (PhantomStealer)", "value": "27a5f6703673ac1f6ec3f69fc21a5a5b37a1f19985f6277c352e1a5050c0af020a38d4bacc9688095952d7200dd408a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648670, "uuid": "6d0b7891-5657-4e13-bfc1-668c1d229d41", "value": "T1C205073DC818412EF172D91AC597095FF8E20597623CE90760C77B4BAE66882B7D73AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648670, "uuid": "f7b17385-dd25-492c-9e1d-89e7c1aa17b4", "value": "3072:WqDu9HeNGmyOHEgwyooS4f+91jRSMl383q3r6llUkiRFtGJic3DqT9eN5zrk4LHE:+9+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648670, "uuid": "ffc2ed50-8a26-4592-9cb0-e5bb016ee8bd", "value": 812220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648670, "uuid": "d4e4690c-c6d9-4691-88a6-4bc97eb80b78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648670, "uuid": "ebb918df-4967-4ac4-a403-3498f615ec41", "value": "Request For Quotation_1200013039.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1267835a-60b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1780645335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645335, "uuid": "877c43cf-d433-4a7b-afc5-4f4f7343e3cd", "comment": "Malware payload (Amadey)", "value": "c528aba86f9016726d00eb12fd4772b0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645335, "uuid": "d9a539a8-a5a0-480a-b1c0-6c5eb0e89640", "comment": "Malware payload (Amadey)", "value": "ef33cf4f79c623c90873613f799702370f0e43ffa558e78f03d683131948043b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645335, "uuid": "8bd8ebf6-e06e-4805-b47c-098d96b3c2ec", "comment": "Malware payload (Amadey)", "value": "6c31b2a8bcd934cd060fe2ec7b866478c57ddcfa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645335, "uuid": "e9aacaf7-99b8-44df-80f2-4d476605b162", "comment": "Malware payload (Amadey)", "value": "4ba65e63e35210bf587559d2fb18eb74a6e889a8b87640c08f5a08dc3452fe51860ef81bf77e3de31925b1df6d8bdb38", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645335, "uuid": "b3f8cdef-c58f-44dd-a4ab-40d9e31f3909", "value": "T111273368C23FB080E27A7E77AE27176141E5C99BC2E7705E7EA137D1098C3E191871E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645335, "uuid": "0e0efae9-a2a2-4d59-8a9f-701f941f1a74", "value": "393216:sQc5uKhglfPC/hcRFfaRjekkbjbgSwrJ8eWH6UTZ0w0yocUtbL7QOJTjz:sx5glkhmKKzUrmjTZzStbQOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780645335, "uuid": "84d642f2-fa5a-48ac-8dfc-d3b15dbe6874", "value": 21201646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780645335, "uuid": "398da21b-4d37-415c-83a8-b41abc4bae75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645335, "uuid": "8673ac15-a07e-41cd-88eb-60b42c8ed205", "value": "ef33cf4f79c623c90873613f799702370f0e43ffa558e78f03d683131948043b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5971dd58-6107-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780681961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681961, "uuid": "fbe05ba1-700e-4a03-80cd-a7c64b488221", "comment": "Malware payload", "value": "6e275788ddab49f79e1ce8dcf0843689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681961, "uuid": "34ab873a-e369-4072-8103-8d42cf8ab23e", "comment": "Malware payload", "value": "ef434b46325ef0787bc709ca1e12a5014aefc27f2b7dd4fad73ee1849dfc2a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681961, "uuid": "ccc4da28-2ba4-43cf-b1d7-4661e9b2c796", "comment": "Malware payload", "value": "d6086a7d4b7617d9d0dccc6faa8436be59946994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780681961, "uuid": "ea0e94d4-7526-4d86-850d-4779396a7fbf", "comment": "Malware payload", "value": "80d380d8914a17abf3b09d80eb053eaa2d4b93a1b3abd07f4a5ed41ede4954f7ed1a646b714215885eba82c8ac5988fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681961, "uuid": "25ac4fc3-6bb6-4dfb-8bdd-b7f2d179f5cc", "value": "T18C54D0003ABECB73D3C246358C7EFA90A6767C6F9B61813BB7987B4F1E712449652205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681961, "uuid": "a935d168-a3ed-46e9-af49-1187b6002da2", "value": "b6096454c0b0666c7e487d2e3e0cbf92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681961, "uuid": "7295212b-6d00-4990-b767-fb6e2d1c3ee0", "value": "3072:8myvMnbtGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB3RtM9:GzlKgzelZNQSBQGH/CSpWqTNwNmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780681961, "uuid": "b18c3bcc-d960-425c-b71b-ebe117740b1b", "value": 296769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780681961, "uuid": "66d5de1b-c598-49db-a4f8-16fbc7e72ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780681961, "uuid": "90dedbd8-b5cd-4bd0-a8e4-e6ed96e08174", "value": "7z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cccc2a3-60e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780666129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666129, "uuid": "edd832e3-0d8e-4f5a-9ab3-ba49ab5aa7ee", "comment": "Malware payload (Gafgyt)", "value": "37a0f813cdba2d8cedbdceb29ece3eb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666129, "uuid": "f5667a13-75cd-43fa-9acd-28821c9c7525", "comment": "Malware payload (Gafgyt)", "value": "f0102d8f4a3a7ba6e1bbbfa7657a14058aa5a1bf855a08a775e458ce5cf1a4f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666129, "uuid": "bee3baf2-0d80-41b5-879a-1f09aff876fd", "comment": "Malware payload (Gafgyt)", "value": "8bb9cbb84ebd9af025559637cf12c92b589e6651", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780666129, "uuid": "d3038765-4ab8-4c73-91a8-c63b04442dee", "comment": "Malware payload (Gafgyt)", "value": "6b73584114d448ddba99a6d42e67bfd55848a32e29f6929a951a5ef030f67bd486c95d2168e2e20e0972bdadcb2efb83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666129, "uuid": "fd0c1f88-e279-48f4-a690-470225540339", "value": "T106933A47B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD00372EB12512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666129, "uuid": "94dd34b1-5980-43b0-85c4-f3e228f5f2aa", "value": "1536:9QK1n/zXzxuPz5tq57MBtcaKECp/dC1k+82MLumXxVqDrstKfz9e:99bzI9dtcaT0oMLumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780666129, "uuid": "1019c40a-7ad3-4773-94ab-1ff3ca680b6a", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780666129, "uuid": "cca79c4f-508f-4d8c-b656-5f5c36900573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780666129, "uuid": "8073c358-535f-4cf2-88df-07086c9d1f4d", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f1dee5-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642277, "uuid": "3291e335-98e4-46ca-999d-a7a84462594e", "comment": "Malware payload (RemusStealer)", "value": "2e229a8920f6a83433760f315eb373fa", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642277, "uuid": "945e2ad0-f0c5-4d8f-87ad-2a6fdbbfcdd4", "comment": "Malware payload (RemusStealer)", "value": "f0ec11682e4e2db15721b4e463d55fbf99ef399b9c635628133fa4f09bf5f3c0", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642277, "uuid": "8750ff4e-9659-462d-84be-cc5afba1afeb", "comment": "Malware payload (RemusStealer)", "value": "98af54e1beeb43da6640a165b2d2a9d26681ea6d", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642277, "uuid": "3276ffe3-7a74-47d0-b7b6-d30acf076cc1", "comment": "Malware payload (RemusStealer)", "value": "99982baf9bb3cfff9b3515fae62a1923cfc0a5880ce8ed42108b5d70497a571a6b868cb80ce26352625abb029a1604fb", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642277, "uuid": "6c1ae8fb-d7d3-4f03-8589-63394af5cbf5", "value": "T12C14386BD25371FCE553C07882667231B732B63907346EF742A2D334AE329D06E78969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642277, "uuid": "20865928-04ad-43f9-a014-af76ae8c7969", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642277, "uuid": "82d911cd-3e00-4013-b86b-f5680ab24dbc", "value": "6144:mpFJxVbqzn7nZsdAzjOj2lvF8EIuGVoyqYY:mtxVbqYQlvFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642277, "uuid": "f3406d47-a310-406f-999d-c0bdd679d81a", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642277, "uuid": "8b666f86-d318-4723-a619-5fe3ca7c3a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642277, "uuid": "a724eba1-3409-43f4-9f28-3ad01efc7c99", "value": "f0ec11682e4e2db15721b4e463d55fbf99ef399b9c635628133fa4f09bf5f3c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da77aab-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780641891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641891, "uuid": "14161f56-285c-4bf9-982c-8fe0cb995816", "comment": "Malware payload", "value": "a0508dab497aafe9031aab0358cbb57f", "object_relation": "md5", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641891, "uuid": "ec580167-0383-4955-b184-cce9a959e294", "comment": "Malware payload", "value": "f159c34d2ce19410ea9250675c92400e7d85050a3dbb0725d8ca6d02993f512c", "object_relation": "sha256", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641891, "uuid": "d33fe8bf-ca39-444f-95ea-89f0be46e165", "comment": "Malware payload", "value": "868dbd78ae9e627ef4d108e5e598e5ed06c32eb1", "object_relation": "sha1", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780641891, "uuid": "e7e695d8-6257-401e-86c1-cacda3260846", "comment": "Malware payload", "value": "f83f548d91a21591af2f1041b8f2daac5bc2168605e4563237eb19d82b5955f540b72d99ca5273dbff83e02d769f083c", "object_relation": "sha3-384", "Tag": [ { "name": "Bitcoin-Futures-LLC", "colour": "#735004", "exportable": true, "hide_tag": false }, { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641891, "uuid": "7a5ec564-c177-496f-8971-89ddaacc0edb", "value": "T1AE27DEC0F228F548E7550570582936A849662D303754D9BABE8F7AC259782EAFDF0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641891, "uuid": "3fb815c4-d294-4e39-af73-e2a8594a7220", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641891, "uuid": "bb78c47b-46d6-4ec5-bcef-5cc152bca6ec", "value": "393216:jXVxcaTtqtn2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlkf:jlxcaTtqtK2OGfEhP0JqHOG8qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780641891, "uuid": "e9fd281a-d5ef-49b4-866b-e39f66cd1e15", "value": 21106880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780641891, "uuid": "ea7297c8-a0f7-4ab4-889e-30ef88250589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780641891, "uuid": "68f5c5a3-b38c-4bc5-a64b-7ccf1a493331", "value": "f159c34d2ce19410ea9250675c92400e7d85050a3dbb0725d8ca6d02993f512c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf1b76f-60e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780667311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667311, "uuid": "1e6f6058-d1ae-4fe7-8385-453b163ef956", "comment": "Malware payload", "value": "a28f06fd35d4075bb2d69fa40c2dd2ad", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667311, "uuid": "e7aaef55-5e88-488d-9de7-0cd4e1055782", "comment": "Malware payload", "value": "f2c59c4f12e9725a468208a2a7d3ea474e24f123cb64d324735a75e07de5730f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667311, "uuid": "dda610a1-5e8e-4abe-a8de-3b8d4406f8ca", "comment": "Malware payload", "value": "53842f34efd66c9768b2a5b9e108442c108a2525", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780667311, "uuid": "689bd41f-85a6-4314-8aa5-52dea604bf93", "comment": "Malware payload", "value": "72c489a51f6f64b49579d640e4f2a2cdb55dc44832760638da6c6fcdfec03cc359f2d5c1e5b0a698028fad0cb230b240", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667311, "uuid": "7c160bcf-1907-40a4-b08c-7575074c7878", "value": "T1BEE01AEAA815A752400DEE44A07789597036EAD71590860C38EE20E9C8AC91DA229A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667311, "uuid": "02485eef-105c-4ba9-901e-00ef3075ee89", "value": "6:L6FnGj5AANaa626V6F45AAPgV6FTWX5AAvbT2V6FLX5AA6KIey:KGj5AANfN6N5AAYau5AAjT2eX5AA6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780667311, "uuid": "6f5f92ae-0ad5-4cdb-9d64-292998ee4f57", "value": 330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780667311, "uuid": "c84a5988-8f25-4b1b-999c-03f5188e9ea0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780667311, "uuid": "4c5f1cba-90d2-4080-ab7c-be0ce273d1e9", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61e23c3-60bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780649475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649475, "uuid": "76437a6a-0c74-4a10-9c7a-f4a2039124c9", "comment": "Malware payload", "value": "fa3a26394575d0c5242e9e6243868785", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649475, "uuid": "ed61617f-df12-4383-a8bf-3585c42df3f8", "comment": "Malware payload", "value": "f473b3b07fb16ef2f56989dcb681c0b6b70e728432ea0eb78b5a2bb701849b92", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649475, "uuid": "b04c890b-9c53-4749-93d6-44d5b3b8b49d", "comment": "Malware payload", "value": "dc8e40b769ed8e3936ab9afd62c3ea9125041111", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780649475, "uuid": "2539e1b0-33b5-4f00-a3e0-e0b6c3be9caf", "comment": "Malware payload", "value": "0efc8419817397e42c73b16cfbb98864fdd6d3641625e3d5f1ca35cd1b65642ebe8476a1d12a9e572a50a8a89c476124", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649475, "uuid": "9c010970-c161-4900-8565-8189b8d5a474", "value": "T132A18EE8F43A7B65AC17CB75E96F20F23F45493C87625B952BAE4E0C34C90C629030A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649475, "uuid": "4af427d9-7845-432d-a137-6e75623ea774", "value": "96:aYmDGL1Uek49M30u7xrsdQAJQ4x9iQQ9mzrdOSDZmIqAGX/FV0nqGbv:fuI+et2jFsykQ4xu9mzrdrYIq7NV0nqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780649475, "uuid": "182e4d85-d665-47e9-a9c7-9a9ae47833b9", "value": 4745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780649475, "uuid": "275688a8-f202-472c-8034-dec6fd213876", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780649475, "uuid": "f6049c43-2b7e-4131-a2ad-efa22f56806a", "value": "photo-708558833.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690677ec-60ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780657506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657506, "uuid": "b054547e-3beb-4829-84ca-6d156872d598", "comment": "Malware payload (Mirai)", "value": "ffd75be7aa0943ed052219bdc7b318de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657506, "uuid": "9d531f5e-4079-41dd-8f63-c3ca45a9f5d7", "comment": "Malware payload (Mirai)", "value": "f49b792a074e4460fc4476ba02d2639f9fea6faa057cf718142270ff1f91c2cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657506, "uuid": "667407a3-6512-473d-b7c8-b1acd6c9e5e9", "comment": "Malware payload (Mirai)", "value": "129184230319f5298cc1cda790fce8f851f4566b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657506, "uuid": "c2d74e21-a7a7-4470-8b3a-16d1f5ff9e2c", "comment": "Malware payload (Mirai)", "value": "e5535e38e8712331fd4dd3133f111279edad7f54548451efe4b7447c2c2becc943d47f7f13bf524a048ae64d787b653f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657506, "uuid": "6b8dca04-9957-4eca-a128-3969bbec5004", "value": "T157A35D97F401EE7DF80BD5BA04670A0AF630E3E51B930B366397BD67ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657506, "uuid": "f685a575-1787-47cf-8573-4c1327c7bf90", "value": "1536:iPhR5NhZp+huOzP6DxHd8P9foRRfZAuDbAV3GNPt8QkPa:ip3PSVWxHcqRhzhNPt8QkPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657506, "uuid": "b84c957b-77d8-423e-96fb-f140d5276bc5", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657506, "uuid": "471cc9a2-8285-4759-8826-8e792d77b54e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657506, "uuid": "312345cb-3447-402e-bdd3-a6f4f6866d06", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494944bd-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780648433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648433, "uuid": "31728179-9a37-4f0e-870a-35f7780a5e81", "comment": "Malware payload (Formbook)", "value": "7e9d69b6f2d881dd6fd34f9de9a22cf9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648433, "uuid": "8fceefe8-f128-4ff3-b9c9-73becb7c49ba", "comment": "Malware payload (Formbook)", "value": "f4be2ea5af9a53bf4f0b19c4ffdf7b4578691b901869dc7635b1670a4b70bbdb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648433, "uuid": "326957b0-781a-4b18-80c2-bcf60b509978", "comment": "Malware payload (Formbook)", "value": "16b256dca7e77ffd40b882716efb55e2f7ea2a37", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648433, "uuid": "1a15e8fa-3065-4d60-8efa-d4bb080466f0", "comment": "Malware payload (Formbook)", "value": "d9c84e19283cfcb74b8ca8219aa45fbfaba1af8bcefabb1198dd498bd0fdf7d864f46deddd0c65badde654bbbf9c96a1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648433, "uuid": "b16b4eb8-4b75-4812-b112-a7bc22342e7b", "value": "T1A9F253893BCDF1E14626B46B3F2BB496F12F4C81724C4484F36970C8F9B8718C9766A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648433, "uuid": "eec88b05-19ab-4859-9763-20467fe2b10e", "value": "384:zjDP4pocNUwWFF0aaMbUfArVmFSAwyWaYPcDhD11IBStj+lI2Lof7Wm9SVrlf0Vs:3zcoEUwu8VohS5tj00x9STf0VZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648433, "uuid": "fff9b9f0-8548-48c4-bdb5-f71f89ca8389", "value": 36368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648433, "uuid": "31aebc79-17f6-4349-b34d-91317adc4d72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648433, "uuid": "adb7b701-fd1c-4ebb-8626-f136092db473", "value": "ADA MED ADTIP REF 704405 ANTREPO DEV\u0130R 04,06,2026 .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f44d9a-6121-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780692980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692980, "uuid": "03927501-16ca-4118-b904-e4b1a3f4d2e8", "comment": "Malware payload (ACRStealer)", "value": "ae78d6cbdf6014353e2c68f8265a2604", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692980, "uuid": "3090dd96-5bf8-48f9-ad8e-eb8a261ac724", "comment": "Malware payload (ACRStealer)", "value": "f63c6700dfdbca563c741c862e159d2cadf669b386dc0cf7ee1aea57f10bf7d0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692980, "uuid": "8eec213a-ae44-4683-8c2b-7f8276e6b907", "comment": "Malware payload (ACRStealer)", "value": "8fc0b9fee63640681a766d90c905eefa48f7866a", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780692980, "uuid": "c5aa606a-e228-4158-a917-edd41833624a", "comment": "Malware payload (ACRStealer)", "value": "fd8cc0c9dcf46c4f3f3e507417d7ff08bb65f95a06dd5f27e3cdeb89f58fecd9b9105f01d812e7be0a2c298d2e5bf583", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "apexdataserver3-lol", "colour": "#C48E32", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692980, "uuid": "2dbf160e-0471-4ecc-ac78-94a2eff695b3", "value": "T164665B07BC9109E9C0AAB3318DB66292BB75BC480B3623C72E91B7782E737D05D76754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692980, "uuid": "78a52f9f-4307-479b-be25-b7717895d80a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692980, "uuid": "58399a56-b68e-4ef8-9d69-c4b24d4f6803", "value": "49152:pAT2FAo5CotnR1R7Z2UO5K7chfTovUIqnPkd:p7bX7cJEcpMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780692980, "uuid": "6c943a5b-6467-47b3-ac76-1d188104e3fc", "value": 6842504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780692980, "uuid": "07aae15a-d2e5-46d0-b5bc-d13e5c22919a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780692980, "uuid": "27980b6f-292c-45d4-9bdb-82a475ffb473", "value": "ojujn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef604312-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642270, "uuid": "4a9fb1a8-76c9-4adc-8752-bfd7c3b333e7", "comment": "Malware payload (RemusStealer)", "value": "a801d07c523772974051b486c5c6af80", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642270, "uuid": "a62a9b90-0851-441d-a433-2b8223be900b", "comment": "Malware payload (RemusStealer)", "value": "f6ce9315cde1cefb88ee60885abab8f6eb2d0e2eff1b04714fed7abf995ea840", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642270, "uuid": "49ee75bb-22c8-42fe-b469-521f8b4962cb", "comment": "Malware payload (RemusStealer)", "value": "405d0a635997980296ded64f6e15a92b50edd6ff", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642270, "uuid": "a61dbde8-da09-4b7f-89df-101d939fb097", "comment": "Malware payload (RemusStealer)", "value": "0dab653dc6aca9b7c7a44829cac2e3b1df3a35bcd505b69ca1ffafd33876055a85169b010f977e0c49f14220b957712a", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642270, "uuid": "1ed40eee-9f5c-43a6-990c-1434b9af3be5", "value": "T118A5290B7D9749E5C46A9235B9B231A93F30BCBD0B3223EB2F5076351E726D4587A708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642270, "uuid": "4e01eb68-3806-427f-a206-87efc3dc792a", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642270, "uuid": "56bc569e-6694-4cf1-aa43-039e43b7e9d7", "value": "24576:diCQ9TMBNDgYtZzoxpHFZCNPIg7qzSYOWtPWxtU/xTslm:diCQpMnDgYtBoJZCNPIg7kOLUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642270, "uuid": "1a04bc62-2c2c-4f83-8a07-1d914604a413", "value": 2115584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642270, "uuid": "7b421a53-ceea-44a9-a06d-137065131b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642270, "uuid": "f4c87c1a-f6a2-4aa9-8d93-5152ed77e840", "value": "f6ce9315cde1cefb88ee60885abab8f6eb2d0e2eff1b04714fed7abf995ea840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6de1e4-611a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780690157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690157, "uuid": "9741be78-17d0-4ff4-8eb1-0526fe9ed52e", "comment": "Malware payload (Mirai)", "value": "4fe2b29a9b6e093b1d26915f1fcdab4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690157, "uuid": "ae1d3a1f-277c-490f-aa01-854c21be469f", "comment": "Malware payload (Mirai)", "value": "f797bdb7f35e89d63a1302ba1c2fcc6442bb863020533dae7146b8925c1aedba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690157, "uuid": "62d1a952-4c31-475a-9402-468f9b828f65", "comment": "Malware payload (Mirai)", "value": "a698c1092aa1423fe507b7a3f85d1e72eef12e95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780690157, "uuid": "e1aac266-568d-4d84-8317-769df5cc6313", "comment": "Malware payload (Mirai)", "value": "1f1ae7a630031480e6bfc4a7853baa32615607e17f99b9e90e3aca73394abd5c3ce73f2ca307216e11f46db8fb1ed505", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690157, "uuid": "383e5859-9166-4350-b035-9961993d79a0", "value": "T1F5F32B06E9819F12D5D211B9FF5E414D37136F78D3EE32029D24AFA0778A8FB0A3A615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690157, "uuid": "fdf7c744-1d91-48e6-88c0-d6cd7b8f05b8", "value": "3072:qXw00mJt3AsBUOaItXXkNavj6lXHDwY9I/x6TnM/i3HXgDrr:qA00mJtbBFJXX8avj6lXHEY9Bnr3HwD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780690157, "uuid": "73f3f52b-6768-4737-8230-0be98612ada2", "value": 167108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780690157, "uuid": "0f99d3c0-7667-4712-9f31-d40dcb52115a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780690157, "uuid": "b42d350d-8dcd-4bb0-acf0-edd747d86644", "value": "nova.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f910057-6119-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780689622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689622, "uuid": "4b1f653c-8ea0-4e26-ba2d-46adcf5cf1a2", "comment": "Malware payload (Mirai)", "value": "afcb763d73acede216000874b2bdeac7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689622, "uuid": "ce50c68f-691e-4a5c-9af9-31bb9e97d8f3", "comment": "Malware payload (Mirai)", "value": "f7cf64bb5fa4c1102645773b7f880dc34a32fa9aac77f57a017b5bf43abcf344", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689622, "uuid": "77b86dbb-b432-4887-a337-723418ac8ace", "comment": "Malware payload (Mirai)", "value": "a6d461249b980e7b6afbae268e1c6b054e2a974f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780689622, "uuid": "2c7a5a2f-7f47-4267-8b16-c12d3a120d4d", "comment": "Malware payload (Mirai)", "value": "52cecd61a28ff2793f1f62c16ba2a0247e64937459a6127ab6d97bea3fb1967dd8e4d14f4cdfe03e04031ce3baeb1556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689622, "uuid": "22162f84-c38e-46ac-9c48-664cb86693cc", "value": "T19423013A524DF945A9B10CF2D428CBC73E570B75847E5B0B58E50EA2AE7540BE23B1EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689622, "uuid": "a2a8e2e7-dc21-43ab-bdbb-a693d340bfdd", "value": "768:lkEb5dyz6Y/LYr5kbHOY8Qu3B4a/OF/njj+zdlztilxp2YNeahifZs5gMyhks3Uc:l5UN/G5kbZ04a/ORuZUxXNea4fKCPz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780689622, "uuid": "140cbf4c-aa60-441c-8531-8cd944696e2d", "value": 50096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780689622, "uuid": "7e3563e7-dca4-494c-bfec-7f2d3e8c9132", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780689622, "uuid": "84711dba-290b-4f78-b530-e8ab17eafcac", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc6c83d-60b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780645250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645250, "uuid": "fa30ad31-ee25-43ed-be8c-702061bc7455", "comment": "Malware payload", "value": "cbb61a9b42b09a998d76e4f724656b16", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645250, "uuid": "3b6fb417-2c38-4a44-ae4f-53663394192f", "comment": "Malware payload", "value": "f85f1b29c0c05b4bdf7458e9870829b8af05113667c65541e1b867193a3d26c5", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645250, "uuid": "6e9875fb-1903-49bb-9f72-67ae83985dd7", "comment": "Malware payload", "value": "d01b5b33e13d54d7ac257d00baeadf4fa1a83b56", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780645250, "uuid": "3d504045-ba7e-46ba-8ad0-e04624284e47", "comment": "Malware payload", "value": "919b9869eb034569eb3ec7eb4e475441d585957306ab379994093c10ac91ea03b5807de17439e416135f9728507aefe1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quantifyr-site", "colour": "#C1695D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645250, "uuid": "b05d42e2-73b2-4474-8243-5923a406aee0", "value": "T15114E5A94E5B38C8986528D2C65270826FA5073F6D3DC8437B613E41622F71ADBCDB4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645250, "uuid": "d8b2a69b-235c-467a-8022-4bdcd6b1c9dd", "value": "6144:a6gPBqQkZxAmd4enFmv1UxqllCjhJg8W5SafS:ePbkZDn8v1KqlEJg8aS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780645250, "uuid": "ee017e85-4640-4b25-bcdd-cc8e77cf48a4", "value": 205950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780645250, "uuid": "b9e9dc75-279c-4db7-921d-ec8d90707ad7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780645250, "uuid": "b8858529-0dac-47dd-a304-ac4bdc94b427", "value": "f85f1b29c0c05b4bdf7458e9870829b8af05113667c65541e1b867193a3d26c5.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0e2780-60aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780642262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642262, "uuid": "78b6f313-c99d-4163-b0c3-41746c13c1a2", "comment": "Malware payload (RemusStealer)", "value": "27072f26b94d1a418b6fb12d7cc968f0", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642262, "uuid": "2772448e-f0dd-43f7-a457-d17e24ddda9b", "comment": "Malware payload (RemusStealer)", "value": "f8fdcbbb82f1f8737430ba8c17ba61c6e775df9c54a5cd527680b78d2a2cc609", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642262, "uuid": "47797615-09a5-4b55-aadf-3d249f778a87", "comment": "Malware payload (RemusStealer)", "value": "7f257bdfec7193d00deb3255409edc24bac2c483", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780642262, "uuid": "92c0a747-e928-4586-b484-04f4289dac28", "comment": "Malware payload (RemusStealer)", "value": "0036eac50cc48e8bb4f787dd16368780afcb8a93143acc1b6952deb1ae5786227dbb4a6b3e874a654f2d9567ef0384fc", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642262, "uuid": "7579b0a9-43bc-4daf-9815-d2d23a7639e5", "value": "T18D14386BD25371FCE553C07882667231B732B63907346EF742A2D730AE329D06E78969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642262, "uuid": "cc3a585b-a02b-4ae5-9e83-249af1c0851f", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642262, "uuid": "f61a5925-0461-42d3-9670-531d2996d2ab", "value": "6144:epFJxVbqzn7nZsdAzjOj2lvF8EIuasoyqYY:etxVbqYQlvFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780642262, "uuid": "0cf37fa0-f1a3-47ab-b38b-a3bf3b9d34af", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780642262, "uuid": "81c2bb0a-b694-4eff-b50a-ffd65b0a37ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780642262, "uuid": "c15512f6-7f7d-485b-9f57-02eca61758a6", "value": "f8fdcbbb82f1f8737430ba8c17ba61c6e775df9c54a5cd527680b78d2a2cc609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ea8844-6077-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780620138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780620138, "uuid": "d3cf1872-e166-4dca-939e-ff60646721b2", "comment": "Malware payload", "value": "1805f77c59a4c3ab267f876636db0f38", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780620138, "uuid": "77b26799-cd24-4c06-88b7-90fa8faf470d", "comment": "Malware payload", "value": "f9ee87e82586f945f4d3616fab697072ff76d9c03bee1ce671ba652fdcec8498", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780620138, "uuid": "29479c61-123f-4886-ac8e-77ca0d83d689", "comment": "Malware payload", "value": "e1d8bb64cd7c9386fcd470e5c8e6257874de0cd8", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780620138, "uuid": "aae4f41d-eb8c-498b-b7ad-9e7c73e57a46", "comment": "Malware payload", "value": "6c319dab8871a5267e84ad2af170840f88446ec6e6bdb7ebabd77c423c5e0eed812c0a3e788702185cc875dadb912c97", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780620138, "uuid": "332a76d8-975a-4694-9feb-ae3f6ca93234", "value": "T12FE43A97EE9001F6D21EE23585A77329D737BC3D27A28F8F529A1D151F372984A3A310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780620138, "uuid": "aebead9b-711b-44f1-923e-c2e341219006", "value": "d3af97c4fa45b300c1ab28c930e68ae9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780620138, "uuid": "59d1b92e-3349-4922-b7d2-8521b2b7f02c", "value": "12288:l42oGeOhFkZ8YB1gs8D93jIdBh1pSHo539plp:l42oshFi1B1gs8DFjMBRa439Dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780620138, "uuid": "362084c6-5aa0-404d-88f9-560c65360e2d", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780620138, "uuid": "8494a095-c2a1-4730-8c4e-a1659d8d389e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780620138, "uuid": "9d81c67b-29a1-4c2a-bb14-e9bdf86da4d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1025be59-60a2-11f1-a769-42010a9c0008", "comment": "Malware payload (MasonRAT)", "timestamp": 1780638459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638459, "uuid": "28542b7e-a408-4a47-b309-857ff6e50b06", "comment": "Malware payload (MasonRAT)", "value": "d56d7496841160f1e78193ded872183d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638459, "uuid": "e2e6f9f0-8662-4169-8182-d3553b6fafc3", "comment": "Malware payload (MasonRAT)", "value": "fa1f349170f67960d99d2553077d1b4a46eb2bc3b781a07300ff7cc8816f1d04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638459, "uuid": "3a458f90-585f-4fc7-a13b-f812a114c84f", "comment": "Malware payload (MasonRAT)", "value": "d0e5e44c5bb00a00a1df0dbc46ccdee27bc0aab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780638459, "uuid": "cf075b09-3f17-4280-846b-8c193c8b878b", "comment": "Malware payload (MasonRAT)", "value": "5cc6c9ecf09f658521c19190a9ba97baedab035daa830e7458034bef1d86a52208524649e709cdf2ac2c905ebf683079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MasonRAT", "colour": "#402B2F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638459, "uuid": "b54067b9-d92e-410d-bd49-b38d4c6bae7a", "value": "T19DB5BF0973EE45F8CA6A4074CC03B723CEA1781E623853791BD9AD916BE532816FDB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638459, "uuid": "2221f7d5-c4eb-4a31-94da-6c2676e006de", "value": "34db57be92f91b358ff5dda6df78fd69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638459, "uuid": "c8bff9bb-c78f-4b8a-8204-75aa78b91478", "value": "49152:SPNVyQ+/rttOo+KTVoMMBuV+xN32b25/P40:oVyLtPrMBuVV2N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780638459, "uuid": "d0e03973-74e7-4958-a3a4-9bf235ade9b4", "value": 2299036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780638459, "uuid": "93be35d1-f401-4ac0-b820-387c9d8c8d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780638459, "uuid": "e866ddee-16ce-493c-8dc7-f522c3425c0b", "value": "CodCheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64c13b1-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780643087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643087, "uuid": "23c37be1-9918-454b-bf82-5513bd1ab247", "comment": "Malware payload", "value": "676268064d334f31c3e90a79650ce071", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643087, "uuid": "41ef0938-75e4-4d14-9f22-3e3a5d3c74a8", "comment": "Malware payload", "value": "fd13c4819d6f9fa99f9240845fb31ec27a592630dc80a432bb036f358b6c8b38", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643087, "uuid": "e6238cf2-fb45-43b7-b47a-15d2f636709c", "comment": "Malware payload", "value": "22416cb712e177a360c0514278f1c3fc2517acc2", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643087, "uuid": "1d06d083-bd1b-4a0b-a7e2-375bf49536fe", "comment": "Malware payload", "value": "9d450bb9931369f74e053db0e8d52e422d662682594fbf79ad3e012937704fa36d3078febad744adc12107f5f16cbe17", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643087, "uuid": "9da2f7ca-72ac-4efb-9e33-cf5ed64ede6b", "value": "T1AB51EF8D34F3A082C2B26029457F799AFA289A95874CDA14863D97BCBC710ED6317F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643087, "uuid": "96512379-8eb4-4cc2-9e3b-6dd1d54ea159", "value": "48:/OAm9KsV4c1n+5+6Fw3Fbl50+14WcC1TmWazLlB8bVxlBuLUjgOt3ZfuT2ACB:WAm9KI4cRY8oWcC1TmJzLlB0VxH9RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643087, "uuid": "a1c94c35-b6b8-4d68-abbc-4c106f74a370", "value": 3073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643087, "uuid": "f66a064c-a73b-4fb0-b31b-71e0ea27f096", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643087, "uuid": "1565c277-fc8b-4563-84ec-d31940cc89e2", "value": "fd13c4819d6f9fa99f9240845fb31ec27a592630dc80a432bb036f358b6c8b38.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8b149a-60ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780657512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657512, "uuid": "f0ef9d7b-0e23-404b-96c1-18f2dd887b6b", "comment": "Malware payload (Mirai)", "value": "3df9cfd86cb9367fd370725998fac232", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657512, "uuid": "c60e7c2b-eb58-41fa-a0a2-fb306d966c0d", "comment": "Malware payload (Mirai)", "value": "fdbe6b99cf5be0dfb585f42974e993f54b907fde86a404981fc1e4b0ea41a22c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657512, "uuid": "a91d2752-b5d4-43f1-a17f-24cb5c2f72e7", "comment": "Malware payload (Mirai)", "value": "805f9040c014202c813a527d45ef976c09e4f4e5", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657512, "uuid": "682f133b-3345-45ec-ade2-a2ee6d35b558", "comment": "Malware payload (Mirai)", "value": "b645e25c16c75b7517d981815f9c1666c3e3035665b0e9b41ca38362205c545a499903699057534de959a359896d8e8a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657512, "uuid": "fae29db2-326e-4039-bc85-771c6ececb4a", "value": "T1B383AD32EA292D44C0455570B0B98F395B73A5C083476FB66AFAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657512, "uuid": "4be5e667-c598-4b62-afaa-a86846c44a32", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7w:UeAsdukuhoNJVwbmuUqjLjwWiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657512, "uuid": "25ae950f-c9b2-4172-a9c8-26fa982c11c6", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657512, "uuid": "de595786-574d-4d73-b262-290ffc2180f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657512, "uuid": "04885b97-c78e-4a3e-ad01-897416dc3b74", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aad0260-60cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780657133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657133, "uuid": "3bb09441-86a6-4bb0-8666-815bfd22d53a", "comment": "Malware payload", "value": "8bab1a4feebc5d284d0da7aa53ebebc5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657133, "uuid": "28c070d4-6eb1-4e86-8f2a-0f91a9791690", "comment": "Malware payload", "value": "feb02b267842318a80bd5e052e4bdbe4956f5b4d9c92a9f97bb24061e3b5af7d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657133, "uuid": "5213e406-f5fd-42d6-ac0a-55113fda7189", "comment": "Malware payload", "value": "c43644750c5765eb3951469b970db03121291170", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780657133, "uuid": "9e15a146-0d8c-457c-b737-701595ea71cb", "comment": "Malware payload", "value": "4578ff99c4c214b9ce957cfced8a1fe62335d6247deef9200ba495ad72e09ea4219eabad93b966b9bbf1ab5f3644c5f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657133, "uuid": "0657310a-66c2-40ef-945b-45ce24e5441b", "value": "T1E8521B09BB884627DC6E0F3B9CA755406678E9875907DF1BBDCCE30E5CDB16C8622398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657133, "uuid": "672ca894-fcf5-4581-a833-ef86066e1671", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657133, "uuid": "0c06c7a9-085b-4ca7-a061-f58449d01fd3", "value": "192:58RAc4kpxBHcRmD84sNdQEk4ISUUxS8wP4etUWQPlFNPOT0thBeI5k/23o8m:WAc4kHmO8PNEvSS8wP4etRQNFfhGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780657133, "uuid": "0b1b4ea3-2aad-4545-ab59-ed796fc915bc", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780657133, "uuid": "e01e562e-389c-41db-97a2-91ae80b44866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780657133, "uuid": "e14261a1-09ee-4f21-881f-b89776f65206", "value": "RustVentTank.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1190233-60ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780643132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643132, "uuid": "7f7865bc-3f38-48b4-88eb-d24aa3e935b2", "comment": "Malware payload", "value": "185215f9f63c7503655fc95f6daf68d0", "object_relation": "md5", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643132, "uuid": "b7729d15-4f90-4930-b73f-83c955aa0691", "comment": "Malware payload", "value": "ffad5f6c82f666a7572b3b91e4e6042407d36b290cd4dc081a828ff0b5691798", "object_relation": "sha256", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643132, "uuid": "e7aae2a2-a419-42e3-8324-9924ac6a6f2e", "comment": "Malware payload", "value": "f4ea8667ce516cc16306496d5a58d1e8d5e53c0d", "object_relation": "sha1", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780643132, "uuid": "80b5bdf3-fc9b-4e98-9149-beaf7a234b67", "comment": "Malware payload", "value": "1dea927095180b9617bd12c3b778c9a8cdee555c4d1e2764dd541a2f964bc5728b6b56671bcb83aff3e64ffa0d046139", "object_relation": "sha3-384", "Tag": [ { "name": "Click-Hijacking-TDS", "colour": "#B0BB30", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643132, "uuid": "265fe8b5-44ad-487d-b8af-8d58f1925ede", "value": "T1C651219D34F3A0C282B26025053FB99AFA389A91834CDA14863D96BCBC755DD7367F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643132, "uuid": "52625b6a-c49c-4829-b2e4-3fe91587f664", "value": "48:mYbc5KJyEc1n+5+6Fw3Fbl50+14WcC1TmWazLlB8ZLVxlBuLUjgOt3ZfuT2ACB:mYbc0yEcRY8oWcC1TmJzLlB8VxH9RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780643132, "uuid": "a6f90d35-197f-4c00-b041-f7de08f15831", "value": 3056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780643132, "uuid": "89fe1e31-98c5-44f6-9f2e-f6045355d644", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780643132, "uuid": "77946837-3166-4156-a8e5-ecc2a9a59cf4", "value": "ffad5f6c82f666a7572b3b91e4e6042407d36b290cd4dc081a828ff0b5691798.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1cb99b-60b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780648653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648653, "uuid": "0debbbfc-2a1c-4ca9-b5b6-2f502c991611", "comment": "Malware payload", "value": "9afcd53881df58b442a8161010b08de8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648653, "uuid": "d17d499b-db96-4259-9700-2fc8890dc1df", "comment": "Malware payload", "value": "ffe4afcd49e58c7256bef8349d29c727c61ba75c2d489097947bf38fbe7005bf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648653, "uuid": "711b1523-51b4-4d47-8ff7-b41c1e1a0de9", "comment": "Malware payload", "value": "cbe0874ec6d8c7f5557da455e6561cd0ddf25a3e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780648653, "uuid": "56cff58b-8cff-4f36-831f-ec06a92bddf9", "comment": "Malware payload", "value": "35978faff95a16a207d41d270a471511e1883441cb343178454cc3597c02c9ab53bf2a2d7e97fdfffca20a59a4c554d3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648653, "uuid": "ccd10a80-72ef-4a68-a93e-4e64317c1c24", "value": "T15205F62DCC18412EF137D51A8496085FF8A2168B623CE94770C77B5FAE66882B7D739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648653, "uuid": "ea05b6ba-b08a-449c-86be-2ef5573bf130", "value": "3072:rrTWUFE7izHAZWQx23Fr5OyeTZ8kfN+KtnSu0tEcbZGWE27if9fzSiDux6iBe9O7:vIizHA4yK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780648653, "uuid": "db3da696-f011-4441-9384-a77e354c2880", "value": 806540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780648653, "uuid": "a52a054d-0871-48d9-bd99-55f54f4f0d9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780648653, "uuid": "fff05289-b722-4188-842e-d3f9d08ad191", "value": "Invoive INV-PO26-2602-2760009.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }